Now reading the description of the TRUSTEE structure at <http://msdn.microsoft.com/en-us/library/aa379636(VS.85).aspx>, I see the following under "Remarks": > A trustee name can have any of the following formats: > > * A fully qualified name, such as "g:\remotedir\abc". That looks like a file name; can anyone explain what such a thing means as a trustee? Does it mean the ACE should apply to any process executing that file, similar to the setuid flag on Unix? From the "remotedir" name, one might also assume that g: has been mapped to a network file server, in case that has any relevance.