diff --git a/server/src/com/cloud/template/TemplateManagerImpl.java b/server/src/com/cloud/template/TemplateManagerImpl.java
index da8405f7227..752825f7a23 100755
--- a/server/src/com/cloud/template/TemplateManagerImpl.java
+++ b/server/src/com/cloud/template/TemplateManagerImpl.java
@@ -841,8 +841,7 @@ public class TemplateManagerImpl implements TemplateManager, Manager, TemplateSe
     	}
     	
     	//check permissions
-    	_accountMgr.checkAccess(caller, null, iso);
-    	_accountMgr.checkAccess(caller, null, vm);
+    	_accountMgr.checkAccess(caller, null, iso, vm);
     	
         State vmState = vm.getState();
         if (vmState != State.Running && vmState != State.Stopped) {
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index 28ce0b286a3..3e9ed681304 100755
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -97,6 +97,7 @@ import com.cloud.storage.dao.VMTemplateDao;
 import com.cloud.storage.dao.VolumeDao;
 import com.cloud.storage.snapshot.SnapshotManager;
 import com.cloud.template.TemplateManager;
+import com.cloud.template.VirtualMachineTemplate;
 import com.cloud.user.Account.State;
 import com.cloud.user.dao.AccountDao;
 import com.cloud.user.dao.UserAccountDao;
@@ -823,8 +824,9 @@ public class AccountManagerImpl implements AccountManager, AccountService, Manag
         		Account account = ApiDBUtils.findAccountById(entity.getAccountId());
         		domainId = account != null ? account.getDomainId() : -1 ;
         	}
-        	if (entity.getAccountId() != -1 && domainId != -1) {
+        	if (entity.getAccountId() != -1 && domainId != -1 && !(entity instanceof VirtualMachineTemplate)) {
                 List<ControlledEntity> toBeChecked = domains.get(entity.getDomainId());
+                //for templates, we don't have to do cross domains check
                 if (toBeChecked == null) {
                     toBeChecked = new ArrayList<ControlledEntity>();
                     domains.put(domainId, toBeChecked);