smbcacls text outputs includes the CONTROL line, but when using -S to restore the output generated by smbcacls, it fails with: Failed to parse token 'CONTROL:...' in security descriptor The sec_desc_parse() function doesn't know how to handle the CONTROL line. Removing the CONTROL line when setting ACLs with -S works, but this changes the current CONTROL value when generating the text version of the ACLs again.