diff --git a/tst/memfs/memfs-main.c b/tst/memfs/memfs-main.c
index 77531877..3cd1ac07 100644
--- a/tst/memfs/memfs-main.c
+++ b/tst/memfs/memfs-main.c
@@ -55,6 +55,7 @@ static void usage(void)
         "    -t FileInfoTimeout\n"
         "    -n MaxFileNodes\n"
         "    -s MaxFileSize\n"
+        "    -S RootSddl"
         "    -u \\\\Volume\\Prefix\n"
         "    -m MountPoint\n";
 
@@ -99,6 +100,7 @@ int wmain(int argc, wchar_t **argv)
     ULONG MaxFileSize = 1024 * 1024;
     PWSTR MountPoint = 0;
     PWSTR VolumePrefix = 0;
+    PWSTR RootSddl = 0;
 
     for (argp = argv + 1; 0 != argp[0]; argp++)
     {
@@ -112,6 +114,9 @@ int wmain(int argc, wchar_t **argv)
         case L'n':
             MaxFileNodes = argtol(++argp, MaxFileNodes);
             break;
+        case L'S':
+            RootSddl = argtos(++argp);
+            break;
         case L's':
             MaxFileSize = argtol(++argp, MaxFileSize);
             break;
@@ -135,7 +140,8 @@ int wmain(int argc, wchar_t **argv)
     if (0 == MainEvent)
         fail("error: cannot create MainEvent");
 
-    Result = MemfsCreate(Flags, FileInfoTimeout, MaxFileNodes, MaxFileSize, VolumePrefix, &Memfs);
+    Result = MemfsCreate(Flags, FileInfoTimeout, MaxFileNodes, MaxFileSize, VolumePrefix, RootSddl,
+        &Memfs);
     if (!NT_SUCCESS(Result))
         fail("error: cannot create MEMFS");
     Result = MemfsStart(Memfs);
@@ -146,8 +152,9 @@ int wmain(int argc, wchar_t **argv)
         fail("error: cannot mount MEMFS");
     MountPoint = FspFileSystemMountPoint(MemfsFileSystem(Memfs));
 
-    warn("%s -t %ld -n %ld -s %ld%s%S -m %S",
+    warn("%s -t %ld -n %ld -s %ld%s%S%s%S -m %S",
         PROGNAME, FileInfoTimeout, MaxFileNodes, MaxFileSize,
+        RootSddl ? " -S " : "", RootSddl ? RootSddl : L"",
         VolumePrefix ? " -u " : "", VolumePrefix ? VolumePrefix : L"",
         MountPoint);
     SetConsoleCtrlHandler(ConsoleCtrlHandler, TRUE);
diff --git a/tst/memfs/memfs.cpp b/tst/memfs/memfs.cpp
index 50fc2578..07443120 100644
--- a/tst/memfs/memfs.cpp
+++ b/tst/memfs/memfs.cpp
@@ -6,6 +6,7 @@
 
 #undef _DEBUG
 #include "memfs.h"
+#include <sddl.h>
 #include <map>
 #include <cassert>
 
@@ -836,9 +837,13 @@ static VOID MemfsLeaveOperation(FSP_FILE_SYSTEM *FileSystem,
     LeaveCriticalSection(&Memfs->Lock);
 }
 
-NTSTATUS MemfsCreate(ULONG Flags, ULONG FileInfoTimeout,
-    ULONG MaxFileNodes, ULONG MaxFileSize,
+NTSTATUS MemfsCreate(
+    ULONG Flags,
+    ULONG FileInfoTimeout,
+    ULONG MaxFileNodes,
+    ULONG MaxFileSize,
     PWSTR VolumePrefix,
+    PWSTR RootSddl,
     MEMFS **PMemfs)
 {
     NTSTATUS Result;
@@ -848,13 +853,24 @@ NTSTATUS MemfsCreate(ULONG Flags, ULONG FileInfoTimeout,
     UINT64 AllocationUnit;
     MEMFS *Memfs;
     MEMFS_FILE_NODE *RootNode;
+    PSECURITY_DESCRIPTOR RootSecurity;
+    ULONG RootSecuritySize;
     BOOLEAN Inserted;
 
     *PMemfs = 0;
 
+    if (0 == RootSddl)
+        RootSddl = L"O:BAG:BAD:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;WD)";
+    if (!ConvertStringSecurityDescriptorToSecurityDescriptorW(RootSddl, SDDL_REVISION_1,
+        &RootSecurity, &RootSecuritySize))
+        return FspNtStatusFromWin32(GetLastError());
+
     Memfs = (MEMFS *)malloc(sizeof *Memfs);
     if (0 == Memfs)
+    {
+        LocalFree(RootSecurity);
         return STATUS_INSUFFICIENT_RESOURCES;
+    }
 
     memset(Memfs, 0, sizeof *Memfs);
     Memfs->MaxFileNodes = MaxFileNodes;
@@ -865,6 +881,7 @@ NTSTATUS MemfsCreate(ULONG Flags, ULONG FileInfoTimeout,
     if (!NT_SUCCESS(Result))
     {
         free(Memfs);
+        LocalFree(RootSecurity);
         return Result;
     }
 
@@ -886,6 +903,7 @@ NTSTATUS MemfsCreate(ULONG Flags, ULONG FileInfoTimeout,
     {
         MemfsFileNodeMapDelete(Memfs->FileNodeMap);
         free(Memfs);
+        LocalFree(RootSecurity);
         return Result;
     }
 
@@ -907,19 +925,34 @@ NTSTATUS MemfsCreate(ULONG Flags, ULONG FileInfoTimeout,
     if (!NT_SUCCESS(Result))
     {
         MemfsDelete(Memfs);
+        LocalFree(RootSecurity);
         return Result;
     }
 
     RootNode->FileInfo.FileAttributes = FILE_ATTRIBUTE_DIRECTORY;
 
+    RootNode->FileSecurity = malloc(RootSecuritySize);
+    if (0 == RootNode->FileSecurity)
+    {
+        MemfsFileNodeDelete(RootNode);
+        MemfsDelete(Memfs);
+        LocalFree(RootSecurity);
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+    RootNode->FileSecuritySize = RootSecuritySize;
+    memcpy(RootNode->FileSecurity, RootSecurity, RootSecuritySize);
+
     Result = MemfsFileNodeMapInsert(Memfs->FileNodeMap, RootNode, &Inserted);
     if (!NT_SUCCESS(Result))
     {
         MemfsFileNodeDelete(RootNode);
         MemfsDelete(Memfs);
+        LocalFree(RootSecurity);
         return Result;
     }
 
+    LocalFree(RootSecurity);
+
     *PMemfs = Memfs;
 
     return STATUS_SUCCESS;
diff --git a/tst/memfs/memfs.h b/tst/memfs/memfs.h
index 1a706926..ca71dd11 100644
--- a/tst/memfs/memfs.h
+++ b/tst/memfs/memfs.h
@@ -21,9 +21,13 @@ enum
     MemfsNet                            = 0x01,
 };
 
-NTSTATUS MemfsCreate(ULONG Flags, ULONG FileInfoTimeout,
-    ULONG MaxFileNodes, ULONG MaxFileSize,
+NTSTATUS MemfsCreate(
+    ULONG Flags,
+    ULONG FileInfoTimeout,
+    ULONG MaxFileNodes,
+    ULONG MaxFileSize,
     PWSTR VolumePrefix,
+    PWSTR RootSddl,
     MEMFS **PMemfs);
 VOID MemfsDelete(MEMFS *Memfs);
 NTSTATUS MemfsStart(MEMFS *Memfs);
diff --git a/tst/winfsp-tests/memfs-test.c b/tst/winfsp-tests/memfs-test.c
index 2ed3c299..95ba100c 100644
--- a/tst/winfsp-tests/memfs-test.c
+++ b/tst/winfsp-tests/memfs-test.c
@@ -15,7 +15,7 @@ void *memfs_start_ex(ULONG Flags, ULONG FileInfoTimeout)
     NTSTATUS Result;
 
     Result = MemfsCreate(Flags, FileInfoTimeout, 1024, 1024 * 1024,
-        MemfsNet == Flags ? L"\\memfs\\share" : 0, &Memfs);
+        MemfsNet == Flags ? L"\\memfs\\share" : 0, 0, &Memfs);
     ASSERT(NT_SUCCESS(Result));
     ASSERT(0 != Memfs);