diff --git a/selftest/knownfail.d/samba3.blackbox.test_veto_files.get_veto_file b/selftest/knownfail.d/samba3.blackbox.test_veto_files.get_veto_file
deleted file mode 100644
index ff8f37f0509..00000000000
--- a/selftest/knownfail.d/samba3.blackbox.test_veto_files.get_veto_file
+++ /dev/null
@@ -1 +0,0 @@
-^samba3.blackbox.test_veto_files.create_veto_file\(fileserver\)
diff --git a/source3/smbd/filename.c b/source3/smbd/filename.c
index e5cb3c867cd..a5ee0392bae 100644
--- a/source3/smbd/filename.c
+++ b/source3/smbd/filename.c
@@ -752,7 +752,7 @@ static NTSTATUS openat_pathref_fsp_case_insensitive(
 	if (IS_VETO_PATH(dirfsp->conn, smb_fname_rel->base_name)) {
 		DBG_DEBUG("veto files rejecting last component %s\n",
 			  smb_fname_str_dbg(smb_fname_rel));
-		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+		return NT_STATUS_NETWORK_OPEN_RESTRICTION;
 	}
 
 	status = openat_pathref_fsp(dirfsp, smb_fname_rel);
@@ -818,7 +818,7 @@ static NTSTATUS openat_pathref_fsp_case_insensitive(
 			DBG_DEBUG("veto files rejecting last component %s\n",
 				  smb_fname_str_dbg(smb_fname_rel));
 			TALLOC_FREE(cache_key.data);
-			return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+			return NT_STATUS_NETWORK_OPEN_RESTRICTION;
 		}
 
 		status = openat_pathref_fsp(dirfsp, smb_fname_rel);
@@ -848,7 +848,7 @@ lookup:
 		if (IS_VETO_PATH(dirfsp->conn, smb_fname_rel->base_name)) {
 			DBG_DEBUG("veto files rejecting last component %s\n",
 				smb_fname_str_dbg(smb_fname_rel));
-			return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+			return NT_STATUS_NETWORK_OPEN_RESTRICTION;
 		}
 
 		status = openat_pathref_fsp(dirfsp, smb_fname_rel);
@@ -1292,6 +1292,10 @@ static NTSTATUS filename_convert_dirfsp_nosymlink(
 		goto done;
 	}
 
+	if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_OPEN_RESTRICTION)) {
+		/* A vetoed file, pretend it's not there  */
+		status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
+	}
 	if (!NT_STATUS_IS_OK(status)) {
 		goto fail;
 	}