Hello, >> Where am I making a mistake? >access to dn.subtree=ou=removed_accounts,ou=people,o=suffix by none >access to dn.one=ou=people,o=suffix by * write Ok, that works like a charm! Follow-up question (this probably shows I don't know much about ACLs): Why do I need to limit the scope via another ACL if I have one in place which itself should already limit the scope of a search on a subtree? Cheers, Claus