diff --git a/config/alfresco/core-services-context.xml b/config/alfresco/core-services-context.xml
index ff0dc7a59f..cfb0b11de3 100644
--- a/config/alfresco/core-services-context.xml
+++ b/config/alfresco/core-services-context.xml
@@ -741,7 +741,7 @@
             <ref bean="NodeService" />
         </property>
         <property name="dbNodeService">
-            <ref bean="dbNodeService" />
+            <ref bean="mtAwareNodeService" />
         </property>
         <property name="versionCounterService">
             <ref bean="versionCounterService" />
@@ -768,7 +768,7 @@
 
     <bean id="versionNodeService" class="org.alfresco.repo.version.Node2ServiceImpl">
         <property name="dbNodeService">
-            <ref bean="dbNodeService" />
+            <ref bean="mtAwareNodeService" />
         </property>
         <property name="dictionaryService">
             <ref bean="dictionaryService" />
@@ -777,7 +777,7 @@
     
     <bean id="versionMigrator" class="org.alfresco.repo.version.VersionMigrator" init-method="init">
         <property name="dbNodeService">
-            <ref bean="dbNodeService" />
+            <ref bean="mtAwareNodeService" />
         </property>
         <property name="versionNodeService">
             <ref bean="versionNodeService" />
@@ -1113,7 +1113,7 @@
     <!-- Audit -->
     <bean id="auditableAspect" class="org.alfresco.repo.audit.AuditableAspect" init-method="init">
         <property name="nodeService">
-            <ref bean="dbNodeService" />    <!-- bypass loads of interceptor layers -->
+            <ref bean="mtAwareNodeService" />    <!-- bypass loads of interceptor layers -->
         </property>
         <property name="policyComponent">
             <ref bean="policyComponent" />
diff --git a/config/alfresco/node-services-context.xml b/config/alfresco/node-services-context.xml
index b672b41eda..678d6e0d79 100644
--- a/config/alfresco/node-services-context.xml
+++ b/config/alfresco/node-services-context.xml
@@ -43,7 +43,6 @@
       <property name="interceptorNames">
          <list>
             <value>nodeRefPropertyInterceptor</value>
-            <value>multiTNodeServiceInterceptor</value>
             <value>mlPropertyInterceptor</value>
          </list>
       </property>
@@ -54,16 +53,32 @@
          <value>org.alfresco.service.cmr.repository.NodeService</value>
       </property>
       <property name="defaultBinding">
-         <ref bean="dbNodeService"></ref>
+         <ref bean="mtAwareNodeService"></ref>
       </property>
       <property name="redirectedProtocolBindings">
          <map>
-            <entry key="workspace"><ref bean="dbNodeService"></ref></entry>
+            <entry key="workspace"><ref bean="mtAwareNodeService"></ref></entry>
             <entry key="versionStore"><ref bean="versionNodeService"></ref></entry>
             <entry key="avm"><ref bean="avmNodeService"/></entry>
          </map>
       </property>
    </bean>
+   
+   <bean id="mtAwareNodeService" class="org.springframework.aop.framework.ProxyFactoryBean" >
+      <property name="targetName">
+         <value>dbNodeService</value>
+      </property>
+      <property name="proxyInterfaces">
+         <list>
+            <value>org.alfresco.service.cmr.repository.NodeService</value>
+         </list>
+      </property>
+      <property name="interceptorNames">
+         <list>
+            <value>multiTNodeServiceInterceptor</value>
+         </list>
+      </property>
+   </bean>
 
    <!-- Map stores to archive stores -->
    <bean id="storeArchiveMap" class="org.alfresco.repo.node.StoreArchiveMap">
diff --git a/config/alfresco/public-services-security-context.xml b/config/alfresco/public-services-security-context.xml
index 7fd54e0cb7..36e8bfa21e 100644
--- a/config/alfresco/public-services-security-context.xml
+++ b/config/alfresco/public-services-security-context.xml
@@ -41,7 +41,7 @@
     
     <bean id="permissionServiceImpl" class="org.alfresco.repo.security.permissions.impl.PermissionServiceImpl">
         <property name="nodeService">
-            <ref bean="dbNodeService" />
+            <ref bean="mtAwareNodeService" />
         </property>
         <property name="tenantService">
             <ref bean="tenantService"/>
diff --git a/config/alfresco/remote-services-context.xml b/config/alfresco/remote-services-context.xml
index b459942f63..988a22a68d 100644
--- a/config/alfresco/remote-services-context.xml
+++ b/config/alfresco/remote-services-context.xml
@@ -102,7 +102,7 @@
 	     Unfinished, experimental, and probably ephemeral. -->
     <bean id="repoRemoteService" class="org.alfresco.repo.remote.RepoRemoteService">
         <property name="nodeService">
-        	<ref bean="dbNodeService"/>
+        	<ref bean="mtAwareNodeService"/>
         </property>
         <property name="fileFolderService">
             <ref bean="fileFolderService"/>
diff --git a/source/java/org/alfresco/repo/tenant/MultiTDemoTest.java b/source/java/org/alfresco/repo/tenant/MultiTDemoTest.java
index 5f09c8ff40..e1e4bdd9be 100644
--- a/source/java/org/alfresco/repo/tenant/MultiTDemoTest.java
+++ b/source/java/org/alfresco/repo/tenant/MultiTDemoTest.java
@@ -44,6 +44,7 @@ import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
 import org.alfresco.service.cmr.repository.ChildAssociationRef;
 import org.alfresco.service.cmr.repository.ContentService;
 import org.alfresco.service.cmr.repository.ContentWriter;
+import org.alfresco.service.cmr.repository.InvalidNodeRefException;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.NodeService;
 import org.alfresco.service.cmr.repository.StoreRef;
@@ -213,6 +214,35 @@ public class MultiTDemoTest extends TestCase
         }   
     }
     
+    public void testLoginUsers() throws Throwable
+    {
+        logger.info("Login demo users");
+        
+        try
+        {
+            AuthenticationUtil.clearCurrentSecurityContext();
+            
+            for (final String tenantDomain : tenants)
+            {
+                loginLogoutUser(tenantService.getDomainUser(TEST_USER1, tenantDomain), "welcome");
+                
+                loginLogoutUser(tenantService.getDomainUser(TEST_USER2, tenantDomain), "welcome");
+                
+                if (tenantDomain.equals(TEST_TENANT_DOMAIN2))
+                {
+                    loginLogoutUser(tenantService.getDomainUser(TEST_USER3, tenantDomain), "welcome");
+                }
+            }
+        }   
+        catch (Throwable t)
+        {
+            StringWriter stackTrace = new StringWriter();
+            t.printStackTrace(new PrintWriter(stackTrace));
+            System.err.println(stackTrace.toString());
+            throw t;
+        }
+    }
+    
     public void testCreateGroups()
     {
         logger.info("Create demo groups");
@@ -355,6 +385,28 @@ public class MultiTDemoTest extends TestCase
         }
     }
 
+    public void testGetStores()
+    {
+        logger.info("Get tenant stores");
+        
+        // super tenant
+        assertTrue("Super tenant: ", (nodeService.getStores().size() >= 5));
+        
+        for (final String tenantDomain : tenants)
+        {        
+            String tenantAdminName = tenantService.getDomainUser(TenantService.ADMIN_BASENAME, tenantDomain);
+            
+            AuthenticationUtil.runAs(new RunAsWork<Object>()
+            {
+                public Object doWork() throws Exception
+                {
+                    assertEquals("Tenant: "+tenantDomain, 5, nodeService.getStores().size());
+                    
+                    return null;                      
+                }
+            }, tenantAdminName);
+        }
+    }
     
     private void createGroup(String shortName, String parentShortName)
     {
@@ -417,6 +469,26 @@ public class MultiTDemoTest extends TestCase
         }
     }
     
+    private void loginLogoutUser(String username, String password)
+    {
+        // authenticate via the authentication service
+        authenticationService.authenticate(username, password.toCharArray());
+        
+        // set the user name as stored by the back end 
+        username = authenticationService.getCurrentUserName();
+        
+        NodeRef homeSpaceRef = (NodeRef)nodeService.getProperty(personService.getPerson(username), ContentModel.PROP_HOMEFOLDER);
+        
+        // check that the home space node exists - else user cannot login
+        if (nodeService.exists(homeSpaceRef) == false)
+        {
+           throw new InvalidNodeRefException(homeSpaceRef);
+        }
+        
+        // logout
+        authenticationService.clearCurrentSecurityContext();
+    }
+    
     private NodeRef getUserHomesNodeRef(StoreRef storeRef)
     {
         // get the users' home location
diff --git a/source/java/org/alfresco/repo/tenant/MultiTNodeServiceInterceptor.java b/source/java/org/alfresco/repo/tenant/MultiTNodeServiceInterceptor.java
index 3e89483349..fc2a9adc50 100644
--- a/source/java/org/alfresco/repo/tenant/MultiTNodeServiceInterceptor.java
+++ b/source/java/org/alfresco/repo/tenant/MultiTNodeServiceInterceptor.java
@@ -108,9 +108,11 @@ public class MultiTNodeServiceInterceptor extends DelegatingIntroductionIntercep
             return invocation.proceed();
         }
 
+        String methodName = invocation.getMethod().getName();
+        
         if (logger.isDebugEnabled())
         {
-            logger.debug("Intercepting method " + invocation.getMethod().getName());
+            logger.debug("Intercepting method " + methodName);
         }
         
         Object[] args = invocation.getArguments();
@@ -162,8 +164,49 @@ public class MultiTNodeServiceInterceptor extends DelegatingIntroductionIntercep
         // Make the call
         Object ret = invocation.proceed();
         
-        // Convert the outbound value
-        ret = convertOutboundValue(ret);
+        if (methodName.equals("getStores"))
+        {
+            if ((ret == null) || (! (ret instanceof List)))
+            {
+                return null;
+            }
+            
+            List<StoreRef> rawValues = (List<StoreRef>)ret;
+            final List<StoreRef> convertedValues = new ArrayList<StoreRef>(rawValues.size());
+            
+            for (StoreRef ref : rawValues)
+            {
+                StoreRef storeRef = ref;
+                try
+                {
+                    if (tenantService.isEnabled())
+                    {
+                        String currentUser = AuthenticationUtil.getCurrentUserName();
+
+                        // MT: return tenant stores only (although for super System return all stores - as used by
+                        // ConfigurationChecker, IndexRecovery, IndexBackup etc)
+                        if ((currentUser == null) || (!currentUser.equals(AuthenticationUtil.getSystemUserName())))
+                        {
+                            tenantService.checkDomain(storeRef.getIdentifier());
+                            storeRef = tenantService.getBaseName(storeRef);
+                        }
+                    }
+                    
+                    convertedValues.add(storeRef);
+                }
+                catch (RuntimeException re)
+                {
+                    // deliberately ignore - stores in different domain will not be listed
+                }
+            }
+            
+            return convertedValues;
+        }
+        else
+        {
+            // Convert the outbound value
+            ret = convertOutboundValue(ret);
+        }
         
         // done
         return ret;
diff --git a/source/java/org/alfresco/repo/tenant/MultiTServiceImpl.java b/source/java/org/alfresco/repo/tenant/MultiTServiceImpl.java
index 82f4c8c114..c7989ae43b 100755
--- a/source/java/org/alfresco/repo/tenant/MultiTServiceImpl.java
+++ b/source/java/org/alfresco/repo/tenant/MultiTServiceImpl.java
@@ -60,20 +60,17 @@ public class MultiTServiceImpl implements TenantService
     {
         this.tenantsCache = tenantsCache;
     }
-   
+    
     public NodeRef getName(NodeRef nodeRef)
     {
-		// Check that all the passed values are not null
-        ParameterCheck.mandatory("NodeRef", nodeRef);
+        if (nodeRef == null) { return null; }
 
         return new NodeRef(nodeRef.getStoreRef().getProtocol(), getName(nodeRef.getStoreRef().getIdentifier()), nodeRef.getId());
     }
     
     public NodeRef getName(NodeRef inNodeRef, NodeRef nodeRef)
     {
-        // Check that all the passed values are not null
-        ParameterCheck.mandatory("InNodeRef", inNodeRef);
-        ParameterCheck.mandatory("NodeRef", nodeRef);
+        if (inNodeRef == null || nodeRef == null) { return null; }
 
         int idx = inNodeRef.getStoreRef().getIdentifier().lastIndexOf(SEPARATOR);
         if (idx != -1)
@@ -87,16 +84,14 @@ public class MultiTServiceImpl implements TenantService
     
     public StoreRef getName(StoreRef storeRef)
     {
-        // Check that all the passed values are not null
-        ParameterCheck.mandatory("StoreRef", storeRef);
+        if (storeRef == null) { return null; }
         
         return new StoreRef(storeRef.getProtocol(), getName(storeRef.getIdentifier()));
     }
     
     public ChildAssociationRef getName(ChildAssociationRef childAssocRef)
     {
-        // Check that all the passed values are not null
-        ParameterCheck.mandatory("ChildAssocRef", childAssocRef);
+        if (childAssocRef == null) { return null; }
         
         return new ChildAssociationRef(
                 childAssocRef.getTypeQName(),
@@ -109,8 +104,7 @@ public class MultiTServiceImpl implements TenantService
     
     public AssociationRef getName(AssociationRef assocRef)
     {
-        // Check that all the passed values are not null
-        ParameterCheck.mandatory("assocRef", assocRef);
+        if (assocRef == null) { return null; }
         
         return new AssociationRef(
                 getName(assocRef.getSourceRef()),
@@ -121,10 +115,10 @@ public class MultiTServiceImpl implements TenantService
 
     public StoreRef getName(String username, StoreRef storeRef)
     {
-        // Check that all the passed values are not null
-        ParameterCheck.mandatory("StoreRef", storeRef);
+        if (storeRef == null) { return null; }
 
-        if (username != null) {
+        if (username != null) 
+        {
             int idx = username.lastIndexOf(SEPARATOR);
             if ((idx > 0) && (idx < (username.length()-1)))
             {
@@ -241,24 +235,21 @@ public class MultiTServiceImpl implements TenantService
       
     public NodeRef getBaseName(NodeRef nodeRef)
     { 
-        // Check that all the passed values are not null
-        ParameterCheck.mandatory("NodeRef", nodeRef);
+        if (nodeRef == null) { return null; }
 
         return new NodeRef(nodeRef.getStoreRef().getProtocol(), getBaseName(nodeRef.getStoreRef().getIdentifier()), nodeRef.getId());
     }
     
     public StoreRef getBaseName(StoreRef storeRef)
     {         
-        // Check that all the passed values are not null
-        ParameterCheck.mandatory("StoreRef", storeRef);
+        if (storeRef == null) { return null; }
         
         return new StoreRef(storeRef.getProtocol(), getBaseName(storeRef.getIdentifier()));
     } 
     
     public ChildAssociationRef getBaseName(ChildAssociationRef childAssocRef)
     {
-        // Check that all the passed values are not null
-        ParameterCheck.mandatory("ChildAssocRef", childAssocRef);
+        if (childAssocRef == null) { return null; }
         
         return new ChildAssociationRef(childAssocRef.getTypeQName(),
                 getBaseName(childAssocRef.getParentRef()),