diff --git a/docs-xml/smbdotconf/filename/vetofiles.xml b/docs-xml/smbdotconf/filename/vetofiles.xml
index acbc3dcffb3..11bb51e6c76 100644
--- a/docs-xml/smbdotconf/filename/vetofiles.xml
+++ b/docs-xml/smbdotconf/filename/vetofiles.xml
@@ -1,6 +1,7 @@
 <samba:parameter name="veto files"
                  context="S"
                  type="string"
+                 substitution="1"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
  <description>
 	<para>
diff --git a/source3/modules/vfs_fruit.c b/source3/modules/vfs_fruit.c
index 02aaa34da88..265abdcb304 100644
--- a/source3/modules/vfs_fruit.c
+++ b/source3/modules/vfs_fruit.c
@@ -1254,6 +1254,8 @@ static int fruit_connect(vfs_handle_struct *handle,
 	int rc;
 	char *list = NULL, *newlist = NULL;
 	struct fruit_config_data *config;
+	const struct loadparm_substitution *lp_sub =
+		loadparm_s3_global_substitution();
 
 	DEBUG(10, ("fruit_connect\n"));
 
@@ -1271,7 +1273,7 @@ static int fruit_connect(vfs_handle_struct *handle,
 				struct fruit_config_data, return -1);
 
 	if (config->veto_appledouble) {
-		list = lp_veto_files(talloc_tos(), SNUM(handle->conn));
+		list = lp_veto_files(talloc_tos(), lp_sub, SNUM(handle->conn));
 
 		if (list) {
 			if (strstr(list, "/" ADOUBLE_NAME_PREFIX "*/") == NULL) {
diff --git a/source3/smbd/close.c b/source3/smbd/close.c
index 18defc1ac5c..6b63ea2c64e 100644
--- a/source3/smbd/close.c
+++ b/source3/smbd/close.c
@@ -927,6 +927,8 @@ static NTSTATUS rmdir_internals(TALLOC_CTX *ctx, files_struct *fsp)
 {
 	connection_struct *conn = fsp->conn;
 	struct smb_filename *smb_dname = fsp->fsp_name;
+	const struct loadparm_substitution *lp_sub =
+		loadparm_s3_global_substitution();
 	int ret;
 
 	SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
@@ -961,7 +963,7 @@ static NTSTATUS rmdir_internals(TALLOC_CTX *ctx, files_struct *fsp)
 		return NT_STATUS_OK;
 	}
 
-	if(((errno == ENOTEMPTY)||(errno == EEXIST)) && *lp_veto_files(talloc_tos(), SNUM(conn))) {
+	if(((errno == ENOTEMPTY)||(errno == EEXIST)) && *lp_veto_files(talloc_tos(), lp_sub, SNUM(conn))) {
 		/*
 		 * Check to see if the only thing in this directory are
 		 * vetoed files/directories. If so then delete them and
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index f82bc0d5d13..54979f77ffb 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -824,7 +824,7 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn,
 	/* Add veto/hide lists */
 	if (!IS_IPC(conn) && !IS_PRINT(conn)) {
 		set_namearray( &conn->veto_list,
-			       lp_veto_files(talloc_tos(), snum));
+			       lp_veto_files(talloc_tos(), lp_sub, snum));
 		set_namearray( &conn->hide_list,
 			       lp_hide_files(talloc_tos(), lp_sub, snum));
 		set_namearray( &conn->veto_oplock_list,