diff --git a/source4/dsdb/common/dsdb_access.c b/source4/dsdb/common/dsdb_access.c
index b8784fc62f7..fd75e77541e 100644
--- a/source4/dsdb/common/dsdb_access.c
+++ b/source4/dsdb/common/dsdb_access.c
@@ -152,9 +152,12 @@ int dsdb_check_access_on_dn(struct ldb_context *ldb,
 		"objectSid",
 		NULL
 	};
-	NTSTATUS status = GUID_from_string(ext_right, &guid);
-	if (!NT_STATUS_IS_OK(status)) {
-		return LDB_ERR_OPERATIONS_ERROR;
+
+	if (ext_right != NULL) {
+		NTSTATUS status = GUID_from_string(ext_right, &guid);
+		if (!NT_STATUS_IS_OK(status)) {
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
 	}
 
 	ret = dsdb_search_dn(ldb, mem_ctx, &acl_res, dn, acl_attrs, DSDB_SEARCH_SHOW_DELETED);
@@ -168,6 +171,6 @@ int dsdb_check_access_on_dn(struct ldb_context *ldb,
 						token,
 						dn,
 						access_mask,
-						&guid);
+						ext_right ? &guid : NULL);
 }