Fixing share Acl for domain-based DFS Domain-based DFS and stand-alone DFS security descriptors are stored differently. For domain-based DFS namespaces, the security descriptor is stored in Active Directory. For stand-alone DFS namespaces, the security descriptor is stored on the stand-alone server.