diff --git a/include/os/windows/spl/sys/sid.h b/include/os/windows/spl/sys/sid.h
index e7082deb618c..d5d3ff5d74f2 100644
--- a/include/os/windows/spl/sys/sid.h
+++ b/include/os/windows/spl/sys/sid.h
@@ -33,6 +33,8 @@ extern "C" {
 
 #include <sys/kidmap.h>
 
+#define	EA_NTACL "security.NTACL"
+
 typedef struct ksiddomain {
 	char		*kd_name;
 } ksiddomain_t;
diff --git a/module/os/windows/zfs/zfs_vnops_windows_lib.c b/module/os/windows/zfs/zfs_vnops_windows_lib.c
index b2657e6554c6..6807112104cf 100644
--- a/module/os/windows/zfs/zfs_vnops_windows_lib.c
+++ b/module/os/windows/zfs/zfs_vnops_windows_lib.c
@@ -2429,8 +2429,6 @@ find_set_gid(struct vnode *vp, struct vnode *dvp,
 #endif
 }
 
-#define	EA_NTACL "security.NTACL"
-
 void
 zfs_save_ntsecurity(struct vnode *vp)
 {
@@ -2736,13 +2734,6 @@ zfs_attach_security(struct vnode *vp, struct vnode *dvp)
 	return (Status);
 }
 
-// return true if a XATTR name should be skipped
-int
-xattr_protected(char *name)
-{
-	return (0);
-}
-
 // return true if xattr is a stream (name ends with ":$DATA")
 int
 xattr_stream(char *name)
diff --git a/module/os/windows/zfs/zfs_vnops_windows_xattr.c b/module/os/windows/zfs/zfs_vnops_windows_xattr.c
index d16e184d53a6..b98caab3f1c2 100644
--- a/module/os/windows/zfs/zfs_vnops_windows_xattr.c
+++ b/module/os/windows/zfs/zfs_vnops_windows_xattr.c
@@ -113,6 +113,20 @@ enum xattr_permission {
 
 static unsigned int zfs_xattr_compat = 0;
 
+// return true if a XATTR name should be skipped
+int
+xattr_protected(char *name)
+{
+	if (strcmp(EA_NTACL, name) == 0)
+		return (1);
+
+	if ((strncmp(XATTR_USER_PREFIX, name, XATTR_USER_PREFIX_LEN) == 0) &&
+	    (strcmp(EA_NTACL, &name[XATTR_USER_PREFIX_LEN]) == 0))
+		return (1);
+
+	return (0);
+}
+
 static enum xattr_permission
 zpl_xattr_permission(struct vnode *dvp, zfs_uio_t *uio, const char *name,
     int name_len)