diff --git a/api/src/org/apache/cloudstack/api/BaseListDomainResourcesCmd.java b/api/src/org/apache/cloudstack/api/BaseListDomainResourcesCmd.java
index 3257d65d3b4..79f7edc2297 100644
--- a/api/src/org/apache/cloudstack/api/BaseListDomainResourcesCmd.java
+++ b/api/src/org/apache/cloudstack/api/BaseListDomainResourcesCmd.java
@@ -39,8 +39,7 @@ public abstract class BaseListDomainResourcesCmd extends BaseListCmd {
     }
 
     public boolean isRecursive() {
-        // if listAll is true, recursive is not specified, then recursive should default to true.
-        return recursive == null ? (listAll() ? true : false) : recursive;
+        return recursive == null ? false : recursive;
     }
 
     public Long getDomainId() {
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index 0d4b72d4c5d..b48f047d2c3 100755
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -2280,6 +2280,13 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
                     permittedAccounts.addAll(grantedAccounts);
                     permittedResources.addAll(grantedResources);
                 }
+
+                if (permittedDomains.isEmpty() && permittedAccounts.isEmpty() & permittedResources.isEmpty()) {
+                    // if at this point, all permitted arrays are empty, that means that caller cannot see anything, we put -1 in permittedAccounts
+                    // to distinguish this case from the case that caller can see everything
+                    permittedAccounts.add(-1L);
+
+                }
             }
         }
     }