diff --git a/winsup/cygwin/external.cc b/winsup/cygwin/external.cc
index a7d364a95..6aa7e90bb 100644
--- a/winsup/cygwin/external.cc
+++ b/winsup/cygwin/external.cc
@@ -121,6 +121,13 @@ get_cygdrive_prefixes (char *user, char *system)
   return res;
 }
 
+static DWORD
+check_ntsec (const char *filename)
+{
+  path_conv pc (filename);
+  return allow_ntsec && pc.has_acls ();
+}
+
 extern "C" unsigned long
 cygwin_internal (cygwin_getinfo_types t, ...)
 {
@@ -247,6 +254,11 @@ cygwin_internal (cygwin_getinfo_types t, ...)
 	  pinfo p (pid);
 	  return (DWORD) p->cmdline (n);
 	}
+      case CW_CHECK_NTSEC:
+	{
+	  char *filename = va_arg (arg, char *);
+	  return check_ntsec (filename);
+	}
       default:
 	return (DWORD) -1;
     }
diff --git a/winsup/cygwin/include/cygwin/version.h b/winsup/cygwin/include/cygwin/version.h
index 6ca91004a..dd5af1eab 100644
--- a/winsup/cygwin/include/cygwin/version.h
+++ b/winsup/cygwin/include/cygwin/version.h
@@ -197,12 +197,13 @@ details. */
 		  fgetpos64 fopen64 freopen64 fseeko64 fsetpos64 ftello64
 		  _open64 _lseek64 _fstat64 _stat64 mknod32
        80: Export pthread_rwlock stuff
+       81: CW_CHECK_NTSEC addition to external.cc
      */
 
      /* Note that we forgot to bump the api for ualarm, strtoll, strtoull */
 
 #define CYGWIN_VERSION_API_MAJOR 0
-#define CYGWIN_VERSION_API_MINOR 80
+#define CYGWIN_VERSION_API_MINOR 81
 
      /* There is also a compatibity version number associated with the
 	shared memory regions.  It is incremented when incompatible
diff --git a/winsup/cygwin/include/sys/cygwin.h b/winsup/cygwin/include/sys/cygwin.h
index 5985db68c..dccff2068 100644
--- a/winsup/cygwin/include/sys/cygwin.h
+++ b/winsup/cygwin/include/sys/cygwin.h
@@ -71,7 +71,8 @@ typedef enum
     CW_STRACE_ACTIVE,
     CW_CYGWIN_PID_TO_WINPID,
     CW_EXTRACT_DOMAIN_AND_USER,
-    CW_CMDLINE
+    CW_CMDLINE,
+    CW_CHECK_NTSEC
   } cygwin_getinfo_types;
 
 #define CW_NEXTPID	0x80000000	/* or with pid to get next one */