diff --git a/lib/api/kolab_api_service_domain.php b/lib/api/kolab_api_service_domain.php
--- a/lib/api/kolab_api_service_domain.php
+++ b/lib/api/kolab_api_service_domain.php
@@ -314,13 +314,13 @@
                 '(targetattr = "*")'
                 . '(version 3.0; acl "Deny Unauthorized"; deny (all)'
                 . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmt_root_dn . ' || '
-                . 'ldap:///ou=People,' . $domain_root_dn . '??sub?(objectclass=inetorgperson)") AND NOT '
+                . 'ldap:///' . $domain_root_dn . '??sub?(objectclass=inetorgperson)") AND NOT '
                 . 'roledn = "ldap:///cn=kolab-admin,' . $mgmt_root_dn . '";)',
 
                 '(targetattr != "userPassword")'
                 . '(version 3.0;acl "Search Access";allow (read,compare,search)'
                 . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmt_root_dn . ' || '
-                . 'ldap:///ou=People,' . $domain_root_dn . '??sub?(objectclass=inetorgperson)");)',
+                . 'ldap:///' . $domain_root_dn . '??sub?(objectclass=inetorgperson)");)',
 
                 '(targetattr = "*")'
                 . '(version 3.0;acl "Kolab Administrators";allow (all)'
@@ -390,13 +390,13 @@
             '(targetattr = "*")'
             . '(version 3.0;acl "Deny Unauthorized"; deny (all)'
             . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmt_root_dn . ' || '
-            . 'ldap:///ou=People,' . $domain_root_dn . '??sub?(objectclass=inetorgperson)") AND NOT '
+            . 'ldap:///' . $domain_root_dn . '??sub?(objectclass=inetorgperson)") AND NOT '
             . 'roledn = "ldap:///cn=kolab-admin,' . $mgmt_root_dn . '";)',
 
             '(targetattr != "userPassword")'
-            . '(version 3.0;acl "Search Access";allow (read,compare,search,write)'
+            . '(version 3.0;acl "Search Access";allow (read,compare,search)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmt_root_dn . ' || '
-            . 'ldap:///ou=People,' . $domain_root_dn . '??sub?(objectclass=inetorgperson)");)',
+            . 'ldap:///' . $domain_root_dn . '??sub?(objectclass=inetorgperson)");)',
 
             '(targetattr = "*")'
             . '(version 3.0;acl "Kolab Administrators";allow (all)'