r4391: bring the default ACL inline with what w2k3 uses