DOMAIN_NOACCESS
(domain_val(DOMAIN_USER, DOMAIN_NOACCESS) | \
(__DACR_DEFAULT | domain_val(DOMAIN_USER, DOMAIN_NOACCESS))
domain_val(DOMAIN_USER, DOMAIN_NOACCESS))