Merge branch 'v4-0-test' into id10ts-registry

(This used to be commit f98b59021a5ea39c7970ebc5520d17775e500b8c)

187 files changed, 3070 insertions, 1558 deletions

diff --git a/.gitignore b/.gitignore
index f75f698c65..3a2e5642e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -197,3 +197,4 @@ source/apidocs
 *.swp
 source/mkconfig.mk
 source/data.mk
+source/librpc/idl-deps
diff --git a/source4/Makefile b/source4/Makefile
index 1fddfefce3..97518ebcb6 100644
--- a/source4/Makefile
+++ b/source4/Makefile
@@ -19,11 +19,39 @@ BNLD_FLAGS = $(LDFLAGS) $(SYS_LDFLAGS)
 HOSTCC_FLAGS = -D_SAMBA_HOSTCC_ $(CFLAGS)
 HOSTLD_FLAGS = $(LDFLAGS) $(SYS_LDFLAGS)
 
-default: all
+.DEFAULT_GOAL := all
+
+ifneq ($(automatic_deps),yes)
+ALL_PREDEP = proto
+.NOTPARALLEL:
+endif
 
 include rules.mk
 include data.mk
 
+DEP_FILES = $(patsubst %.ho,%.hd,$(patsubst %.o,%.d,$(ALL_OBJS))) \
+		   include/includes.d
+
+ifeq ($(automatic_deps),yes)
+ifneq ($(MAKECMDGOALS),clean)
+ifneq ($(MAKECMDGOALS),distclean)
+ifneq ($(MAKECMDGOALS),realdistclean)
+ifneq ($(SKIP_DEP_FILES),yes)
+-include $(DEP_FILES)
+endif
+endif
+endif
+endif
+
+ifneq ($(SKIP_DEP_FILES),yes)
+clean::
+	@echo Removing dependency files
+	@find . -name '*.d' -o -name '*.hd' | xargs rm -f
+endif
+else
+include $(srcdir)/static_deps.mk
+endif
+
 DEFAULT_HEADERS = $(srcdir)/lib/util/dlinklist.h \
 		  $(srcdir)/version.h
 
diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 9189640150..4cb8d2b304 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -226,7 +226,9 @@ static NTSTATUS authsam_authenticate(struct auth_context *auth_context,
 {
 	struct samr_Password *lm_pwd, *nt_pwd;
 	NTSTATUS nt_status;
-	uint16_t acct_flags = samdb_result_acct_flags(msgs[0], "userAccountControl");
+	struct ldb_dn *domain_dn = samdb_result_dn(sam_ctx, mem_ctx, msgs_domain_ref[0], "nCName", NULL);
+
+	uint16_t acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msgs[0], domain_dn);
 	
 	/* Quit if the account was locked out. */
 	if (acct_flags & ACB_AUTOLOCK) {
diff --git a/source4/auth/config.mk b/source4/auth/config.mk
index 5b320bcf36..369c5bb4e6 100644
--- a/source4/auth/config.mk
+++ b/source4/auth/config.mk
@@ -6,13 +6,14 @@ mkinclude credentials/config.mk
 
 [SUBSYSTEM::auth_session]
 OBJ_FILES = session.o
-PUBLIC_HEADERS = session.h
-PUBLIC_PROTO_HEADER = session_proto.h
+PRIVATE_PROTO_HEADER = session_proto.h
 PUBLIC_DEPENDENCIES = CREDENTIALS
 
+PUBLIC_HEADERS += auth/session.h
+
 [SUBSYSTEM::auth_system_session]
 OBJ_FILES = system_session.o
-PUBLIC_PROTO_HEADER = system_session_proto.h
+PRIVATE_PROTO_HEADER = system_session_proto.h
 PUBLIC_DEPENDENCIES = CREDENTIALS
 PRIVATE_DEPENDENCIES = auth_session LIBSAMBA-UTIL LIBSECURITY 
 
@@ -81,8 +82,7 @@ OBJ_FILES = pam_errors.o
 [SUBSYSTEM::auth]
 #VERSION = 0.0.1
 #SO_VERSION = 0
-PUBLIC_HEADERS = auth.h
-PUBLIC_PROTO_HEADER = auth_proto.h
+PRIVATE_PROTO_HEADER = auth_proto.h
 OBJ_FILES = \
 		auth.o \
 		auth_util.o \
@@ -92,6 +92,8 @@ PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL
 # End SUBSYSTEM auth
 #######################
 
+PUBLIC_HEADERS += auth/auth.h
+
 [PYTHON::swig_auth]
 PUBLIC_DEPENDENCIES = auth_system_session
 PRIVATE_DEPENDENCIES = SAMDB 
diff --git a/source4/auth/credentials/config.mk b/source4/auth/credentials/config.mk
index fee9519ae5..ef8db50109 100644
--- a/source4/auth/credentials/config.mk
+++ b/source4/auth/credentials/config.mk
@@ -1,8 +1,7 @@
 #################################
 # Start SUBSYSTEM CREDENTIALS
 [SUBSYSTEM::CREDENTIALS]
-PUBLIC_PROTO_HEADER = credentials_proto.h
-PUBLIC_HEADERS = credentials.h credentials_krb5.h
+PRIVATE_PROTO_HEADER = credentials_proto.h
 OBJ_FILES = credentials.o \
 		credentials_files.o \
 		credentials_ntlm.o \
@@ -13,6 +12,8 @@ PUBLIC_DEPENDENCIES = \
 PRIVATE_DEPENDENCIES = \
 		SECRETS
 
+PUBLIC_HEADERS += $(addprefix auth/credentials/, credentials.h credentials_krb5.h)
+
 [PYTHON::swig_credentials]
 PUBLIC_DEPENDENCIES = CREDENTIALS LIBCMDLINE_CREDENTIALS
 SWIG_FILE = credentials.i
diff --git a/source4/auth/gensec/config.mk b/source4/auth/gensec/config.mk
index 9aab2c704e..b60f039284 100644
--- a/source4/auth/gensec/config.mk
+++ b/source4/auth/gensec/config.mk
@@ -4,14 +4,15 @@
 PC_FILE = gensec.pc
 VERSION = 0.0.1
 SO_VERSION = 0
-PUBLIC_HEADERS = gensec.h spnego.h
-PUBLIC_PROTO_HEADER = gensec_proto.h
+PRIVATE_PROTO_HEADER = gensec_proto.h
 OBJ_FILES = gensec.o socket.o
 PUBLIC_DEPENDENCIES = \
 		CREDENTIALS LIBSAMBA-UTIL LIBCRYPTO ASN1_UTIL samba-socket LIBPACKET
 # End SUBSYSTEM gensec
 #################################
 
+PUBLIC_HEADERS += $(addprefix auth/gensec/, gensec.h spnego.h)
+
 ################################################
 # Start MODULE gensec_krb5
 [MODULE::gensec_krb5]
diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index fdd7de7c71..9a8045f62d 100644
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -149,19 +149,20 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
 	const char *workstation_list;
 	NTTIME acct_expiry;
 	NTTIME must_change_time;
-	NTTIME last_set_time;
 
 	struct ldb_dn *domain_dn = samdb_result_dn(sam_ctx, mem_ctx, msg_domain_ref, "nCName", ldb_dn_new(mem_ctx, sam_ctx, NULL));
 
 	NTTIME now;
 	DEBUG(4,("authsam_account_ok: Checking SMB password for user %s\n", name_for_logs));
 
-	acct_flags = samdb_result_acct_flags(msg, "userAccountControl");
+	acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
 	
 	acct_expiry = samdb_result_nttime(msg, "accountExpires", 0);
+
+	/* Check for when we must change this password, taking the
+	 * userAccountControl flags into account */
 	must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx, 
 							      domain_dn, msg);
-	last_set_time = samdb_result_nttime(msg, "pwdLastSet", 0);
 
 	workstation_list = samdb_result_string(msg, "userWorkstations", NULL);
 
@@ -186,22 +187,20 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_ACCOUNT_EXPIRED;
 	}
 
-	if (!(acct_flags & ACB_PWNOEXP)) {
-		/* check for immediate expiry "must change at next logon" */
-		if (must_change_time == 0 && last_set_time != 0) {
-			DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", 
-				 name_for_logs));
-			return NT_STATUS_PASSWORD_MUST_CHANGE;
-		}
+	/* check for immediate expiry "must change at next logon" */
+	if (must_change_time == 0) {
+		DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", 
+			 name_for_logs));
+		return NT_STATUS_PASSWORD_MUST_CHANGE;
+	}
 
-		/* check for expired password */
-		if ((must_change_time != 0) && (must_change_time < now)) {
-			DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", 
-				 name_for_logs));
-			DEBUG(1,("sam_account_ok: Password expired at '%s' unix time.\n", 
-				 nt_time_string(mem_ctx, must_change_time)));
-			return NT_STATUS_PASSWORD_EXPIRED;
-		}
+	/* check for expired password */
+	if (must_change_time < now) {
+		DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", 
+			 name_for_logs));
+		DEBUG(1,("sam_account_ok: Password expired at '%s' unix time.\n", 
+			 nt_time_string(mem_ctx, must_change_time)));
+		return NT_STATUS_PASSWORD_EXPIRED;
 	}
 
 	/* Test workstation. Workstation list is comma separated. */
@@ -267,6 +266,7 @@ _PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_conte
 	struct dom_sid **groupSIDs = NULL;
 	struct dom_sid *account_sid;
 	struct dom_sid *primary_group_sid;
+	struct ldb_dn *domain_dn;
 	const char *str;
 	struct ldb_dn *ncname;
 	int i;
@@ -368,7 +368,10 @@ _PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_conte
 	server_info->logon_count = samdb_result_uint(msg, "logonCount", 0);
 	server_info->bad_password_count = samdb_result_uint(msg, "badPwdCount", 0);
 
-	server_info->acct_flags = samdb_result_acct_flags(msg, "userAccountControl");
+	domain_dn = samdb_result_dn(sam_ctx, mem_ctx, msg_domain_ref, "nCName", NULL);
+
+	server_info->acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, 
+							  msg, domain_dn);
 
 	server_info->user_session_key = user_sess_key;
 	server_info->lm_session_key = lm_sess_key;
diff --git a/source4/build/m4/check_make.m4 b/source4/build/m4/check_make.m4
index d7799649a7..f497684453 100644
--- a/source4/build/m4/check_make.m4
+++ b/source4/build/m4/check_make.m4
@@ -6,35 +6,26 @@ dnl  Released under the GNU GPL
 dnl -------------------------------------------------------
 dnl
 
-AC_PATH_PROG(MAKE,make)
+AC_PATH_PROGS(MAKE,gmake make)
 
 AC_CACHE_CHECK([whether we have GNU make], samba_cv_gnu_make, [
-if $ac_cv_path_MAKE --version | head -1 | grep GNU 2>/dev/null >/dev/null
+if ! $ac_cv_path_MAKE --version | head -1 | grep GNU 2>/dev/null >/dev/null
 then
-	samba_cv_gnu_make=yes
-else
-	samba_cv_gnu_make=no
+	AC_MSG_ERROR([Unable to find GNU make])
 fi
 ])
 
-GNU_MAKE=$samba_cv_gnu_make
-AC_SUBST(GNU_MAKE)
-
-if test "x$GNU_MAKE" = x"yes"; then
-	AC_CACHE_CHECK([GNU make version], samba_cv_gnu_make_version,[
+AC_CACHE_CHECK([GNU make version], samba_cv_gnu_make_version,[
 		samba_cv_gnu_make_version=`$ac_cv_path_MAKE --version | head -1 | cut -d " " -f 3 2>/dev/null`
 	])
 	GNU_MAKE_VERSION=$samba_cv_gnu_make_version
 	AC_SUBST(GNU_MAKE_VERSION)
-fi
 
 
 new_make=no
 AC_MSG_CHECKING([for GNU make >= 3.81])
-if test x$GNU_MAKE = x"yes"; then
-	if $PERL -e " \$_ = '$GNU_MAKE_VERSION'; s/@<:@^\d\.@:>@.*//g; exit (\$_ < 3.81);"; then
-		new_make=yes
-	fi
+if $PERL -e " \$_ = '$GNU_MAKE_VERSION'; s/@<:@^\d\.@:>@.*//g; exit (\$_ < 3.81);"; then
+	new_make=yes
 fi
 AC_MSG_RESULT($new_make)
 automatic_dependencies=no
@@ -46,11 +37,3 @@ AC_ARG_ENABLE(automatic-dependencies,
 [ automatic_dependencies=no ])
 AC_MSG_RESULT($automatic_dependencies)
 AC_SUBST(automatic_dependencies)
-
-FIRST_PREREQ="\$*.c"
-AC_SUBST(FIRST_PREREQ)
-
-if test x$GNU_MAKE = xyes; then
-	FIRST_PREREQ="\$<"
-fi
-
diff --git a/source4/build/smb_build/README.txt b/source4/build/smb_build/README.txt
index a5e4db99e0..eac3905cce 100644
--- a/source4/build/smb_build/README.txt
+++ b/source4/build/smb_build/README.txt
@@ -1,6 +1,5 @@
 The Samba Build System

-----------------------

-----------------------

+======================

 

 The build system basically has two main parts: the autoconf-generated 

 shell scripts which check for availability of functions and libraries 

@@ -29,7 +28,7 @@ EXT_LIB:
 BINARY:

 	a BINARY means a executable binary file.

 	(e.g. 'smbtorture' or 'ldbedit')

-	a BINARY typicly has only commandline handling and basic 

+	a BINARY typically has only commandline handling and basic 

 	functionality code in it and depends on the functions of

 	SUBSYSTEM's (REQUIRED_SUBSYSTEMS).

 

@@ -50,8 +49,6 @@ input.pm - Input validation
 main.pm - Main

 makefile.pm - Makefile generation

 output.pm - Dependency calculation

-header.pm - build.h generation

-cflags.pm - Generates cflags.txt for file-specific cflags

 

 Layout

 -------

diff --git a/source4/build/smb_build/cflags.pm b/source4/build/smb_build/cflags.pm
deleted file mode 100755
index a4ab90a8cd..0000000000
--- a/source4/build/smb_build/cflags.pm
+++ /dev/null
@@ -1,69 +0,0 @@
-# SMB Build System
-#
-#  Copyright (C) Jelmer Vernooij 2006
-#  Released under the GNU GPL
-
-package cflags;
-use strict;
-
-my $sort_available = eval "use sort 'stable'; return 1;";
-$sort_available = 0 unless defined($sort_available);
-
-sub by_path {
-	return  1 if($a =~ m#^\-I/#);
-    	return -1 if($b =~ m#^\-I/#);
-	return  0;
-}
-
-sub create_cflags($$$$) {
-	my $CTX = shift;
-	my $srcdir = shift;
-	my $builddir = shift;
-	my $file = shift;
-
-	open(CFLAGS_TXT,">$file") || die ("Can't open `$file'\n");
-
-	print CFLAGS_TXT "include mkconfig.mk\n";
-
-	my $src_ne_build = ($srcdir ne $builddir) ? 1 : 0;
-
-	foreach my $key (values %{$CTX}) {
-		next unless defined ($key->{OBJ_LIST});
-		next unless defined ($key->{FINAL_CFLAGS});
-		next unless (@{$key->{FINAL_CFLAGS}} > 0);
-
-		my @sorted_cflags = @{$key->{FINAL_CFLAGS}};
-		if ($sort_available) {
-			@sorted_cflags = sort by_path @{$key->{FINAL_CFLAGS}};
-		}
-
-		# Rewrite CFLAGS so that both the source and the build
-		# directories are in the path.
-		my @cflags = ();
-		foreach my $flag (@sorted_cflags) {
-			if($src_ne_build) {
-			        if($flag =~ m#^-I([^/].*$)#) {
-				        my $dir = $1;
-				        $dir =~ s#^\$\((?:src|build)dir\)/?##;
-					push(@cflags, "-I$builddir/$dir", "-I$srcdir/$dir");
-				        next;
-			        }
-			}
-			push(@cflags, $flag);
-		}
-		
-		my $cflags = join(' ', @cflags);
-
-		foreach (@{$key->{OBJ_LIST}}) {
-			my $ofile = $_;
-			my $dfile = $_;
-			$dfile =~ s/\.o$/.d/;
-			$dfile =~ s/\.ho$/.d/;
-			print CFLAGS_TXT "$ofile $dfile: CFLAGS+= $cflags\n";
-		}
-	}
-	close(CFLAGS_TXT);
-
-	print __FILE__.": creating $file\n";
-}
-1;
diff --git a/source4/build/smb_build/config_mk.pm b/source4/build/smb_build/config_mk.pm
index 4d8db8a04e..d8ec646910 100644
--- a/source4/build/smb_build/config_mk.pm
+++ b/source4/build/smb_build/config_mk.pm
@@ -36,13 +36,8 @@ my $section_types = {
 
 		"ENABLE"		=> "bool",
 
-		"MANPAGE"		=> "string",
-
-		"PUBLIC_PROTO_HEADER"	=> "string",
 		"PRIVATE_PROTO_HEADER"	=> "string",
 
-		"PUBLIC_HEADERS"	=> "list",
-
 		"CFLAGS"		=> "list",
 		"LDFLAGS"		=> "list",
 		"STANDARD_VISIBILITY"	=> "string",
@@ -62,7 +57,6 @@ my $section_types = {
 
 		"OUTPUT_TYPE"		=> "list",
 
-		"MANPAGE"		=> "string",
 		"PRIVATE_PROTO_HEADER"	=> "string",
 
 		"CFLAGS"		=> "list"
@@ -74,7 +68,6 @@ my $section_types = {
 
 		"ENABLE"		=> "bool",
 
-		"MANPAGE"		=> "string",
 		"INSTALLDIR"		=> "string",
 		"PRIVATE_PROTO_HEADER"	=> "string",
 
@@ -102,11 +95,6 @@ my $section_types = {
 
 		"ENABLE"		=> "bool",
 
-		"MANPAGE"		=> "string",
-
-		"PUBLIC_HEADERS"	=> "list",
-
-		"PUBLIC_PROTO_HEADER"	=> "string",
 		"PRIVATE_PROTO_HEADER"	=> "string",
 
 		"CFLAGS"		=> "list",
diff --git a/source4/build/smb_build/env.pm b/source4/build/smb_build/env.pm
deleted file mode 100644
index 76cd8d1a26..0000000000
--- a/source4/build/smb_build/env.pm
+++ /dev/null
@@ -1,57 +0,0 @@
-# Environment class
-#
-# Samba Build Environment
-#
-# (C) 2005 Jelmer Vernooij <jelmer@samba.org>
-#
-# Published under the GNU GPL
-
-package smb_build::env;
-use smb_build::input;
-use File::Path;
-use File::Basename;
-
-use strict;
-
-sub new($$)
-{ 
-	my ($name, $config) = @_;
-	my $self = { };
-	bless $self, $name;
-
-	$self->{items} = {};
-	$self->{info} = {};
-	
-	$self->_set_config($config);
-
-	return $self;
-}
-
-sub _set_config($$)
-{
-	my ($self, $config) = @_;
-
-	$self->{config} = $config;
-
-	if (not defined($self->{config}->{srcdir})) {
-		$self->{config}->{srcdir} = '.';
-	}
-
-	if (not defined($self->{config}->{builddir})) {
-		$self->{config}->{builddir}  = '.';
-	}
-
-	if ($self->{config}->{prefix} eq "NONE") {
-		$self->{config}->{prefix} = $self->{config}->{ac_default_prefix};
-	}
-
-	if ($self->{config}->{exec_prefix} eq "NONE") {
-		$self->{config}->{exec_prefix} = $self->{config}->{prefix};
-	}
-	
-	$self->{developer} = ($self->{config}->{developer} eq "yes");
-	$self->{gnu_make} = ($self->{config}->{GNU_MAKE} eq "yes");
-	$self->{automatic_deps} = ($self->{config}->{automatic_dependencies} eq "yes");
-}
-
-1;
diff --git a/source4/build/smb_build/input.pm b/source4/build/smb_build/input.pm
index 8c9a6efacc..948f2657b4 100644
--- a/source4/build/smb_build/input.pm
+++ b/source4/build/smb_build/input.pm
@@ -233,14 +233,6 @@ sub check($$$$$)
 	my ($INPUT, $enabled, $subsys_ot, $lib_ot, $module_ot) = @_;
 
 	foreach my $part (values %$INPUT) {
-		unless (defined($part->{PUBLIC_HEADERS})) {
-			$part->{PUBLIC_HEADERS} = [];
-		}
-		
-		if (defined($part->{PUBLIC_PROTO_HEADER})) {
-			push (@{$part->{PUBLIC_HEADERS}}, $part->{PUBLIC_PROTO_HEADER});
-		}
-
 		if (defined($enabled->{$part->{NAME}})) { 
 			$part->{ENABLE} = $enabled->{$part->{NAME}};
 			next;
diff --git a/source4/build/smb_build/main.pl b/source4/build/smb_build/main.pl
index 3ed0327d6d..c3dc46461b 100644
--- a/source4/build/smb_build/main.pl
+++ b/source4/build/smb_build/main.pl
@@ -10,8 +10,6 @@ use smb_build::header;
 use smb_build::input;
 use smb_build::config_mk;
 use smb_build::output;
-use smb_build::env;
-use smb_build::cflags;
 use smb_build::summary;
 use smb_build::config;
 use strict;
@@ -56,7 +54,7 @@ foreach my $key (values %$OUTPUT) {
 	$mkenv->MergedObj($key) if grep(/MERGED_OBJ/, @{$key->{OUTPUT_TYPE}});
 	$mkenv->StaticLibrary($key) if grep(/STATIC_LIBRARY/, @{$key->{OUTPUT_TYPE}});
 	if (defined($key->{PC_FILE})) {
-		push(@{$mkenv->{pc_files}}, "$key->{BASEDIR}/$key->{PC_FILE}");
+		$mkenv->output("PC_FILES += $key->{BASEDIR}/$key->{PC_FILE}\n");
 	} 
 	$mkenv->SharedLibraryPrimitives($key) if ($key->{TYPE} eq "LIBRARY") and
 					grep(/SHARED_LIBRARY/, @{$key->{OUTPUT_TYPE}});
@@ -68,10 +66,8 @@ foreach my $key (values %$OUTPUT) {
 								   $key->{TYPE} eq "PYTHON") and
 					grep(/SHARED_LIBRARY/, @{$key->{OUTPUT_TYPE}});
 	$mkenv->PythonFiles($key) if defined($key->{PYTHON_FILES});
-	$mkenv->Manpage($key) if defined($key->{MANPAGE});
-	$mkenv->Header($key) if defined($key->{PUBLIC_HEADERS});
-	$mkenv->ProtoHeader($key) if defined($key->{PRIVATE_PROTO_HEADER}) or 
-					 defined($key->{PUBLIC_PROTO_HEADER});
+	$mkenv->ProtoHeader($key) if defined($key->{PRIVATE_PROTO_HEADER});
+	$mkenv->CFlags($key);
 }
 
 foreach my $key (values %$OUTPUT) {
@@ -88,16 +84,6 @@ foreach my $key (values %$OUTPUT) {
 $mkenv->write("data.mk");
 header::create_smb_build_h($OUTPUT, "include/build.h");
 
-cflags::create_cflags($OUTPUT, $config::config{srcdir},
-		    $config::config{builddir}, "extra_cflags.txt");
-
 summary::show($OUTPUT, \%config::config);
 
-if ($shared_libs_used) {
-	print <<EOF;
-To run binaries without installing, set the following environment variable:
-	$config::config{LIB_PATH_VAR}=$config::config{builddir}/bin/shared
-EOF
-}
-
 1;
diff --git a/source4/build/smb_build/makefile.pm b/source4/build/smb_build/makefile.pm
index 17474db00e..f2bff1a029 100644
--- a/source4/build/smb_build/makefile.pm
+++ b/source4/build/smb_build/makefile.pm
@@ -6,32 +6,21 @@
 #  Released under the GNU GPL
 
 package smb_build::makefile;
-use smb_build::env;
 use smb_build::output;
 use File::Basename;
 use strict;
 
-use base 'smb_build::env';
 use Cwd 'abs_path';
 
 sub new($$$)
 {
 	my ($myname, $config, $mkfile) = @_;
-	my $self = new smb_build::env($config);
-	
+	my $self = {};
+
 	bless($self, $myname);
 
-	$self->{manpages} = [];
-	$self->{sbin_progs} = [];
-	$self->{bin_progs} = [];
-	$self->{static_libs} = [];
-	$self->{python_dsos} = [];
-	$self->{python_pys} = [];
-	$self->{shared_libs} = [];
-	$self->{headers} = [];
-	$self->{plugins} = [];
-	$self->{pc_files} = [];
-	$self->{proto_headers} = [];
+	$self->_set_config($config);
+
 	$self->{output} = "";
 
 	$self->{mkfile} = $mkfile;
@@ -41,12 +30,30 @@ sub new($$$)
 	$self->output("################################################\n");
 	$self->output("\n");
 
-	if (!$self->{automatic_deps}) {
-		$self->output("ALL_PREDEP = proto\n");
-		$self->output(".NOTPARALLEL:\n");
+	return $self;
+}
+
+sub _set_config($$)
+{
+	my ($self, $config) = @_;
+
+	$self->{config} = $config;
+
+	if (not defined($self->{config}->{srcdir})) {
+		$self->{config}->{srcdir} = '.';
 	}
 
-	return $self;
+	if (not defined($self->{config}->{builddir})) {
+		$self->{config}->{builddir}  = '.';
+	}
+
+	if ($self->{config}->{prefix} eq "NONE") {
+		$self->{config}->{prefix} = $self->{config}->{ac_default_prefix};
+	}
+
+	if ($self->{config}->{exec_prefix} eq "NONE") {
+		$self->{config}->{exec_prefix} = $self->{config}->{prefix};
+	}
 }
 
 sub output($$)
@@ -66,23 +73,17 @@ sub _prepare_mk_files($)
 		push (@tmp, $_);
 	}
 
-	if ($self->{gnu_make}) {
-		$self->output("
+	$self->output("
 ifneq (\$(MAKECMDGOALS),clean)
 ifneq (\$(MAKECMDGOALS),distclean)
 ifneq (\$(MAKECMDGOALS),realdistclean)
 ");
-	}
-
 	$self->output("MK_FILES = " . array2oneperline(\@tmp) . "\n");
-
-	if ($self->{gnu_make}) {
-		$self->output("
+	$self->output("
 endif
 endif
 endif
 ");
-	}
 }
 
 sub array2oneperline($)
@@ -129,10 +130,9 @@ sub SharedModule($$)
 	$sane_subsystem =~ s/^lib//;
 	
 	if ($ctx->{TYPE} eq "PYTHON") {
-		push (@{$self->{python_dsos}}, 
-			"$ctx->{SHAREDDIR}/$ctx->{LIBRARY_REALNAME}");
+		$self->output("PYTHON_DSOS += $ctx->{SHAREDDIR}/$ctx->{LIBRARY_REALNAME}\n");
 	} else {
-		push (@{$self->{plugins}}, "$ctx->{SHAREDDIR}/$ctx->{LIBRARY_REALNAME}");
+		$self->output("PLUGINS += $ctx->{SHAREDDIR}/$ctx->{LIBRARY_REALNAME}\n");
 		$self->output("installplugins:: $ctx->{SHAREDDIR}/$ctx->{LIBRARY_REALNAME}\n");
 		$self->output("\t\@echo Installing $ctx->{SHAREDDIR}/$ctx->{LIBRARY_REALNAME} as \$(DESTDIR)\$(modulesdir)/$sane_subsystem/$ctx->{LIBRARY_REALNAME}\n");
 		$self->output("\t\@mkdir -p \$(DESTDIR)\$(modulesdir)/$sane_subsystem/\n");
@@ -220,36 +220,27 @@ sub SharedLibrary($$)
 {
 	my ($self,$ctx) = @_;
 
-	push (@{$self->{shared_libs}}, $ctx->{RESULT_SHARED_LIBRARY}) if (defined($ctx->{SO_VERSION}));
+	$self->output("SHARED_LIBS += $ctx->{SHAREDDIR}/$ctx->{LIBRARY_REALNAME}\n") if (defined($ctx->{SO_VERSION}));
 
 	$self->_prepare_list($ctx, "DEPEND_LIST");
 	$self->_prepare_list($ctx, "LINK_FLAGS");
 
-	my $soarg = "";
-	my $lns = "";
-	if ($self->{config}->{SONAMEFLAG} ne "#" and defined($ctx->{LIBRARY_SONAME})) {
-		$soarg = "$self->{config}->{SONAMEFLAG}$ctx->{LIBRARY_SONAME}";
-		if ($ctx->{LIBRARY_REALNAME} ne $ctx->{LIBRARY_SONAME}) {
-			$lns .= "\n\t\@test \$($ctx->{NAME}_VERSION) = \$($ctx->{NAME}_SOVERSION) || ln -fs $ctx->{LIBRARY_REALNAME} $ctx->{SHAREDDIR}/$ctx->{LIBRARY_SONAME}";
-		}
-	}
-
-	if (defined($ctx->{LIBRARY_SONAME})) {
-		$lns .= "\n\t\@ln -fs $ctx->{LIBRARY_REALNAME} $ctx->{SHAREDDIR}/$ctx->{LIBRARY_DEBUGNAME}";
-	}
-
 	$self->output(<< "__EOD__"
-#
 $ctx->{RESULT_SHARED_LIBRARY}: \$($ctx->{NAME}_DEPEND_LIST) \$($ctx->{NAME}_FULL_OBJ_LIST)
 	\@echo Linking \$\@
-	\@mkdir -p $ctx->{SHAREDDIR}
+	\@mkdir -p \$(\@D)
 	\@\$(SHLD) \$(LDFLAGS) \$(SHLD_FLAGS) \$(INTERN_LDFLAGS) -o \$\@ \$(INSTALL_LINK_FLAGS) \\
 		\$($ctx->{NAME}\_FULL_OBJ_LIST) \\
 		\$($ctx->{NAME}_LINK_FLAGS) \\
-		$soarg$lns
+		\$(if \$(SONAMEFLAG), \$(SONAMEFLAG)$ctx->{LIBRARY_SONAME})
 __EOD__
 );
-	$self->output("\n");
+	if ($ctx->{LIBRARY_REALNAME} ne $ctx->{LIBRARY_SONAME}) {
+		$self->output("\t\@test \$($ctx->{NAME}_VERSION) = \$($ctx->{NAME}_SOVERSION) || ln -fs $ctx->{LIBRARY_REALNAME} $ctx->{SHAREDDIR}/$ctx->{LIBRARY_SONAME}\n");
+	}
+	$self->output("ifdef $ctx->{NAME}_SOVERSION\n");
+	$self->output("\t\@ln -fs $ctx->{LIBRARY_REALNAME} $ctx->{SHAREDDIR}/$ctx->{LIBRARY_DEBUGNAME}\n");
+	$self->output("endif\n");
 }
 
 sub MergedObj($$)
@@ -263,7 +254,7 @@ sub MergedObj($$)
 #
 $ctx->{RESULT_MERGED_OBJ}: \$($ctx->{NAME}_OBJ_LIST)
 	\@echo Partially linking \$@
-	\@mkdir -p bin/mergedobj
+	\@mkdir -p \$(\@D)
 	\$(PARTLINK) -o \$@ \$($ctx->{NAME}_OBJ_LIST)
 
 __EOD__
@@ -276,43 +267,23 @@ sub StaticLibrary($$)
 
 	return unless (defined($ctx->{OBJ_FILES}));
 
-	push (@{$self->{static_libs}}, $ctx->{RESULT_STATIC_LIBRARY}) if ($ctx->{TYPE} eq "LIBRARY");
+	$self->output("STATIC_LIBS += $ctx->{TARGET_STATIC_LIBRARY}\n") if ($ctx->{TYPE} eq "LIBRARY");
 
 	$self->output("$ctx->{NAME}_OUTPUT = $ctx->{OUTPUT}\n");
 	$self->_prepare_list($ctx, "FULL_OBJ_LIST");
 
-	$self->output(<< "__EOD__"
-#
-$ctx->{RESULT_STATIC_LIBRARY}: \$($ctx->{NAME}_FULL_OBJ_LIST)
-	\@echo Linking \$@
-	\@rm -f \$@
-	\@mkdir -p $ctx->{STATICDIR}
-	\@\$(STLD) \$(STLD_FLAGS) \$@ \$($ctx->{NAME}_FULL_OBJ_LIST)
-
-__EOD__
-);
-}
-
-sub Header($$)
-{
-	my ($self,$ctx) = @_;
-
-	foreach (@{$ctx->{PUBLIC_HEADERS}}) {
-		push (@{$self->{headers}}, output::add_dir_str($ctx->{BASEDIR}, $_));
-	}
+	$self->output("$ctx->{RESULT_STATIC_LIBRARY}: \$($ctx->{NAME}_FULL_OBJ_LIST)\n");
 }
 
 sub Binary($$)
 {
 	my ($self,$ctx) = @_;
 
-	my $extradir = "";
-
 	unless (defined($ctx->{INSTALLDIR})) {
 	} elsif ($ctx->{INSTALLDIR} eq "SBINDIR") {
-		push (@{$self->{sbin_progs}}, $ctx->{RESULT_BINARY});
+		$self->output("SBIN_PROGS += bin/$ctx->{BINARY}\n");
 	} elsif ($ctx->{INSTALLDIR} eq "BINDIR") {
-		push (@{$self->{bin_progs}}, $ctx->{RESULT_BINARY});
+		$self->output("BIN_PROGS += bin/$ctx->{BINARY}\n");
 	}
 
 	$self->output("binaries:: $ctx->{TARGET_BINARY}\n");
@@ -350,103 +321,34 @@ sub PythonFiles($$)
 	foreach (@{$ctx->{PYTHON_FILES}}) {
 		my $target = "bin/python/".basename($_);
 		my $source = output::add_dir_str($ctx->{BASEDIR}, $_);
-		$self->output("$target: $source\n" .
-					  "\tmkdir -p \$(builddir)/bin/python\n" .
-		              "\tcp $source \$@\n\n");
-		push (@{$self->{python_pys}}, $target);
+		$self->output("$target: $source\n\n");
+		$self->output("PYTHON_PYS += $target\n");
 	}
 }
 
-sub Manpage($$)
-{
-	my ($self,$ctx) = @_;
-
-	my $path = output::add_dir_str($ctx->{BASEDIR}, $ctx->{MANPAGE});
-	push (@{$self->{manpages}}, $path);
-}
-
 sub ProtoHeader($$)
 {
 	my ($self,$ctx) = @_;
 
-	my $target = "";
-	my $comment = "Creating ";
-
-	my $priv = undef;
-	my $pub = undef;
+	my $priv = output::add_dir_str($ctx->{BASEDIR}, $ctx->{PRIVATE_PROTO_HEADER});
+	$self->output("PROTO_HEADERS += $priv\n");
 
-	if (defined($ctx->{PRIVATE_PROTO_HEADER})) {
-		$priv = output::add_dir_str($ctx->{BASEDIR}, $ctx->{PRIVATE_PROTO_HEADER});
-		$target .= $priv;
-		$comment .= $priv;
-		if (defined($ctx->{PUBLIC_PROTO_HEADER})) {
-			$comment .= " and ";
-			$target.= " ";
-		}
-		push (@{$self->{proto_headers}}, $priv);
-	} else {
-		$ctx->{PRIVATE_PROTO_HEADER} = $ctx->{PUBLIC_PROTO_HEADER};
-		$priv = output::add_dir_str($ctx->{BASEDIR}, $ctx->{PRIVATE_PROTO_HEADER});
-	}
-
-	if (defined($ctx->{PUBLIC_PROTO_HEADER})) {
-		$pub = output::add_dir_str($ctx->{BASEDIR}, $ctx->{PUBLIC_PROTO_HEADER});
-		$comment .= $pub;
-		$target .= $pub;
-		push (@{$self->{proto_headers}}, $pub);
-	} else {
-		$ctx->{PUBLIC_PROTO_HEADER} = $ctx->{PRIVATE_PROTO_HEADER};
-		$pub = output::add_dir_str($ctx->{BASEDIR}, $ctx->{PUBLIC_PROTO_HEADER});
-	}
-
-	$self->output("$pub: $ctx->{MK_FILE} \$($ctx->{NAME}_OBJ_LIST:.o=.c) \$(srcdir)/script/mkproto.pl\n");
-	$self->output("\t\@echo \"$comment\"\n");
-	$self->output("\t\@\$(PERL) \$(srcdir)/script/mkproto.pl --srcdir=\$(srcdir) --builddir=\$(builddir) --private=$priv --public=$pub \$($ctx->{NAME}_OBJ_LIST)\n\n");
+	$self->output("$priv: $ctx->{MK_FILE} \$($ctx->{NAME}_OBJ_LIST:.o=.c) \$(srcdir)/script/mkproto.pl\n");
+	$self->output("\t\@echo \"Creating \$@\"\n");
+	$self->output("\t\@mkdir -p \$(\@D)\n");
+	$self->output("\t\@\$(PERL) \$(srcdir)/script/mkproto.pl --srcdir=\$(srcdir) --builddir=\$(builddir) --all=\$@ \$($ctx->{NAME}_OBJ_LIST)\n\n");
 }
 
 sub write($$)
 {
 	my ($self, $file) = @_;
 
-	$self->output("MANPAGES = " . array2oneperline($self->{manpages})."\n");
-	$self->output("BIN_PROGS = " . array2oneperline($self->{bin_progs}) . "\n");
-	$self->output("SBIN_PROGS = " . array2oneperline($self->{sbin_progs}) . "\n");
-	$self->output("STATIC_LIBS = " . array2oneperline($self->{static_libs}) . "\n");
-	$self->output("SHARED_LIBS = " . array2oneperline($self->{shared_libs}) . "\n");
-	$self->output("PYTHON_DSOS = " . array2oneperline($self->{python_dsos}) . "\n");
-	$self->output("PYTHON_PYS = " . array2oneperline($self->{python_pys}) . "\n");
-	$self->output("PUBLIC_HEADERS = " . array2oneperline($self->{headers}) . "\n");
-	$self->output("PC_FILES = " . array2oneperline($self->{pc_files}) . "\n");
 	$self->output("ALL_OBJS = " . array2oneperline($self->{all_objs}) . "\n");
-	$self->output("PROTO_HEADERS = " . array2oneperline($self->{proto_headers}) .  "\n");
-	$self->output("PLUGINS = " . array2oneperline($self->{plugins}) . "\n");
 
 	$self->_prepare_mk_files();
 
 	$self->output($self->{mkfile});
 
-	if ($self->{automatic_deps}) {
-		$self->output("
-ifneq (\$(MAKECMDGOALS),clean)
-ifneq (\$(MAKECMDGOALS),distclean)
-ifneq (\$(MAKECMDGOALS),realdistclean)
-ifneq (\$(SKIP_DEP_FILES),yes)
--include \$(DEP_FILES)
-endif
-endif
-endif
-endif
-
-ifneq (\$(SKIP_DEP_FILES),yes)
-clean::
-	\@echo Removing dependency files
-	\@find . -name '*.d' -o -name '*.hd' | xargs rm -f
-endif
-");
-	} else {
-		$self->output("include \$(srcdir)/static_deps.mk\n");
-	}
-
 	open(MAKEFILE,">$file") || die ("Can't open $file\n");
 	print MAKEFILE $self->{output};
 	close(MAKEFILE);
@@ -454,4 +356,51 @@ endif
 	print __FILE__.": creating $file\n";
 }
 
+my $sort_available = eval "use sort 'stable'; return 1;";
+$sort_available = 0 unless defined($sort_available);
+
+sub by_path {
+	return  1 if($a =~ m#^\-I/#);
+    	return -1 if($b =~ m#^\-I/#);
+	return  0;
+}
+
+sub CFlags($$)
+{
+	my ($self, $key) = @_;
+
+	my $srcdir = $self->{config}->{srcdir};
+	my $builddir = $self->{config}->{builddir};
+
+	my $src_ne_build = ($srcdir ne $builddir) ? 1 : 0;
+
+	return unless defined ($key->{OBJ_LIST});
+	return unless defined ($key->{FINAL_CFLAGS});
+	return unless (@{$key->{FINAL_CFLAGS}} > 0);
+
+	my @sorted_cflags = @{$key->{FINAL_CFLAGS}};
+	if ($sort_available) {
+		@sorted_cflags = sort by_path @{$key->{FINAL_CFLAGS}};
+	}
+
+	# Rewrite CFLAGS so that both the source and the build
+	# directories are in the path.
+	my @cflags = ();
+	foreach my $flag (@sorted_cflags) {
+		if($src_ne_build) {
+				if($flag =~ m#^-I([^/].*$)#) {
+					my $dir = $1;
+					$dir =~ s#^\$\((?:src|build)dir\)/?##;
+				push(@cflags, "-I$builddir/$dir", "-I$srcdir/$dir");
+					next;
+				}
+		}
+		push(@cflags, $flag);
+	}
+	
+	my $cflags = join(' ', @cflags);
+
+	$self->output("\$(patsubst %.ho,%.d,\$(key->{NAME}_OBJ_LIST:.o=.d)) \$($key->{NAME}_OBJ_LIST): CFLAGS+= $cflags\n");
+}
+
 1;
diff --git a/source4/build/smb_build/output.pm b/source4/build/smb_build/output.pm
index ff9afe8e8c..4ae4a62cf4 100644
--- a/source4/build/smb_build/output.pm
+++ b/source4/build/smb_build/output.pm
@@ -101,9 +101,6 @@ sub generate_merged_obj($)
 		$lib->{MERGED_OBJNAME} = lc($link_name).".o";
 		$lib->{RESULT_MERGED_OBJ} = $lib->{OUTPUT_MERGED_OBJ} = "bin/mergedobj/$lib->{MERGED_OBJNAME}";
 		$lib->{TARGET_MERGED_OBJ} = $lib->{RESULT_MERGED_OBJ};
-	} else {
-		$lib->{TARGET_MERGED_OBJ} = "";
-		$lib->{RESULT_MERGED_OBJ} = "";
 	}
 }
 
@@ -124,10 +121,6 @@ sub generate_static_library($)
 		$lib->{TARGET_STATIC_LIBRARY} = $lib->{RESULT_STATIC_LIBRARY};
 		$lib->{STATICDIR} = 'bin/static';
 		$lib->{OUTPUT_STATIC_LIBRARY} = "-l".lc($link_name);
-	} else {
-		$lib->{RESULT_STATIC_LIBRARY} = "";
-		$lib->{TARGET_STATIC_LIBRARY} = "";
-		$lib->{OUTPUT_STATIC_LIBRARY} = "";
 	}
 }
 
diff --git a/source4/cldap_server/cldap_server.c b/source4/cldap_server/cldap_server.c
index 7858ee2cf0..783e31d1ae 100644
--- a/source4/cldap_server/cldap_server.c
+++ b/source4/cldap_server/cldap_server.c
@@ -92,7 +92,7 @@ static NTSTATUS cldapd_add_socket(struct cldapd_server *cldapd, struct loadparm_
 	NTSTATUS status;
 
 	/* listen for unicasts on the CLDAP port (389) */
-	cldapsock = cldap_socket_init(cldapd, cldapd->task->event_ctx);
+	cldapsock = cldap_socket_init(cldapd, cldapd->task->event_ctx, lp_iconv_convenience(cldapd->task->lp_ctx));
 	NT_STATUS_HAVE_NO_MEMORY(cldapsock);
 
 	socket_address = socket_address_from_strings(cldapsock, cldapsock->sock->backend_name, 
diff --git a/source4/cluster/ctdb/opendb_ctdb.c b/source4/cluster/ctdb/opendb_ctdb.c
index 3dfc6819b7..e84f2364d4 100644
--- a/source4/cluster/ctdb/opendb_ctdb.c
+++ b/source4/cluster/ctdb/opendb_ctdb.c
@@ -409,10 +409,12 @@ static NTSTATUS odb_ctdb_open_file_pending(struct odb_lock *lck, void *private)
 /*
   remove a opendb entry
 */
-static NTSTATUS odb_ctdb_close_file(struct odb_lock *lck, void *file_handle)
+static NTSTATUS odb_ctdb_close_file(struct odb_lock *lck, void *file_handle,
+				    const char **_delete_path)
 {
 	struct odb_context *odb = lck->odb;
 	struct opendb_file file;
+	const char *delete_path = NULL;
 	int i;
 	NTSTATUS status;
 
@@ -448,6 +450,15 @@ static NTSTATUS odb_ctdb_close_file(struct odb_lock *lck, void *file_handle)
 	file.num_pending = 0;
 
 	file.num_entries--;
+
+	if (file.num_entries == 0 && file.delete_on_close) {
+		delete_path = talloc_strdup(lck, file.path);
+		NT_STATUS_HAVE_NO_MEMORY(delete_path);
+	}
+
+	if (_delete_path) {
+		*_delete_path = delete_path;
+	}
 	
 	return odb_push_record(lck, &file);
 }
@@ -532,6 +543,25 @@ static NTSTATUS odb_ctdb_rename(struct odb_lock *lck, const char *path)
 }
 
 /*
+  get the path of an open file
+*/
+static NTSTATUS odb_ctdb_get_path(struct odb_lock *lck, const char **path)
+{
+	struct opendb_file file;
+	NTSTATUS status;
+
+	*path = NULL;
+
+	status = odb_pull_record(lck, &file);
+	/* we don't ignore NT_STATUS_OBJECT_NAME_NOT_FOUND here */
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	*path = file.path;
+
+	return NT_STATUS_OK;
+}
+
+/*
   update delete on close flag on an open file
 */
 static NTSTATUS odb_ctdb_set_delete_on_close(struct odb_lock *lck, bool del_on_close)
@@ -552,20 +582,20 @@ static NTSTATUS odb_ctdb_set_delete_on_close(struct odb_lock *lck, bool del_on_c
   people still have the file open
 */
 static NTSTATUS odb_ctdb_get_delete_on_close(struct odb_context *odb, 
-					    DATA_BLOB *key, bool *del_on_close, 
-					    int *open_count, char **path)
+					    DATA_BLOB *key, bool *del_on_close)
 {
 	NTSTATUS status;
 	struct opendb_file file;
 	struct odb_lock *lck;
 
+	(*del_on_close) = false;
+
 	lck = odb_lock(odb, odb, key);
 	NT_STATUS_HAVE_NO_MEMORY(lck);
 
 	status = odb_pull_record(lck, &file);
 	if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_NOT_FOUND, status)) {
 		talloc_free(lck);
-		(*del_on_close) = false;
 		return NT_STATUS_OK;
 	}
 	if (!NT_STATUS_IS_OK(status)) {
@@ -574,16 +604,6 @@ static NTSTATUS odb_ctdb_get_delete_on_close(struct odb_context *odb,
 	}
 
 	(*del_on_close) = file.delete_on_close;
-	if (open_count != NULL) {
-		(*open_count) = file.num_entries;
-	}
-	if (path != NULL) {
-		*path = talloc_strdup(odb, file.path);
-		NT_STATUS_HAVE_NO_MEMORY(*path);
-		if (file.num_entries == 1 && file.entries[0].delete_on_close) {
-			(*del_on_close) = true;
-		}
-	}
 
 	talloc_free(lck);
 
@@ -652,6 +672,7 @@ static const struct opendb_ops opendb_ctdb_ops = {
 	.odb_close_file          = odb_ctdb_close_file,
 	.odb_remove_pending      = odb_ctdb_remove_pending,
 	.odb_rename              = odb_ctdb_rename,
+	.odb_get_path            = odb_ctdb_get_path,
 	.odb_set_delete_on_close = odb_ctdb_set_delete_on_close,
 	.odb_get_delete_on_close = odb_ctdb_get_delete_on_close,
 	.odb_can_open            = odb_ctdb_can_open,
diff --git a/source4/configure.ac b/source4/configure.ac
index b609b4f52c..5ba441375c 100644
--- a/source4/configure.ac
+++ b/source4/configure.ac
@@ -78,6 +78,8 @@ SMB_EXT_LIB_FROM_PKGCONFIG(LIBLDB, ldb >= 0.9.1,
 			AC_DEFINE_UNQUOTED(LDB_MODULESDIR, "${LDB_MODULESDIR}" , [ldb Modules directory])
 		fi
 		])
+		ldbdir=lib/ldb
+		AC_SUBST(ldbdir)
 		m4_include(lib/ldb/sqlite3.m4)
 		m4_include(lib/ldb/libldb.m4)
 		SMB_INCLUDE_MK(lib/ldb/config.mk)
@@ -226,3 +228,12 @@ AC_FOREACH([AC_Var], m4_defn([_AC_SUBST_VARS]), [
 AC_Var = $AC_Var])
 $MAKE_SETTINGS
 CEOF
+
+if test $USESHARED = true
+then
+	echo "To run binaries without installing, set the following environment variable:"
+	echo "$ac_cv_LIB_PATH_VAR=$builddir/bin/shared"
+fi
+
+echo
+echo "To build Samba, run $ac_cv_path_MAKE"
diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
index bee1eac480..ace5e0edaf 100644
--- a/source4/dsdb/common/util.c
+++ b/source4/dsdb/common/util.c
@@ -469,8 +469,8 @@ NTTIME samdb_result_allow_password_change(struct ldb_context *sam_ldb,
 }
 
 /*
-  construct the force_password_change field from the PwdLastSet attribute and the 
-  domain password settings
+  construct the force_password_change field from the PwdLastSet
+  attribute, the userAccountControl and the domain password settings
 */
 NTTIME samdb_result_force_password_change(struct ldb_context *sam_ldb, 
 					  TALLOC_CTX *mem_ctx, 
@@ -478,10 +478,12 @@ NTTIME samdb_result_force_password_change(struct ldb_context *sam_ldb,
 					  struct ldb_message *msg)
 {
 	uint64_t attr_time = samdb_result_uint64(msg, "pwdLastSet", 0);
-	uint32_t user_flags = samdb_result_uint64(msg, "userAccountControl", 0);
+	uint32_t userAccountControl = samdb_result_uint64(msg, "userAccountControl", 0);
 	int64_t maxPwdAge;
 
-	if (user_flags & UF_DONT_EXPIRE_PASSWD) {
+	/* Machine accounts don't expire, and there is a flag for 'no expiry' */
+	if (!(userAccountControl & UF_NORMAL_ACCOUNT)
+	    || (userAccountControl & UF_DONT_EXPIRE_PASSWD)) {
 		return 0x7FFFFFFFFFFFFFFFULL;
 	}
 
@@ -596,11 +598,30 @@ struct samr_LogonHours samdb_result_logon_hours(TALLOC_CTX *mem_ctx, struct ldb_
 
 /*
   pull a set of account_flags from a result set. 
+
+  This requires that the attributes: 
+   pwdLastSet
+   userAccountControl
+  be included in 'msg'
 */
-uint16_t samdb_result_acct_flags(struct ldb_message *msg, const char *attr)
+uint32_t samdb_result_acct_flags(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
+				 struct ldb_message *msg, struct ldb_dn *domain_dn)
 {
-	uint_t userAccountControl = ldb_msg_find_attr_as_uint(msg, attr, 0);
-	return samdb_uf2acb(userAccountControl);
+	uint32_t userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
+	uint32_t acct_flags = samdb_uf2acb(userAccountControl); 
+	NTTIME must_change_time;
+	NTTIME now;
+	
+	must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx, 
+							      domain_dn, msg);
+	
+	/* Test account expire time */
+	unix_to_nt_time(&now, time(NULL));
+	/* check for expired password */
+	if (must_change_time < now) {
+		acct_flags |= ACB_PW_EXPIRED;
+	}
+	return acct_flags;
 }
 
 
diff --git a/source4/dsdb/config.mk b/source4/dsdb/config.mk
index 17752fbbbd..fb8cd4f503 100644
--- a/source4/dsdb/config.mk
+++ b/source4/dsdb/config.mk
@@ -5,8 +5,7 @@ mkinclude samdb/ldb_modules/config.mk
 ################################################
 # Start SUBSYSTEM SAMDB
 [SUBSYSTEM::SAMDB]
-PUBLIC_PROTO_HEADER = samdb/samdb_proto.h
-PUBLIC_HEADERS = samdb/samdb.h
+PRIVATE_PROTO_HEADER = samdb/samdb_proto.h
 PUBLIC_DEPENDENCIES = HEIMDAL_KRB5 
 PRIVATE_DEPENDENCIES = LIBNDR NDR_MISC NDR_DRSUAPI NDR_DRSBLOBS NSS_WRAPPER \
 					   auth_system_session LDAP_ENCODE LIBCLI_AUTH LIBNDR \
@@ -17,8 +16,11 @@ OBJ_FILES = \
 		samdb/cracknames.o \
 		repl/replicated_objects.o
 
+
+PUBLIC_HEADERS += dsdb/samdb/samdb.h
+
 [SUBSYSTEM::SAMDB_COMMON]
-PUBLIC_PROTO_HEADER = common/proto.h
+PRIVATE_PROTO_HEADER = common/proto.h
 PRIVATE_DEPENDENCIES = LIBLDB
 OBJ_FILES = \
 		common/sidmap.o \
@@ -26,14 +28,16 @@ OBJ_FILES = \
 		common/util.o
 
 [SUBSYSTEM::SAMDB_SCHEMA]
-PUBLIC_PROTO_HEADER = schema/proto.h
-PUBLIC_HEADERS = schema/schema.h
+PRIVATE_PROTO_HEADER = schema/proto.h
 PRIVATE_DEPENDENCIES = SAMDB_COMMON NDR_DRSUAPI NDR_DRSBLOBS
 OBJ_FILES = \
 		schema/schema_init.o \
 		schema/schema_syntax.o \
 		schema/schema_constructed.o \
 
+
+PUBLIC_HEADERS += dsdb/schema/schema.h
+
 #######################
 # Start SUBSYSTEM DREPL_SRV
 [MODULE::DREPL_SRV]
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index 178149a886..905cd4a995 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -396,6 +396,7 @@ static int samldb_fill_group_object(struct ldb_module *module, const struct ldb_
 						    struct ldb_message **ret_msg)
 {
 	int ret;
+	unsigned int group_type;
 	char *name;
 	struct ldb_message *msg2;
 	struct ldb_dn *dom_dn;
@@ -452,6 +453,26 @@ static int samldb_fill_group_object(struct ldb_module *module, const struct ldb_
 		}
 	}
 	
+	if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
+		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+		talloc_free(mem_ctx);
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+	group_type = samdb_result_uint(msg2, "groupType", 0);
+	if (group_type == 0) {
+		ldb_asprintf_errstring(module->ldb, "groupType invalid");
+		talloc_free(mem_ctx);
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	} else {
+		unsigned int account_type = samdb_gtype2atype(group_type);
+		ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
+					 "sAMAccountType",
+					 account_type);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+	}
+
 	/* Manage SID allocation, conflicts etc */
 	ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn); 
 
@@ -473,6 +494,7 @@ static int samldb_fill_user_or_computer_object(struct ldb_module *module, const
 	const char *rdn_name;
 	TALLOC_CTX *mem_ctx = talloc_new(msg);
 	const char *errstr;
+	unsigned int user_account_control;
 	if (!mem_ctx) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
@@ -485,36 +507,15 @@ static int samldb_fill_user_or_computer_object(struct ldb_module *module, const
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	if (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL) {
-
-		ret = samdb_copy_template(module->ldb, msg2, 
-					  "computer",
-					  &errstr);
-		if (ret) {
-			ldb_asprintf_errstring(module->ldb, 
-					       "samldb_fill_user_or_computer_object: "
-					       "Error copying computer template: %s",
-					       errstr);
-			talloc_free(mem_ctx);
-			return ret;
-		}
-	} else {
-		ret = samdb_copy_template(module->ldb, msg2, 
-					  "user",
-					  &errstr);
-		if (ret) {
-			ldb_asprintf_errstring(module->ldb, 
-					       "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
-					       errstr);
-			talloc_free(mem_ctx);
-			return ret;
-		}
-		/* readd user objectclass */
-		ret = samdb_find_or_add_value(module->ldb, msg2, "objectclass", "user");
-		if (ret) {
-			talloc_free(mem_ctx);
-			return ret;
-		}
+	ret = samdb_copy_template(module->ldb, msg2, 
+				  "user",
+				  &errstr);
+	if (ret) {
+		ldb_asprintf_errstring(module->ldb, 
+				       "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
+				       errstr);
+		talloc_free(mem_ctx);
+		return ret;
 	}
 
 	rdn_name = ldb_dn_get_rdn_name(msg2->dn);
@@ -545,14 +546,30 @@ static int samldb_fill_user_or_computer_object(struct ldb_module *module, const
 		}
 	}
 
-	/*
-	  TODO: useraccountcontrol: setting value 0 gives 0x200 for users
-	*/
+	if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
+		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+		talloc_free(mem_ctx);
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+	user_account_control = samdb_result_uint(msg2, "userAccountControl", 0);
+	if (user_account_control == 0) {
+		ldb_asprintf_errstring(module->ldb, "userAccountControl invalid");
+		talloc_free(mem_ctx);
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	} else {
+		unsigned int account_type = samdb_uf2atype(user_account_control);
+		ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
+					 "sAMAccountType",
+					 account_type);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+	}
 
 	/* Manage SID allocation, conflicts etc */
 	ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn); 
 
-	/* TODO: objectCategory, userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
+	/* TODO: userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
 
 	if (ret == 0) {
 		*ret_msg = msg2;
@@ -689,7 +706,7 @@ static int samldb_add(struct ldb_module *module, struct ldb_request *req)
 	}
 
 	/* is user or computer? */
-	if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) ||
+	if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) || 
 	    (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL)) {
 		/*  add all relevant missing objects */
 		ret = samldb_fill_user_or_computer_object(module, msg, &msg2);
@@ -745,6 +762,53 @@ static int samldb_add(struct ldb_module *module, struct ldb_request *req)
 	return ret;
 }
 
+/* modify */
+static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
+{
+	struct ldb_message *msg;
+	struct ldb_message_element *el, *el2;
+	int ret;
+	unsigned int group_type, user_account_control, account_type;
+	if (ldb_msg_find_element(req->op.mod.message, "sAMAccountType") != NULL) {
+		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+		return LDB_ERR_UNWILLING_TO_PERFORM;
+	}
+
+	el = ldb_msg_find_element(req->op.mod.message, "groupType");
+	if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+		req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
+
+		group_type = strtoul((const char *)el->values[0].data, NULL, 0);
+		account_type =  samdb_gtype2atype(group_type);
+		ret = samdb_msg_add_uint(module->ldb, msg, msg,
+					 "sAMAccountType",
+					 account_type);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+		el2 = ldb_msg_find_element(msg, "sAMAccountType");
+		el2->flags = LDB_FLAG_MOD_REPLACE;
+	}
+
+	el = ldb_msg_find_element(req->op.mod.message, "userAccountControl");
+	if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+		req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
+
+		user_account_control = strtoul((const char *)el->values[0].data, NULL, 0);
+		account_type = samdb_uf2atype(user_account_control);
+		ret = samdb_msg_add_uint(module->ldb, msg, msg,
+					 "sAMAccountType",
+					 account_type);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+		el2 = ldb_msg_find_element(msg, "sAMAccountType");
+		el2->flags = LDB_FLAG_MOD_REPLACE;
+	}
+	return ldb_next_request(module, req);
+}
+
+
 static int samldb_init(struct ldb_module *module)
 {
 	return ldb_next_init(module);
@@ -754,4 +818,5 @@ _PUBLIC_ const struct ldb_module_ops ldb_samldb_module_ops = {
 	.name          = "samldb",
 	.init_context  = samldb_init,
 	.add           = samldb_add,
+	.modify        = samldb_modify
 };
diff --git a/source4/dynconfig.mk b/source4/dynconfig.mk
index e970d4cd4c..aa0565cd7a 100644
--- a/source4/dynconfig.mk
+++ b/source4/dynconfig.mk
@@ -21,5 +21,5 @@ PATH_FLAGS = -DCONFIGFILE=\"$(CONFIGFILE)\" \
 
 dynconfig.o: dynconfig.c Makefile
 	@echo Compiling $<
-	@$(CC) $(CFLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` $(CPPFLAGS) $(PICFLAG) \
-		$(PATH_FLAGS) -c $(FIRST_PREREQ) -o $@
+	@$(CC) $(CFLAGS) $(CPPFLAGS) $(PICFLAG) \
+		$(PATH_FLAGS) -c $< -o $@
diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c
index ff226e5b46..9a17e581e3 100644
--- a/source4/kdc/hdb-ldb.c
+++ b/source4/kdc/hdb-ldb.c
@@ -1168,8 +1168,8 @@ NTSTATUS kdc_hdb_ldb_create(TALLOC_CTX *mem_ctx,
 krb5_error_code hdb_ldb_create(krb5_context context, struct HDB **db, const char *arg)
 {
 	NTSTATUS nt_status;
-	/* The global kdc_mem_ctx, Disgusting, ugly hack, but it means one less private hook */
-	nt_status = kdc_hdb_ldb_create(kdc_mem_ctx, global_loadparm, 
+	/* The global kdc_mem_ctx and kdc_lp_ctx, Disgusting, ugly hack, but it means one less private hook */
+	nt_status = kdc_hdb_ldb_create(kdc_mem_ctx, kdc_lp_ctx, 
 				       context, db, arg);
 
 	if (NT_STATUS_IS_OK(nt_status)) {
diff --git a/source4/kdc/kdc.c b/source4/kdc/kdc.c
index 52ee475862..92a5dc26e0 100644
--- a/source4/kdc/kdc.c
+++ b/source4/kdc/kdc.c
@@ -41,8 +41,10 @@
 #include "param/param.h"
 
 
-/* Disgusting hack to get a mem_ctx into the hdb plugin, when used as a keytab */
+/* Disgusting hack to get a mem_ctx and lp_ctx into the hdb plugin, when 
+ * used as a keytab */
 TALLOC_CTX *kdc_mem_ctx;
+struct loadparm_context *kdc_lp_ctx;
 
 /* hold all the info needed to send a reply */
 struct kdc_reply {
@@ -648,6 +650,7 @@ static void kdc_task_init(struct task_server *task)
 	krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
 
 	kdc_mem_ctx = kdc->smb_krb5_context;
+	kdc_lp_ctx = task->lp_ctx;
 
 	/* start listening on the configured network interfaces */
 	status = kdc_startup_interfaces(kdc, task->lp_ctx, ifaces);
diff --git a/source4/kdc/kdc.h b/source4/kdc/kdc.h
index 3a1f9bd34e..9be15115d1 100644
--- a/source4/kdc/kdc.h
+++ b/source4/kdc/kdc.h
@@ -30,6 +30,7 @@ struct kdc_server;
 struct socket_address;
 
 extern TALLOC_CTX *kdc_mem_ctx;
+extern struct loadparm_context *kdc_lp_ctx;
 
 bool kpasswdd_process(struct kdc_server *kdc,
 		      TALLOC_CTX *mem_ctx, 
diff --git a/source4/lib/appweb/mpr/miniMpr.c b/source4/lib/appweb/mpr/miniMpr.c
index 949d64fcf1..52b23608aa 100644
--- a/source4/lib/appweb/mpr/miniMpr.c
+++ b/source4/lib/appweb/mpr/miniMpr.c
@@ -30,6 +30,7 @@
  */
 
 #include	"miniMpr.h"
+#include "param/param.h"
 
 /************************************ Code ************************************/
 #if !BLD_APPWEB
@@ -49,6 +50,12 @@ void *mprMemCtx(void)
 	return mpr_ctx;
 }
 
+/* return the loadparm context being used for all ejs variables */
+struct loadparm_context *mprLpCtx(void)
+{
+	return global_loadparm;
+}
+
 void mprFree(void *ptr)
 {
 	talloc_free(ptr);
diff --git a/source4/lib/appweb/mpr/miniMpr.h b/source4/lib/appweb/mpr/miniMpr.h
index 836fdab9f2..15ce30c8df 100644
--- a/source4/lib/appweb/mpr/miniMpr.h
+++ b/source4/lib/appweb/mpr/miniMpr.h
@@ -272,6 +272,8 @@ extern int 		mprMemcpy(char *dest, int destMax, const char *src, int nbytes);
 
 extern void mprSetCtx(void *ctx);
 extern void *mprMemCtx(void);
+struct loadparm_context;
+extern struct loadparm_context *mprLpCtx(void);
 
 /* This function needs to be provided by anyone using ejs */
 void ejs_exception(const char *reason);
diff --git a/source4/lib/basic.mk b/source4/lib/basic.mk
index a118636c52..d059bdf49b 100644
--- a/source4/lib/basic.mk
+++ b/source4/lib/basic.mk
@@ -22,17 +22,23 @@ mkinclude crypto/config.mk
 OBJ_FILES = compression/mszip.o
 
 [SUBSYSTEM::GENCACHE]
-PUBLIC_HEADERS = gencache/gencache.h
 OBJ_FILES = gencache/gencache.o
 PRIVATE_DEPENDENCIES = TDB_WRAP
 
+
+PUBLIC_HEADERS += lib/gencache/gencache.h
+
 [SUBSYSTEM::LDB_WRAP]
-PUBLIC_HEADERS = ldb_wrap.h
 OBJ_FILES = ldb_wrap.o
 PUBLIC_DEPENDENCIES = LIBLDB
 PRIVATE_DEPENDENCIES = LDBSAMBA UTIL_LDB
 
+
+PUBLIC_HEADERS += lib/ldb_wrap.h
+
 [SUBSYSTEM::TDB_WRAP]
-PUBLIC_HEADERS = tdb_wrap.h
 OBJ_FILES = tdb_wrap.o
 PUBLIC_DEPENDENCIES = LIBTDB
+
+
+PUBLIC_HEADERS += lib/tdb_wrap.h
diff --git a/source4/lib/charset/config.mk b/source4/lib/charset/config.mk
index 4f0c80c79d..2766784c52 100644
--- a/source4/lib/charset/config.mk
+++ b/source4/lib/charset/config.mk
@@ -5,9 +5,11 @@ OBJ_FILES = \
 		iconv.o \
 		charcnv.o \
 		util_unistr.o
-PUBLIC_HEADERS = charset.h
-PUBLIC_PROTO_HEADER = charset_proto.h
+PRIVATE_PROTO_HEADER = charset_proto.h
 PUBLIC_DEPENDENCIES = ICONV
 PRIVATE_DEPENDENCIES = DYNCONFIG
 # End SUBSYSTEM CHARSET
 ################################################
+
+
+PUBLIC_HEADERS += lib/charset/charset.h
diff --git a/source4/lib/charset/util_unistr.c b/source4/lib/charset/util_unistr.c
index e0e1aed222..9b87f49800 100644
--- a/source4/lib/charset/util_unistr.c
+++ b/source4/lib/charset/util_unistr.c
@@ -123,6 +123,7 @@ _PUBLIC_ int strcasecmp_m(const char *s1, const char *s2)
 {
 	codepoint_t c1=0, c2=0;
 	size_t size1, size2;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	/* handle null ptr comparisons to simplify the use in qsort */
 	if (s1 == s2) return 0;
@@ -130,8 +131,8 @@ _PUBLIC_ int strcasecmp_m(const char *s1, const char *s2)
 	if (s2 == NULL) return 1;
 
 	while (*s1 && *s2) {
-		c1 = next_codepoint(lp_iconv_convenience(global_loadparm), s1, &size1);
-		c2 = next_codepoint(lp_iconv_convenience(global_loadparm), s2, &size2);
+		c1 = next_codepoint(iconv_convenience, s1, &size1);
+		c2 = next_codepoint(iconv_convenience, s2, &size2);
 
 		s1 += size1;
 		s2 += size2;
@@ -207,6 +208,7 @@ _PUBLIC_ int strncasecmp_m(const char *s1, const char *s2, size_t n)
 {
 	codepoint_t c1=0, c2=0;
 	size_t size1, size2;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	/* handle null ptr comparisons to simplify the use in qsort */
 	if (s1 == s2) return 0;
@@ -216,8 +218,8 @@ _PUBLIC_ int strncasecmp_m(const char *s1, const char *s2, size_t n)
 	while (*s1 && *s2 && n) {
 		n--;
 
-		c1 = next_codepoint(lp_iconv_convenience(global_loadparm), s1, &size1);
-		c2 = next_codepoint(lp_iconv_convenience(global_loadparm), s2, &size2);
+		c1 = next_codepoint(iconv_convenience, s1, &size1);
+		c2 = next_codepoint(iconv_convenience, s2, &size2);
 
 		s1 += size1;
 		s2 += size2;
@@ -480,6 +482,7 @@ _PUBLIC_ char *strlower_talloc(TALLOC_CTX *ctx, const char *src)
 {
 	size_t size=0;
 	char *dest;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	/* this takes advantage of the fact that upper/lower can't
 	   change the length of a character by more than 1 byte */
@@ -490,12 +493,12 @@ _PUBLIC_ char *strlower_talloc(TALLOC_CTX *ctx, const char *src)
 
 	while (*src) {
 		size_t c_size;
-		codepoint_t c = next_codepoint(lp_iconv_convenience(global_loadparm), src, &c_size);
+		codepoint_t c = next_codepoint(iconv_convenience, src, &c_size);
 		src += c_size;
 
 		c = tolower_w(c);
 
-		c_size = push_codepoint(lp_iconv_convenience(global_loadparm), dest+size, c);
+		c_size = push_codepoint(iconv_convenience, dest+size, c);
 		if (c_size == -1) {
 			talloc_free(dest);
 			return NULL;
@@ -520,6 +523,7 @@ _PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
 {
 	size_t size=0;
 	char *dest;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 	
 	if (!src) {
 		return NULL;
@@ -534,12 +538,12 @@ _PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
 
 	while (*src) {
 		size_t c_size;
-		codepoint_t c = next_codepoint(lp_iconv_convenience(global_loadparm), src, &c_size);
+		codepoint_t c = next_codepoint(iconv_convenience, src, &c_size);
 		src += c_size;
 
 		c = toupper_w(c);
 
-		c_size = push_codepoint(lp_iconv_convenience(global_loadparm), dest+size, c);
+		c_size = push_codepoint(iconv_convenience, dest+size, c);
 		if (c_size == -1) {
 			talloc_free(dest);
 			return NULL;
@@ -563,6 +567,7 @@ _PUBLIC_ char *strupper_talloc(TALLOC_CTX *ctx, const char *src)
 _PUBLIC_ void strlower_m(char *s)
 {
 	char *d;
+	struct smb_iconv_convenience *iconv_convenience;
 
 	/* this is quite a common operation, so we want it to be
 	   fast. We optimise for the ascii case, knowing that all our
@@ -576,12 +581,14 @@ _PUBLIC_ void strlower_m(char *s)
 	if (!*s)
 		return;
 
+	iconv_convenience = lp_iconv_convenience(global_loadparm);
+
 	d = s;
 
 	while (*s) {
 		size_t c_size, c_size2;
-		codepoint_t c = next_codepoint(lp_iconv_convenience(global_loadparm), s, &c_size);
-		c_size2 = push_codepoint(lp_iconv_convenience(global_loadparm), d, tolower_w(c));
+		codepoint_t c = next_codepoint(iconv_convenience, s, &c_size);
+		c_size2 = push_codepoint(iconv_convenience, d, tolower_w(c));
 		if (c_size2 > c_size) {
 			DEBUG(0,("FATAL: codepoint 0x%x (0x%x) expanded from %d to %d bytes in strlower_m\n",
 				 c, tolower_w(c), (int)c_size, (int)c_size2));
@@ -599,6 +606,7 @@ _PUBLIC_ void strlower_m(char *s)
 _PUBLIC_ void strupper_m(char *s)
 {
 	char *d;
+	struct smb_iconv_convenience *iconv_convenience;
 
 	/* this is quite a common operation, so we want it to be
 	   fast. We optimise for the ascii case, knowing that all our
@@ -612,12 +620,14 @@ _PUBLIC_ void strupper_m(char *s)
 	if (!*s)
 		return;
 
+	iconv_convenience = lp_iconv_convenience(global_loadparm);
+
 	d = s;
 
 	while (*s) {
 		size_t c_size, c_size2;
-		codepoint_t c = next_codepoint(lp_iconv_convenience(global_loadparm), s, &c_size);
-		c_size2 = push_codepoint(lp_iconv_convenience(global_loadparm), d, toupper_w(c));
+		codepoint_t c = next_codepoint(iconv_convenience, s, &c_size);
+		c_size2 = push_codepoint(iconv_convenience, d, toupper_w(c));
 		if (c_size2 > c_size) {
 			DEBUG(0,("FATAL: codepoint 0x%x (0x%x) expanded from %d to %d bytes in strupper_m\n",
 				 c, toupper_w(c), (int)c_size, (int)c_size2));
diff --git a/source4/lib/cmdline/config.mk b/source4/lib/cmdline/config.mk
index a1f876d56a..87014d4d53 100644
--- a/source4/lib/cmdline/config.mk
+++ b/source4/lib/cmdline/config.mk
@@ -4,10 +4,11 @@ OBJ_FILES = credentials.o
 PUBLIC_DEPENDENCIES = CREDENTIALS LIBPOPT
 
 [SUBSYSTEM::POPT_SAMBA]
-PUBLIC_HEADERS = popt_common.h 
 OBJ_FILES = popt_common.o
 PUBLIC_DEPENDENCIES = LIBPOPT
 
+PUBLIC_HEADERS += lib/cmdline/popt_common.h 
+
 [SUBSYSTEM::POPT_CREDENTIALS]
 PRIVATE_PROTO_HEADER = popt_credentials.h
 OBJ_FILES = popt_credentials.o
diff --git a/source4/lib/events/config.mk b/source4/lib/events/config.mk
index 910cf3738f..225a23c634 100644
--- a/source4/lib/events/config.mk
+++ b/source4/lib/events/config.mk
@@ -32,11 +32,12 @@ INIT_FUNCTION = s4_events_standard_init
 # Start SUBSYSTEM LIBEVENTS
 [SUBSYSTEM::LIBEVENTS]
 OBJ_FILES = events.o events_timed.o events_signal.o
-PUBLIC_HEADERS = events.h events_internal.h
 PUBLIC_DEPENDENCIES = LIBTALLOC LIBSAMBA-UTIL
 # End SUBSYSTEM LIBEVENTS
 ##############################
 
+PUBLIC_HEADERS += $(addprefix lib/events/, events.h events_internal.h)
+
 [PYTHON::swig_events]
 SWIG_FILE = events.i
 PRIVATE_DEPENDENCIES = LIBEVENTS
diff --git a/source4/lib/ldb/config.mk b/source4/lib/ldb/config.mk
index d6980f341a..81fd1e9b95 100644
--- a/source4/lib/ldb/config.mk
+++ b/source4/lib/ldb/config.mk
@@ -147,12 +147,14 @@ PUBLIC_DEPENDENCIES = \
 		LIBTALLOC
 PRIVATE_DEPENDENCIES = \
 		SOCKET_WRAPPER
-MANPAGE = man/ldb.3
-PUBLIC_HEADERS = include/ldb.h include/ldb_errors.h
 #
 # End SUBSYSTEM ldb
 ################################################
 
+PUBLIC_HEADERS += $(ldbdir)/include/ldb.h $(ldbdir)/include/ldb_errors.h
+
+MANPAGES += $(ldbdir)/man/ldb.3
+
 ################################################
 # Start BINARY ldbtest
 [BINARY::ldbtest]
@@ -167,7 +169,6 @@ PRIVATE_DEPENDENCIES = \
 # Start BINARY oLschema2ldif
 [BINARY::oLschema2ldif]
 INSTALLDIR = BINDIR
-MANPAGE = man/oLschema2ldif.1
 OBJ_FILES= \
 		tools/convert.o \
 		tools/oLschema2ldif.o
@@ -176,11 +177,12 @@ PRIVATE_DEPENDENCIES = \
 # End BINARY oLschema2ldif
 ################################################
 
+MANPAGES += $(ldbdir)/man/oLschema2ldif.1
+
 ################################################
 # Start BINARY  ad2oLschema
 [BINARY::ad2oLschema]
 INSTALLDIR = BINDIR
-MANPAGE = man/ad2oLschema.1
 OBJ_FILES= \
 		tools/convert.o \
 		tools/ad2oLschema.o
@@ -189,6 +191,7 @@ PRIVATE_DEPENDENCIES = \
 # End BINARY ad2oLschema
 ################################################
 
+MANPAGES += $(ldbdir)/man/ad2oLschema.1
 
 mkinclude tools/config.mk
 mkinclude ldb_ildap/config.mk
diff --git a/source4/lib/ldb/include/ldb.h b/source4/lib/ldb/include/ldb.h
index 2e54920c17..2e13a774b9 100644
--- a/source4/lib/ldb/include/ldb.h
+++ b/source4/lib/ldb/include/ldb.h
@@ -290,7 +290,7 @@ char *ldb_filter_from_tree(TALLOC_CTX *mem_ctx, struct ldb_parse_tree *tree);
    2254 (Section 4). This function also escapes any non-printable
    characters.
 
-   \param ctx the memory context to allocate the return string in.
+   \param mem_ctx the memory context to allocate the return string in.
    \param val the (potentially) binary data to be encoded
 
    \return the encoded data as a null terminated string
@@ -886,7 +886,7 @@ int ldb_search_default_callback(struct ldb_context *ldb, void *context, struct l
   \param attrs the search attributes for the query (pass NULL if none required)
   \param controls an array of controls
   \param context the callback function context
-  \param the callback function to handle the async replies
+  \param callback the callback function to handle the async replies
 
   \return result code (LDB_SUCCESS on success, or a failure code)
 */
@@ -911,7 +911,7 @@ int ldb_build_search_req(struct ldb_request **ret_req,
   \param message contains the entry to be added 
   \param controls an array of controls
   \param context the callback function context
-  \param the callback function to handle the async replies
+  \param callback the callback function to handle the async replies
 
   \return result code (LDB_SUCCESS on success, or a failure code)
 */
@@ -933,7 +933,7 @@ int ldb_build_add_req(struct ldb_request **ret_req,
   \param message contains the entry to be modified
   \param controls an array of controls
   \param context the callback function context
-  \param the callback function to handle the async replies
+  \param callback the callback function to handle the async replies
 
   \return result code (LDB_SUCCESS on success, or a failure code)
 */
@@ -955,7 +955,7 @@ int ldb_build_mod_req(struct ldb_request **ret_req,
   \param dn the DN to be deleted
   \param controls an array of controls
   \param context the callback function context
-  \param the callback function to handle the async replies
+  \param callback the callback function to handle the async replies
 
   \return result code (LDB_SUCCESS on success, or a failure code)
 */
@@ -978,7 +978,7 @@ int ldb_build_del_req(struct ldb_request **ret_req,
   \param newdn the new DN
   \param controls an array of controls
   \param context the callback function context
-  \param the callback function to handle the async replies
+  \param callback the callback function to handle the async replies
 
   \return result code (LDB_SUCCESS on success, or a failure code)
 */
@@ -997,7 +997,7 @@ int ldb_build_rename_req(struct ldb_request **ret_req,
 
   \param req the request struct where to add the control
   \param oid the object identifier of the control as string
-  \param ciritical whether the control should be critical or not
+  \param critical whether the control should be critical or not
   \param data a talloc pointer to the control specific data
 
   \return result code (LDB_SUCCESS on success, or a failure code)
@@ -1137,7 +1137,7 @@ int ldb_extended_default_callback(struct ldb_context *ldb, void *context, struct
   it needs to be NULL or a valid talloc pointer! talloc_get_type() will be used on it  
   \param controls an array of controls
   \param context the callback function context
-  \param the callback function to handle the async replies
+  \param callback the callback function to handle the async replies
 
   \return result code (LDB_SUCCESS on success, or a failure code)
 */
@@ -1226,6 +1226,7 @@ int ldb_valid_attr_name(const char *s);
 /*
   ldif manipulation functions
 */
+
 /**
    Write an LDIF message
 
@@ -1418,8 +1419,8 @@ bool ldb_dn_is_null(struct ldb_dn *dn);
    This function compares to attribute names. Note that this is a
    case-insensitive comparison.
 
-   \param attr1 the first attribute name to compare
-   \param attr2 the second attribute name to compare
+   \param a the first attribute name to compare
+   \param b the second attribute name to compare
 
    \return 0 if the attribute names are the same, or only differ in
    case; non-zero if there are any differences
@@ -1562,6 +1563,7 @@ int ldb_msg_check_string_attribute(const struct ldb_message *msg,
    This function performs basic sanity / integrity checks on an
    ldb_message.
 
+   \param ldb context in which to perform the checks
    \param msg the message to check
 
    \return LDB_SUCCESS if the message is OK, or a non-zero error code
diff --git a/source4/lib/ldb/ldb.i b/source4/lib/ldb/ldb.i
index 336100c4f0..da4c52f778 100644
--- a/source4/lib/ldb/ldb.i
+++ b/source4/lib/ldb/ldb.i
@@ -547,6 +547,43 @@ PyObject *PyExc_LdbError;
     talloc_free($1);
 };
 
+%typemap(in,numinputs=1) ldb_msg *add_msg {
+    int dict_pos, msg_pos;
+    PyObject *key, *value;
+    ldb_msg_element *msgel;
+
+    if (PyDict_Check($input)) {
+        $1 = ldb_msg_new(NULL);
+        $1->elements = talloc_zero_array($1, struct ldb_message_element, PyDict_Size($input));
+        msg_pos = dict_pos = 0;
+        while (PyDict_Next($input, &dict_pos, &key, &value)) {
+            if (!strcmp(PyString_AsString(key), "dn")) {
+                /* using argp0 (magic SWIG value) here is a hack */
+                if (ldb_dn_from_pyobject($1, value, argp1, &$1->dn) != 0) {
+                    SWIG_exception(SWIG_TypeError, "unable to import dn object");
+                }
+            } else {
+                msgel = ldb_msg_element_from_pyobject($1->elements, value, 0, PyString_AsString(key));
+                if (msgel == NULL) {
+                    SWIG_exception(SWIG_TypeError, "unable to import element");
+                }
+                memcpy(&$1->elements[msg_pos], msgel, sizeof(*msgel));
+                msg_pos++;
+            }
+        }
+
+        if ($1->dn == NULL) {
+            SWIG_exception(SWIG_TypeError, "no dn set");
+        }
+
+        $1->num_elements = msg_pos;
+    } else {
+        if (SWIG_ConvertPtr($input, (void **)&$1, SWIGTYPE_p_ldb_message, 0) != 0) {
+            SWIG_exception(SWIG_TypeError, "unable to convert ldb message");
+        }
+    }
+}
+
 /* Top-level ldb operations */
 typedef struct ldb_context {
     %extend {
@@ -604,53 +641,6 @@ typedef struct ldb_context {
         struct ldb_control **parse_control_strings(TALLOC_CTX *mem_ctx, 
                                                    const char * const*control_strings);
         ldb_error add(ldb_msg *add_msg);
-        ldb_error add(PyObject *py_msg) 
-        {
-            ldb_error ret;
-            int dict_pos, msg_pos;
-            PyObject *key, *value;
-            ldb_msg_element *msgel;
-            ldb_msg *msg = NULL;
-
-            if (PyDict_Check(py_msg)) {
-                msg = ldb_msg_new(NULL);
-                msg->elements = talloc_zero_array(msg, struct ldb_message_element, PyDict_Size(py_msg));
-                msg_pos = dict_pos = 0;
-                while (PyDict_Next(py_msg, &dict_pos, &key, &value)) {
-                    if (!strcmp(PyString_AsString(key), "dn")) {
-                        if (ldb_dn_from_pyobject(msg, value, $self, &msg->dn) != 0) {
-                            return LDB_ERR_OTHER;
-                        }
-                    } else {
-                        msgel = ldb_msg_element_from_pyobject(msg->elements, value, 0, PyString_AsString(key));
-                        if (msgel == NULL) {
-                            SWIG_exception(SWIG_TypeError, "unable to import element");
-                            return LDB_ERR_OTHER;
-                        }
-                        memcpy(&msg->elements[msg_pos], msgel, sizeof(*msgel));
-                        msg_pos++;
-                    }
-                }
-
-                if (msg->dn == NULL) {
-                    SWIG_exception(SWIG_TypeError, "no dn set");
-                    return LDB_ERR_OTHER;
-                }
-
-                msg->num_elements = msg_pos;
-            } else {
-                if (SWIG_ConvertPtr(py_msg, (void **)&msg, SWIGTYPE_p_ldb_message, 0) != 0)
-                    return LDB_ERR_OTHER;
-            }
-
-            ret = ldb_add($self, msg);
-
-            talloc_free(msg);
-            return ret;
-
-            fail:
-            return LDB_ERR_OTHER;
-        }
         ldb_error modify(ldb_msg *message);
         ldb_dn *get_config_basedn();
         ldb_dn *get_root_basedn();
diff --git a/source4/lib/ldb/ldb_ildap/ldb_ildap.c b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
index 995b584f51..79958a86eb 100644
--- a/source4/lib/ldb/ldb_ildap/ldb_ildap.c
+++ b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
@@ -816,8 +816,8 @@ _PUBLIC_ const struct ldb_backend_ops ldb_ldap_backend_ops = {
 	.connect_fn = ildb_connect
 };
 
-_PUBLIC_ const struct ldb_backend_ops ldb_ildap_backend_ops = {
-	.name = "ildap",
+_PUBLIC_ const struct ldb_backend_ops ldb_ldapi_backend_ops = {
+	.name = "ldapi",
 	.connect_fn = ildb_connect
 };
 
diff --git a/source4/lib/ldb/ldb_wrap.c b/source4/lib/ldb/ldb_wrap.c
index 51022e5930..7886778b3a 100644
--- a/source4/lib/ldb/ldb_wrap.c
+++ b/source4/lib/ldb/ldb_wrap.c
@@ -3113,52 +3113,6 @@ SWIGINTERN ldb_error ldb_search_ex(ldb *self,TALLOC_CTX *mem_ctx,ldb_dn *base,en
             *OUT = res;
             return ret;
         }
-SWIGINTERN ldb_error ldb_add__SWIG_1(ldb *self,PyObject *py_msg){
-            ldb_error ret;
-            int dict_pos, msg_pos;
-            PyObject *key, *value;
-            ldb_msg_element *msgel;
-            ldb_msg *msg = NULL;
-
-            if (PyDict_Check(py_msg)) {
-                msg = ldb_msg_new(NULL);
-                msg->elements = talloc_zero_array(msg, struct ldb_message_element, PyDict_Size(py_msg));
-                msg_pos = dict_pos = 0;
-                while (PyDict_Next(py_msg, &dict_pos, &key, &value)) {
-                    if (!strcmp(PyString_AsString(key), "dn")) {
-                        if (ldb_dn_from_pyobject(msg, value, self, &msg->dn) != 0) {
-                            return 80;
-                        }
-                    } else {
-                        msgel = ldb_msg_element_from_pyobject(msg->elements, value, 0, PyString_AsString(key));
-                        if (msgel == NULL) {
-                            SWIG_exception(SWIG_TypeError, "unable to import element");
-                            return 80;
-                        }
-                        memcpy(&msg->elements[msg_pos], msgel, sizeof(*msgel));
-                        msg_pos++;
-                    }
-                }
-
-                if (msg->dn == NULL) {
-                    SWIG_exception(SWIG_TypeError, "no dn set");
-                    return 80;
-                }
-
-                msg->num_elements = msg_pos;
-            } else {
-                if (SWIG_ConvertPtr(py_msg, (void **)&msg, SWIGTYPE_p_ldb_message, 0) != 0)
-                    return 80;
-            }
-
-            ret = ldb_add(self, msg);
-
-            talloc_free(msg);
-            return ret;
-
-            fail:
-            return 80;
-        }
 SWIGINTERN PyObject *ldb_schema_format_value(ldb *self,char const *element_name,PyObject *val){
         	const struct ldb_schema_attribute *a;
         	struct ldb_val old_val;
@@ -4733,27 +4687,61 @@ fail:
 }
 
 
-SWIGINTERN PyObject *_wrap_Ldb_add__SWIG_0(PyObject *SWIGUNUSEDPARM(self), int nobjs, PyObject **swig_obj) {
+SWIGINTERN PyObject *_wrap_Ldb_add(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   ldb *arg1 = (ldb *) 0 ;
   ldb_msg *arg2 = (ldb_msg *) 0 ;
   ldb_error result;
   void *argp1 = 0 ;
   int res1 = 0 ;
-  void *argp2 = 0 ;
-  int res2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "add_msg", NULL 
+  };
   
-  if ((nobjs < 2) || (nobjs > 2)) SWIG_fail;
-  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:Ldb_add",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
   if (!SWIG_IsOK(res1)) {
     SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_add" "', argument " "1"" of type '" "ldb *""'"); 
   }
   arg1 = (ldb *)(argp1);
-  res2 = SWIG_ConvertPtr(swig_obj[1], &argp2,SWIGTYPE_p_ldb_message, 0 |  0 );
-  if (!SWIG_IsOK(res2)) {
-    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "Ldb_add" "', argument " "2"" of type '" "ldb_msg *""'"); 
+  {
+    int dict_pos, msg_pos;
+    PyObject *key, *value;
+    ldb_msg_element *msgel;
+    
+    if (PyDict_Check(obj1)) {
+      arg2 = ldb_msg_new(NULL);
+      arg2->elements = talloc_zero_array(arg2, struct ldb_message_element, PyDict_Size(obj1));
+      msg_pos = dict_pos = 0;
+      while (PyDict_Next(obj1, &dict_pos, &key, &value)) {
+        if (!strcmp(PyString_AsString(key), "dn")) {
+          /* using argp0 (magic SWIG value) here is a hack */
+          if (ldb_dn_from_pyobject(arg2, value, argp1, &arg2->dn) != 0) {
+            SWIG_exception(SWIG_TypeError, "unable to import dn object");
+          }
+        } else {
+          msgel = ldb_msg_element_from_pyobject(arg2->elements, value, 0, PyString_AsString(key));
+          if (msgel == NULL) {
+            SWIG_exception(SWIG_TypeError, "unable to import element");
+          }
+          memcpy(&arg2->elements[msg_pos], msgel, sizeof(*msgel));
+          msg_pos++;
+        }
+      }
+      
+      if (arg2->dn == NULL) {
+        SWIG_exception(SWIG_TypeError, "no dn set");
+      }
+      
+      arg2->num_elements = msg_pos;
+    } else {
+      if (SWIG_ConvertPtr(obj1, (void **)&arg2, SWIGTYPE_p_ldb_message, 0) != 0) {
+        SWIG_exception(SWIG_TypeError, "unable to convert ldb message");
+      }
+    }
   }
-  arg2 = (ldb_msg *)(argp2);
   if (arg1 == NULL)
   SWIG_exception(SWIG_ValueError, 
     "ldb context must be non-NULL");
@@ -4772,64 +4760,6 @@ fail:
 }
 
 
-SWIGINTERN PyObject *_wrap_Ldb_add__SWIG_1(PyObject *SWIGUNUSEDPARM(self), int nobjs, PyObject **swig_obj) {
-  PyObject *resultobj = 0;
-  ldb *arg1 = (ldb *) 0 ;
-  PyObject *arg2 = (PyObject *) 0 ;
-  ldb_error result;
-  void *argp1 = 0 ;
-  int res1 = 0 ;
-  
-  if ((nobjs < 2) || (nobjs > 2)) SWIG_fail;
-  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
-  if (!SWIG_IsOK(res1)) {
-    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_add" "', argument " "1"" of type '" "ldb *""'"); 
-  }
-  arg1 = (ldb *)(argp1);
-  arg2 = swig_obj[1];
-  if (arg1 == NULL)
-  SWIG_exception(SWIG_ValueError, 
-    "ldb context must be non-NULL");
-  result = ldb_add__SWIG_1(arg1,arg2);
-  if (result != 0) {
-    PyErr_SetObject(PyExc_LdbError, Py_BuildValue((char *)"(i,s)", result, ldb_strerror(result)));
-    SWIG_fail;
-  }
-  resultobj = Py_None;
-  return resultobj;
-fail:
-  return NULL;
-}
-
-
-SWIGINTERN PyObject *_wrap_Ldb_add(PyObject *self, PyObject *args) {
-  int argc;
-  PyObject *argv[3];
-  
-  if (!(argc = SWIG_Python_UnpackTuple(args,"Ldb_add",0,2,argv))) SWIG_fail;
-  --argc;
-  if (argc == 2) {
-    int _v = 0;
-    {
-      void *vptr = 0;
-      int res = SWIG_ConvertPtr(argv[1], &vptr, SWIGTYPE_p_ldb_message, 0);
-      _v = SWIG_CheckState(res);
-    }
-    if (!_v) goto check_1;
-    return _wrap_Ldb_add__SWIG_0(self, argc, argv);
-  }
-check_1:
-  
-  if (argc == 2) {
-    return _wrap_Ldb_add__SWIG_1(self, argc, argv);
-  }
-  
-fail:
-  SWIG_SetErrorMsg(PyExc_NotImplementedError,"Wrong number of arguments for overloaded function 'Ldb_add'.\n  Possible C/C++ prototypes are:\n""    add(ldb *,ldb_msg *)\n""    add(ldb *,PyObject *)\n");
-  return NULL;
-}
-
-
 SWIGINTERN PyObject *_wrap_Ldb_modify(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   ldb *arg1 = (ldb *) 0 ;
@@ -5729,7 +5659,7 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"Ldb_delete", (PyCFunction) _wrap_Ldb_delete, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_rename", (PyCFunction) _wrap_Ldb_rename, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_parse_control_strings", (PyCFunction) _wrap_Ldb_parse_control_strings, METH_VARARGS | METH_KEYWORDS, NULL},
-	 { (char *)"Ldb_add", _wrap_Ldb_add, METH_VARARGS, NULL},
+	 { (char *)"Ldb_add", (PyCFunction) _wrap_Ldb_add, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_modify", (PyCFunction) _wrap_Ldb_modify, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_get_config_basedn", (PyCFunction)_wrap_Ldb_get_config_basedn, METH_O, NULL},
 	 { (char *)"Ldb_get_root_basedn", (PyCFunction)_wrap_Ldb_get_root_basedn, METH_O, NULL},
diff --git a/source4/lib/ldb/modules/rdn_name.c b/source4/lib/ldb/modules/rdn_name.c
index c4de8e8da8..65c044c0f4 100644
--- a/source4/lib/ldb/modules/rdn_name.c
+++ b/source4/lib/ldb/modules/rdn_name.c
@@ -119,7 +119,8 @@ static int rdn_name_add(struct ldb_module *module, struct ldb_request *req)
 				      "RDN mismatch on %s: %s (%s)", 
 				      ldb_dn_get_linearized(msg->dn), rdn_name, rdn_val.data);
 			talloc_free(down_req);
-			return LDB_ERR_OPERATIONS_ERROR;
+			/* Match AD's error here */
+			return LDB_ERR_INVALID_DN_SYNTAX;
 		}
 	}
 
diff --git a/source4/lib/ldb/tools/config.mk b/source4/lib/ldb/tools/config.mk
index bf6c5f963c..02ad84ae25 100644
--- a/source4/lib/ldb/tools/config.mk
+++ b/source4/lib/ldb/tools/config.mk
@@ -17,10 +17,11 @@ OBJ_FILES = \
 		ldbadd.o
 PRIVATE_DEPENDENCIES = \
 		LIBLDB_CMDLINE LIBCLI_RESOLVE
-MANPAGE = ../man/ldbadd.1
 # End BINARY ldbadd
 ################################################
 
+MANPAGES += $(ldbdir)/man/ldbadd.1
+
 ################################################
 # Start BINARY ldbdel
 [BINARY::ldbdel]
@@ -29,10 +30,11 @@ OBJ_FILES= \
 		ldbdel.o
 PRIVATE_DEPENDENCIES = \
 		LIBLDB_CMDLINE
-MANPAGE = ../man/ldbdel.1
 # End BINARY ldbdel
 ################################################
 
+MANPAGES += $(ldbdir)/man/ldbdel.1
+
 ################################################
 # Start BINARY ldbmodify
 [BINARY::ldbmodify]
@@ -41,10 +43,11 @@ OBJ_FILES= \
 		ldbmodify.o
 PRIVATE_DEPENDENCIES = \
 		LIBLDB_CMDLINE
-MANPAGE = ../man/ldbmodify.1
 # End BINARY ldbmodify
 ################################################
 
+MANPAGES += $(ldbdir)/man/ldbmodify.1
+
 ################################################
 # Start BINARY ldbsearch
 [BINARY::ldbsearch]
@@ -53,10 +56,11 @@ OBJ_FILES= \
 		ldbsearch.o
 PRIVATE_DEPENDENCIES = \
 		LIBLDB_CMDLINE 
-MANPAGE = ../man/ldbsearch.1
 # End BINARY ldbsearch
 ################################################
 
+MANPAGES += $(ldbdir)/man/ldbsearch.1
+
 ################################################
 # Start BINARY ldbedit
 [BINARY::ldbedit]
@@ -65,10 +69,11 @@ OBJ_FILES= \
 		ldbedit.o
 PRIVATE_DEPENDENCIES = \
 		LIBLDB_CMDLINE
-MANPAGE = ../man/ldbedit.1
 # End BINARY ldbedit
 ################################################
 
+MANPAGES += $(ldbdir)/man/ldbedit.1
+
 ################################################
 # Start BINARY ldbrename
 [BINARY::ldbrename]
@@ -77,8 +82,9 @@ OBJ_FILES= \
 		ldbrename.o
 PRIVATE_DEPENDENCIES = \
 		LIBLDB_CMDLINE
-MANPAGE = ../man/ldbrename.1
 # End BINARY ldbrename
 ################################################
 
+MANPAGES += $(ldbdir)/man/ldbrename.1
+
 
diff --git a/source4/lib/nss_wrapper/config.mk b/source4/lib/nss_wrapper/config.mk
index b46f7c3ee7..81b0ef36fd 100644
--- a/source4/lib/nss_wrapper/config.mk
+++ b/source4/lib/nss_wrapper/config.mk
@@ -1,7 +1,8 @@
 ##############################
 # Start SUBSYSTEM NSS_WRAPPER
 [SUBSYSTEM::NSS_WRAPPER]
-PUBLIC_HEADERS = nss_wrapper.h
 OBJ_FILES = nss_wrapper.o
 # End SUBSYSTEM NSS_WRAPPER
 ##############################
+
+PUBLIC_HEADERS += lib/nss_wrapper/nss_wrapper.h
diff --git a/source4/lib/registry/config.mk b/source4/lib/registry/config.mk
index 7a9c8fcff1..b2d7ce202e 100644
--- a/source4/lib/registry/config.mk
+++ b/source4/lib/registry/config.mk
@@ -36,10 +36,11 @@ OBJ_FILES = \
 PUBLIC_DEPENDENCIES = \
 		LIBSAMBA-UTIL CHARSET TDR_REGF LIBLDB \
 		RPC_NDR_WINREG LDB_WRAP
-PUBLIC_HEADERS = registry.h hive.h patchfile.h
 # End MODULE registry_ldb
 ################################################
 
+PUBLIC_HEADERS += $(addprefix lib/registry/, registry.h hive.h patchfile.h)
+
 [SUBSYSTEM::registry_common]
 PUBLIC_DEPENDENCIES = registry
 OBJ_FILES = tools/common.o
@@ -52,10 +53,11 @@ INSTALLDIR = BINDIR
 OBJ_FILES = tools/regdiff.o
 PRIVATE_DEPENDENCIES = \
 		LIBSAMBA-CONFIG registry LIBPOPT POPT_SAMBA POPT_CREDENTIALS
-MANPAGE = man/regdiff.1
 # End BINARY regdiff
 ################################################
 
+MANPAGES += lib/registry/man/regdiff.1
+
 ################################################
 # Start BINARY regpatch
 [BINARY::regpatch]
@@ -64,10 +66,11 @@ OBJ_FILES = tools/regpatch.o
 PRIVATE_DEPENDENCIES = \
 		LIBSAMBA-CONFIG registry LIBPOPT POPT_SAMBA POPT_CREDENTIALS \
 		registry_common
-MANPAGE = man/regpatch.1
 # End BINARY regpatch
 ################################################
 
+MANPAGES += lib/registry/man/regpatch.1
+
 ################################################
 # Start BINARY regshell
 [BINARY::regshell]
@@ -76,10 +79,11 @@ OBJ_FILES = tools/regshell.o
 PRIVATE_DEPENDENCIES = \
 		LIBSAMBA-CONFIG LIBPOPT registry POPT_SAMBA POPT_CREDENTIALS \
 		SMBREADLINE registry_common
-MANPAGE = man/regshell.1
 # End BINARY regshell
 ################################################
 
+MANPAGES += lib/registry/man/regshell.1
+
 ################################################
 # Start BINARY regtree
 [BINARY::regtree]
@@ -88,10 +92,11 @@ OBJ_FILES = tools/regtree.o
 PRIVATE_DEPENDENCIES = \
 		LIBSAMBA-CONFIG LIBPOPT registry POPT_SAMBA POPT_CREDENTIALS \
 		registry_common
-MANPAGE = man/regtree.1
 # End BINARY regtree
 ################################################
 
+MANPAGES += lib/registry/man/regtree.1
+
 [SUBSYSTEM::torture_registry]
 PRIVATE_DEPENDENCIES = registry
 PRIVATE_PROTO_HEADER = tests/proto.h
diff --git a/source4/lib/registry/hive.c b/source4/lib/registry/hive.c
index 5d56a30b3e..ad6a6421ab 100644
--- a/source4/lib/registry/hive.c
+++ b/source4/lib/registry/hive.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "hive.h"
 #include "system/filesys.h"
+#include "param/param.h"
 
 /** Open a registry file/host/etc */
 _PUBLIC_ WERROR reg_open_hive(TALLOC_CTX *parent_ctx, const char *location,
@@ -52,7 +53,7 @@ _PUBLIC_ WERROR reg_open_hive(TALLOC_CTX *parent_ctx, const char *location,
 
 	if (!strncmp(peek, "regf", 4)) {
 		close(fd);
-		return reg_open_regf_file(parent_ctx, location, lp_ctx, root);
+		return reg_open_regf_file(parent_ctx, location, lp_iconv_convenience(lp_ctx), root);
 	} else if (!strncmp(peek, "TDB file", 8)) {
 		close(fd);
 		return reg_open_ldb_file(parent_ctx, location, session_info,
diff --git a/source4/lib/registry/hive.h b/source4/lib/registry/hive.h
index 6d9a69c7c5..87f335663d 100644
--- a/source4/lib/registry/hive.h
+++ b/source4/lib/registry/hive.h
@@ -188,7 +188,7 @@ WERROR hive_key_flush(struct hive_key *key);
 WERROR reg_open_directory(TALLOC_CTX *parent_ctx,
 			  const char *location, struct hive_key **key);
 WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx,
-			  const char *location, struct loadparm_context *lp_ctx,
+			  const char *location, struct smb_iconv_convenience *iconv_convenience,
 			  struct hive_key **key);
 WERROR reg_open_ldb_file(TALLOC_CTX *parent_ctx, const char *location,
 			 struct auth_session_info *session_info,
@@ -200,6 +200,7 @@ WERROR reg_open_ldb_file(TALLOC_CTX *parent_ctx, const char *location,
 WERROR reg_create_directory(TALLOC_CTX *parent_ctx,
 			    const char *location, struct hive_key **key);
 WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx,
+			    struct smb_iconv_convenience *iconv_convenience,
 			    const char *location,
 			    int major_version,
 			    struct hive_key **key);
diff --git a/source4/lib/registry/ldb.c b/source4/lib/registry/ldb.c
index 31b78d8246..a764ca6235 100644
--- a/source4/lib/registry/ldb.c
+++ b/source4/lib/registry/ldb.c
@@ -36,7 +36,9 @@ struct ldb_key_data
 	int subkey_count, value_count;
 };
 
-static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx, struct ldb_message *msg,
+static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx, 
+				 struct smb_iconv_convenience *iconv_convenience,
+				 struct ldb_message *msg,
 				 const char **name, uint32_t *type,
 				 DATA_BLOB *data)
 {
@@ -57,7 +59,7 @@ static void reg_ldb_unpack_value(TALLOC_CTX *mem_ctx, struct ldb_message *msg,
 	{
 	case REG_SZ:
 	case REG_EXPAND_SZ:
-		data->length = convert_string_talloc(mem_ctx, lp_iconv_convenience(global_loadparm), CH_UTF8, CH_UTF16,
+		data->length = convert_string_talloc(mem_ctx, iconv_convenience, CH_UTF8, CH_UTF16,
 						     val->data, val->length,
 						     (void **)&data->data);
 		break;
@@ -281,7 +283,7 @@ static WERROR ldb_get_value_by_id(TALLOC_CTX *mem_ctx, struct hive_key *k,
 	if (idx >= kd->value_count)
 		return WERR_NO_MORE_ITEMS;
 
-	reg_ldb_unpack_value(mem_ctx, kd->values[idx],
+	reg_ldb_unpack_value(mem_ctx, lp_iconv_convenience(global_loadparm), kd->values[idx],
 			     name, data_type, data);
 
 	return WERR_OK;
@@ -310,7 +312,7 @@ static WERROR ldb_get_value(TALLOC_CTX *mem_ctx, struct hive_key *k,
 	if (res->count == 0)
 		return WERR_BADFILE;
 
-	reg_ldb_unpack_value(mem_ctx, res->msgs[0], NULL, data_type, data);
+	reg_ldb_unpack_value(mem_ctx, lp_iconv_convenience(global_loadparm), res->msgs[0], NULL, data_type, data);
 
 	return WERR_OK;
 }
@@ -696,7 +698,9 @@ static WERROR ldb_get_key_info(TALLOC_CTX *mem_ctx,
 
 			if (max_valbufsize != NULL) {
 				DATA_BLOB data;
-				reg_ldb_unpack_value(mem_ctx, kd->values[i], NULL, 
+				reg_ldb_unpack_value(mem_ctx, 
+						     lp_iconv_convenience(global_loadparm),
+						     kd->values[i], NULL, 
 						     NULL, &data);
 				*max_valbufsize = MAX(*max_valbufsize, data.length);
 				talloc_free(data.data);
diff --git a/source4/lib/registry/patchfile.c b/source4/lib/registry/patchfile.c
index a4579010cd..687fd4b91b 100644
--- a/source4/lib/registry/patchfile.c
+++ b/source4/lib/registry/patchfile.c
@@ -27,6 +27,7 @@
 
 
 _PUBLIC_ WERROR reg_preg_diff_load(int fd,
+				   struct smb_iconv_convenience *iconv_convenience, 
 				   const struct reg_diff_callbacks *callbacks,
 				   void *callback_data);
 
@@ -273,6 +274,7 @@ _PUBLIC_ WERROR reg_generate_diff(struct registry_context *ctx1,
  * Load diff file
  */
 _PUBLIC_ WERROR reg_diff_load(const char *filename,
+			      struct smb_iconv_convenience *iconv_convenience,
 			      const struct reg_diff_callbacks *callbacks,
 			      void *callback_data)
 {
@@ -305,10 +307,10 @@ _PUBLIC_ WERROR reg_diff_load(const char *filename,
 #endif
 	if (strncmp(hdr, "PReg", 4) == 0) {
 		/* Must be a GPO Registry.pol file */
-		return reg_preg_diff_load(fd, callbacks, callback_data);
+		return reg_preg_diff_load(fd, iconv_convenience, callbacks, callback_data);
 	} else {
 		/* Must be a normal .REG file */
-		return reg_dotreg_diff_load(fd, lp_iconv_convenience(global_loadparm), callbacks, callback_data);
+		return reg_dotreg_diff_load(fd, iconv_convenience, callbacks, callback_data);
 	}
 }
 
@@ -442,5 +444,6 @@ _PUBLIC_ WERROR reg_diff_apply(struct registry_context *ctx, const char *filenam
 	callbacks.del_all_values = reg_diff_apply_del_all_values;
 	callbacks.done = NULL;
 
-	return reg_diff_load(filename, &callbacks, ctx);
+	return reg_diff_load(filename, lp_iconv_convenience(global_loadparm), 
+			     &callbacks, ctx);
 }
diff --git a/source4/lib/registry/patchfile.h b/source4/lib/registry/patchfile.h
index 08a977d9cd..9289390685 100644
--- a/source4/lib/registry/patchfile.h
+++ b/source4/lib/registry/patchfile.h
@@ -43,6 +43,7 @@ WERROR reg_generate_diff(struct registry_context *ctx1,
 			 const struct reg_diff_callbacks *callbacks,
 			 void *callback_data);
 WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
+			    struct smb_iconv_convenience *iconv_convenience,
 			    struct reg_diff_callbacks **callbacks,
 			    void **callback_data);
 WERROR reg_generate_diff_key(struct registry_key *oldkey,
diff --git a/source4/lib/registry/patchfile_dotreg.c b/source4/lib/registry/patchfile_dotreg.c
index 46ea7c0008..6de642ecb8 100644
--- a/source4/lib/registry/patchfile_dotreg.c
+++ b/source4/lib/registry/patchfile_dotreg.c
@@ -101,6 +101,7 @@ static WERROR reg_dotreg_diff_del_all_values(void *callback_data,
  * Save registry diff
  */
 _PUBLIC_ WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
+				     struct smb_iconv_convenience *iconv_convenience,
 				     struct reg_diff_callbacks **callbacks,
 				     void **callback_data)
 {
@@ -109,7 +110,7 @@ _PUBLIC_ WERROR reg_dotreg_diff_save(TALLOC_CTX *ctx, const char *filename,
 	data = talloc_zero(ctx, struct dotreg_data);
 	*callback_data = data;
 
-	data->iconv_convenience = lp_iconv_convenience(global_loadparm);
+	data->iconv_convenience = iconv_convenience;
 
 	if (filename) {
 		data->fd = open(filename, O_CREAT, 0755);
diff --git a/source4/lib/registry/patchfile_preg.c b/source4/lib/registry/patchfile_preg.c
index 9cc9a5dec2..0d39e67450 100644
--- a/source4/lib/registry/patchfile_preg.c
+++ b/source4/lib/registry/patchfile_preg.c
@@ -29,14 +29,14 @@ struct preg_data {
 	int fd;
 };
 
-static WERROR preg_read_utf16(int fd, char *c)
+static WERROR preg_read_utf16(struct smb_iconv_convenience *ic, int fd, char *c)
 {
 	uint16_t v;
 
 	if (read(fd, &v, 2) < 2) {
 		return WERR_GENERAL_FAILURE;
 	}
-	push_codepoint(lp_iconv_convenience(global_loadparm), c, v);
+	push_codepoint(ic, c, v);
 	return WERR_OK;
 }
 
@@ -123,6 +123,7 @@ _PUBLIC_ WERROR reg_preg_diff_save(TALLOC_CTX *ctx, const char *filename,
  * Load diff file
  */
 _PUBLIC_ WERROR reg_preg_diff_load(int fd,
+				   struct smb_iconv_convenience *iconv_convenience, 
 				   const struct reg_diff_callbacks *callbacks,
 				   void *callback_data)
 {
@@ -162,7 +163,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 	while(1) {
 		uint32_t value_type, length;
 
-		if (!W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr))) {
+		if (!W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr))) {
 			break;
 		}
 		if (*buf_ptr != '[') {
@@ -173,7 +174,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 
 		/* Get the path */
 		buf_ptr = buf;
-		while (W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		while (W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		       *buf_ptr != ';' && buf_ptr-buf < buf_size) {
 			buf_ptr++;
 		}
@@ -181,7 +182,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 
 		/* Get the name */
 		buf_ptr = buf;
-		while (W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		while (W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		       *buf_ptr != ';' && buf_ptr-buf < buf_size) {
 			buf_ptr++;
 		}
@@ -195,7 +196,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 		}
 		/* Read past delimiter */
 		buf_ptr = buf;
-		if (!(W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		if (!(W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		    *buf_ptr == ';') && buf_ptr-buf < buf_size) {
 			DEBUG(0, ("Error in PReg file.\n"));
 			ret = WERR_GENERAL_FAILURE;
@@ -209,7 +210,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 		}
 		/* Read past delimiter */
 		buf_ptr = buf;
-		if (!(W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		if (!(W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		    *buf_ptr == ';') && buf_ptr-buf < buf_size) {
 			DEBUG(0, ("Error in PReg file.\n"));
 			ret = WERR_GENERAL_FAILURE;
@@ -227,7 +228,7 @@ _PUBLIC_ WERROR reg_preg_diff_load(int fd,
 
 		/* Check if delimiter is in place (whine if it isn't) */
 		buf_ptr = buf;
-		if (!(W_ERROR_IS_OK(preg_read_utf16(fd, buf_ptr)) &&
+		if (!(W_ERROR_IS_OK(preg_read_utf16(iconv_convenience, fd, buf_ptr)) &&
 		    *buf_ptr == ']') && buf_ptr-buf < buf_size) {
 			DEBUG(0, ("Warning: Missing ']' in PReg file, expected ']', got '%c' 0x%x.\n",
 				*buf_ptr, *buf_ptr));
diff --git a/source4/lib/registry/regf.c b/source4/lib/registry/regf.c
index 6a35799a7e..a192f3be4d 100644
--- a/source4/lib/registry/regf.c
+++ b/source4/lib/registry/regf.c
@@ -1908,7 +1908,9 @@ static WERROR regf_save_hbin(struct regf_data *regf)
 	return WERR_OK;
 }
 
-WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx, const char *location,
+WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx, 
+			    struct smb_iconv_convenience *iconv_convenience,
+			    const char *location,
 			    int minor_version, struct hive_key **key)
 {
 	struct regf_data *regf;
@@ -1919,7 +1921,7 @@ WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx, const char *location,
 
 	regf = (struct regf_data *)talloc_zero(NULL, struct regf_data);
 
-	regf->iconv_convenience = lp_iconv_convenience(global_loadparm);
+	regf->iconv_convenience = iconv_convenience;
 
 	W_ERROR_HAVE_NO_MEMORY(regf);
 
@@ -1995,7 +1997,7 @@ WERROR reg_create_regf_file(TALLOC_CTX *parent_ctx, const char *location,
 }
 
 WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx, const char *location, 
-			  struct loadparm_context *lp_ctx, struct hive_key **key)
+			  struct smb_iconv_convenience *iconv_convenience, struct hive_key **key)
 {
 	struct regf_data *regf;
 	struct regf_hdr *regf_hdr;
@@ -2004,7 +2006,7 @@ WERROR reg_open_regf_file(TALLOC_CTX *parent_ctx, const char *location,
 
 	regf = (struct regf_data *)talloc_zero(NULL, struct regf_data);
 
-	regf->iconv_convenience = lp_iconv_convenience(lp_ctx);
+	regf->iconv_convenience = iconv_convenience;
 
 	W_ERROR_HAVE_NO_MEMORY(regf);
 
diff --git a/source4/lib/registry/tests/hive.c b/source4/lib/registry/tests/hive.c
index 915782694f..1e56f125c5 100644
--- a/source4/lib/registry/tests/hive.c
+++ b/source4/lib/registry/tests/hive.c
@@ -25,6 +25,7 @@
 #include "torture/torture.h"
 #include "librpc/gen_ndr/winreg.h"
 #include "system/filesys.h"
+#include "param/param.h"
 
 static bool test_del_nonexistant_key(struct torture_context *tctx,
 				     const void *test_data)
@@ -386,7 +387,8 @@ static bool hive_setup_regf(struct torture_context *tctx, void **data)
 
 	rmdir(dirname);
 
-	error = reg_create_regf_file(tctx, dirname, 5, &key);
+	error = reg_create_regf_file(tctx, lp_iconv_convenience(tctx->lp_ctx),
+				     dirname, 5, &key);
 	if (!W_ERROR_IS_OK(error)) {
 		fprintf(stderr, "Unable to create new regf file\n");
 		return false;
diff --git a/source4/lib/registry/tools/regdiff.c b/source4/lib/registry/tools/regdiff.c
index 406eaeea3d..c94380efd2 100644
--- a/source4/lib/registry/tools/regdiff.c
+++ b/source4/lib/registry/tools/regdiff.c
@@ -126,7 +126,7 @@ int main(int argc, const char **argv)
 
 	poptFreeContext(pc);
 
-	error = reg_dotreg_diff_save(ctx, outputfile, &callbacks,
+	error = reg_dotreg_diff_save(ctx, outputfile, lp_iconv_convenience(cmdline_lp_ctx), &callbacks,
 				     &callback_data);
 	if (!W_ERROR_IS_OK(error)) {
 		fprintf(stderr, "Problem saving registry diff to '%s': %s\n",
diff --git a/source4/lib/replace/Makefile.in b/source4/lib/replace/Makefile.in
index 30f39ac6cb..c989835a8d 100644
--- a/source4/lib/replace/Makefile.in
+++ b/source4/lib/replace/Makefile.in
@@ -10,6 +10,7 @@ VPATH = @libreplacedir@
 srcdir = @srcdir@
 builddir = @builddir@
 INSTALL = @INSTALL@
+LIBS = @LIBS@
 
 .PHONY: test all showflags install installcheck clean distclean realdistclean
 
@@ -25,6 +26,7 @@ showflags:
 	@echo '  CC     = $(CC)'
 	@echo '  CFLAGS = $(CFLAGS)'
 	@echo '  LDFLAGS= $(LDFLAGS)'
+	@echo '  LIBS   = $(LIBS)'
 
 install: all
 	mkdir -p $(libdir)
@@ -38,10 +40,10 @@ test: all
 
 installcheck: install test
 
-TEST_OBJS = test/testsuite.o test/os2_delete.o test/strptime.o
+TEST_OBJS = test/testsuite.o test/os2_delete.o test/strptime.o test/getifaddrs.o
 
 testsuite: libreplace.a $(TEST_OBJS)
-	$(CC) -o testsuite $(TEST_OBJS) -L. -lreplace $(LDFLAGS)
+	$(CC) -o testsuite $(TEST_OBJS) -L. -lreplace $(LDFLAGS) $(LIBS)
 
 .c.o:
 	@echo Compiling $*.c
diff --git a/source4/lib/replace/configure.ac b/source4/lib/replace/configure.ac
index beeb77e152..f5e054f476 100644
--- a/source4/lib/replace/configure.ac
+++ b/source4/lib/replace/configure.ac
@@ -3,6 +3,8 @@ AC_INIT(replace.c)
 AC_CONFIG_SRCDIR([replace.c])
 AC_CONFIG_HEADER(config.h)
 
+CFLAGS="$CFLAGS -I$srcdir"
+
 AC_LIBREPLACE_ALL_CHECKS
 
 if test "$ac_cv_prog_gcc" = yes; then
diff --git a/source4/lib/replace/getifaddrs.c b/source4/lib/replace/getifaddrs.c
index 053657475d..f6f0ec080c 100644
--- a/source4/lib/replace/getifaddrs.c
+++ b/source4/lib/replace/getifaddrs.c
@@ -44,13 +44,14 @@
 
 void rep_freeifaddrs(struct ifaddrs *ifp)
 {
-	free(ifp->ifa_name);
-	free(ifp->ifa_addr);
-	free(ifp->ifa_netmask);
-	free(ifp->ifa_dstaddr);
-	if (ifp->ifa_next != NULL)
+	if (ifp != NULL) {
+		free(ifp->ifa_name);
+		free(ifp->ifa_addr);
+		free(ifp->ifa_netmask);
+		free(ifp->ifa_dstaddr);
 		freeifaddrs(ifp->ifa_next);
-	free(ifp);
+		free(ifp);
+	}
 }
 
 static struct sockaddr *sockaddr_dup(struct sockaddr *sa)
@@ -109,38 +110,33 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 
 	/* Loop through interfaces, looking for given IP address */
 	for (i=n-1; i>=0; i--) {
-		if (ioctl(fd, SIOCGIFADDR, &ifr[i]) != 0) {
+		if (ioctl(fd, SIOCGIFFLAGS, &ifr[i]) == -1) {
 			freeifaddrs(*ifap);
+			return -1;
 		}
 
 		curif = calloc(1, sizeof(struct ifaddrs));
-		if (lastif == NULL) {
-			*ifap = curif;
-		} else {
-			lastif->ifa_next = curif;
-		}
-
 		curif->ifa_name = strdup(ifr[i].ifr_name);
-		curif->ifa_addr = sockaddr_dup(&ifr[i].ifr_addr);
+		curif->ifa_flags = ifr[i].ifr_flags;
 		curif->ifa_dstaddr = NULL;
 		curif->ifa_data = NULL;
 		curif->ifa_next = NULL;
-		curif->ifa_netmask = NULL;
 
-		if (ioctl(fd, SIOCGIFFLAGS, &ifr[i]) != 0) {
-			freeifaddrs(*ifap);
-			return -1;
-		}  
-
-		curif->ifa_flags = ifr[i].ifr_flags;
-
-		if (ioctl(fd, SIOCGIFNETMASK, &ifr[i]) != 0) {
-			freeifaddrs(*ifap);
-			return -1;
-		}  
+		curif->ifa_addr = NULL;
+		if (ioctl(fd, SIOCGIFADDR, &ifr[i]) != -1) {
+			curif->ifa_addr = sockaddr_dup(&ifr[i].ifr_addr);
+		}
 
-		curif->ifa_netmask = sockaddr_dup(&ifr[i].ifr_addr);
+		curif->ifa_netmask = NULL;
+		if (ioctl(fd, SIOCGIFNETMASK, &ifr[i]) != -1) {
+			curif->ifa_netmask = sockaddr_dup(&ifr[i].ifr_addr);
+		}
 
+		if (lastif == NULL) {
+			*ifap = curif;
+		} else {
+			lastif->ifa_next = curif;
+		}
 		lastif = curif;
 	}
 
@@ -363,32 +359,3 @@ int rep_getifaddrs(struct ifaddrs **ifap)
 	return -1;
 }
 #endif
-
-#ifdef AUTOCONF_TEST
-/* this is the autoconf driver to test getifaddrs() */
-
- int main()
-{
-	struct ifaddrs *ifs = NULL;
-	int ret;
-	
-	ret = getifaddrs(&ifs);
-	if (ret != 0) {
-		perror("getifaddrs() failed");
-		return 1;
-	}
-
-	while (ifs) {
-		printf("%-10s ", ifs->ifa_name);
-		if (ifs->ifa_addr != NULL && 
-		    ifs->ifa_addr->sa_family == AF_INET) {
-			printf("IP=%s ", inet_ntoa(((struct sockaddr_in *)ifs->ifa_addr)->sin_addr));
-			if (ifs->ifa_netmask != NULL)
-				printf("NETMASK=%s", inet_ntoa(((struct sockaddr_in *)ifs->ifa_netmask)->sin_addr));
-		}
-		printf("\n");
-		ifs = ifs->ifa_next;
-	}
-	return 0;
-}
-#endif
diff --git a/source4/lib/replace/getifaddrs.m4 b/source4/lib/replace/getifaddrs.m4
index dd2a95cb81..6cca155de3 100644
--- a/source4/lib/replace/getifaddrs.m4
+++ b/source4/lib/replace/getifaddrs.m4
@@ -49,7 +49,11 @@ AC_TRY_RUN([
 #define AUTOCONF_TEST 1
 #define SOCKET_WRAPPER_NOT_REPLACE
 #include "$libreplacedir/replace.c"
-#include "$libreplacedir/getifaddrs.c"],
+#include "$libreplacedir/inet_ntop.c"
+#include "$libreplacedir/snprintf.c"
+#include "$libreplacedir/getifaddrs.c"
+#define getifaddrs_test main
+#include "$libreplacedir/test/getifaddrs.c"],
            libreplace_cv_HAVE_IFACE_GETIFADDRS=yes,libreplace_cv_HAVE_IFACE_GETIFADDRS=no,libreplace_cv_HAVE_IFACE_GETIFADDRS=cross)])
 if test x"$libreplace_cv_HAVE_IFACE_GETIFADDRS" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_GETIFADDRS,1,[Whether iface getifaddrs is available])
@@ -67,10 +71,15 @@ AC_TRY_RUN([
 #undef _XOPEN_SOURCE_EXTENDED
 #define SOCKET_WRAPPER_NOT_REPLACE
 #include "$libreplacedir/replace.c"
-#include "$libreplacedir/getifaddrs.c"],
+#include "$libreplacedir/inet_ntop.c"
+#include "$libreplacedir/snprintf.c"
+#include "$libreplacedir/getifaddrs.c"
+#define getifaddrs_test main
+#include "$libreplacedir/test/getifaddrs.c"],
            libreplace_cv_HAVE_IFACE_AIX=yes,libreplace_cv_HAVE_IFACE_AIX=no,libreplace_cv_HAVE_IFACE_AIX=cross)])
 if test x"$libreplace_cv_HAVE_IFACE_AIX" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_AIX,1,[Whether iface AIX is available])
+	old_LIBS="$old_LIBS $LIBS"
 fi
 fi
 
@@ -83,10 +92,15 @@ AC_TRY_RUN([
 #define AUTOCONF_TEST 1
 #define SOCKET_WRAPPER_NOT_REPLACE
 #include "$libreplacedir/replace.c"
-#include "$libreplacedir/getifaddrs.c"],
+#include "$libreplacedir/inet_ntop.c"
+#include "$libreplacedir/snprintf.c"
+#include "$libreplacedir/getifaddrs.c"
+#define getifaddrs_test main
+#include "$libreplacedir/test/getifaddrs.c"],
            libreplace_cv_HAVE_IFACE_IFCONF=yes,libreplace_cv_HAVE_IFACE_IFCONF=no,libreplace_cv_HAVE_IFACE_IFCONF=cross)])
 if test x"$libreplace_cv_HAVE_IFACE_IFCONF" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_IFCONF,1,[Whether iface ifconf is available])
+	old_LIBS="$old_LIBS $LIBS"
 fi
 fi
 
@@ -98,10 +112,15 @@ AC_TRY_RUN([
 #define AUTOCONF_TEST 1
 #define SOCKET_WRAPPER_NOT_REPLACE
 #include "$libreplacedir/replace.c"
-#include "$libreplacedir/getifaddrs.c"],
+#include "$libreplacedir/inet_ntop.c"
+#include "$libreplacedir/snprintf.c"
+#include "$libreplacedir/getifaddrs.c"
+#define getifaddrs_test main
+#include "$libreplacedir/test/getifaddrs.c"],
            libreplace_cv_HAVE_IFACE_IFREQ=yes,libreplace_cv_HAVE_IFACE_IFREQ=no,libreplace_cv_HAVE_IFACE_IFREQ=cross)])
 if test x"$libreplace_cv_HAVE_IFACE_IFREQ" = x"yes"; then
     iface=yes;AC_DEFINE(HAVE_IFACE_IFREQ,1,[Whether iface ifreq is available])
+	old_LIBS="$old_LIBS $LIBS"
 fi
 fi
 
diff --git a/source4/lib/replace/test/getifaddrs.c b/source4/lib/replace/test/getifaddrs.c
new file mode 100644
index 0000000000..8b00ac2f40
--- /dev/null
+++ b/source4/lib/replace/test/getifaddrs.c
@@ -0,0 +1,100 @@
+/*
+ * Unix SMB/CIFS implementation.
+ *
+ * libreplace getifaddrs test
+ *
+ * Copyright (C) Michael Adam <obnox@samba.org> 2008
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef AUTOCONF_TEST
+#include "replace.h"
+#include "system/network.h"
+#endif
+
+#ifdef HAVE_INET_NTOP
+#define rep_inet_ntop inet_ntop
+#endif
+
+static const char *format_sockaddr(struct sockaddr *addr,
+				   char *addrstring,
+				   socklen_t addrlen)
+{
+	const char *result = NULL;
+
+	if (addr->sa_family == AF_INET) {
+		result = rep_inet_ntop(AF_INET,
+				       &((struct sockaddr_in *)addr)->sin_addr,
+				       addrstring,
+				       addrlen);
+#ifdef HAVE_STRUCT_SOCKADDR_IN6
+	} else if (addr->sa_family == AF_INET6) {
+		result = rep_inet_ntop(AF_INET6,
+				       &((struct sockaddr_in6 *)addr)->sin6_addr,
+				       addrstring,
+				       addrlen);
+#endif
+	}
+	return result;
+}
+
+int getifaddrs_test(void)
+{
+	struct ifaddrs *ifs = NULL;
+	struct ifaddrs *ifs_head = NULL;
+	int ret;
+
+	ret = getifaddrs(&ifs);
+	ifs_head = ifs;
+	if (ret != 0) {
+		fprintf(stderr, "getifaddrs() failed: %s\n", strerror(errno));
+		return 1;
+	}
+
+	while (ifs) {
+		printf("%-10s ", ifs->ifa_name);
+		if (ifs->ifa_addr != NULL) {
+			char addrstring[INET6_ADDRSTRLEN];
+			const char *result;
+
+			result = format_sockaddr(ifs->ifa_addr,
+						 addrstring,
+						 sizeof(addrstring));
+			if (result != NULL) {
+				printf("IP=%s ", addrstring);
+			}
+
+			if (ifs->ifa_netmask != NULL) {
+				result = format_sockaddr(ifs->ifa_netmask,
+							 addrstring,
+							 sizeof(addrstring));
+				if (result != NULL) {
+					printf("NETMASK=%s", addrstring);
+				}
+			} else {
+				printf("AF=%d ", ifs->ifa_addr->sa_family);
+			}
+		} else {
+			printf("<no address>");
+		}
+
+		printf("\n");
+		ifs = ifs->ifa_next;
+	}
+
+	freeifaddrs(ifs_head);
+
+	return 0;
+}
diff --git a/source4/lib/replace/test/testsuite.c b/source4/lib/replace/test/testsuite.c
index c9f3301005..b538360365 100644
--- a/source4/lib/replace/test/testsuite.c
+++ b/source4/lib/replace/test/testsuite.c
@@ -856,21 +856,18 @@ static int test_strptime(void)
 	return libreplace_test_strptime();
 }
 
+extern int getifaddrs_test(void);
+
 static int test_getifaddrs(void)
 {
-	struct ifaddrs *ifa;
-	int ret;
 
 	printf("test: getifaddrs\n");
 
-	ret = getifaddrs(&ifa);
-	if (ret != 0) {
+	if (getifaddrs_test() != 0) {
 		printf("failure: getifaddrs\n");
 		return false;
 	}
 
-	freeifaddrs(ifa);
-
 	printf("success: getifaddrs\n");
 	return true;
 }
diff --git a/source4/lib/socket_wrapper/config.mk b/source4/lib/socket_wrapper/config.mk
index 4c5cf94348..cc52a99801 100644
--- a/source4/lib/socket_wrapper/config.mk
+++ b/source4/lib/socket_wrapper/config.mk
@@ -1,8 +1,9 @@
 ##############################
 # Start SUBSYSTEM SOCKET_WRAPPER
 [SUBSYSTEM::SOCKET_WRAPPER]
-PUBLIC_HEADERS = socket_wrapper.h
 OBJ_FILES = socket_wrapper.o
 PRIVATE_DEPENDENCIES = EXT_SOCKET
 # End SUBSYSTEM SOCKET_WRAPPER
 ##############################
+
+PUBLIC_HEADERS += lib/socket_wrapper/socket_wrapper.h
diff --git a/source4/lib/talloc/config.mk b/source4/lib/talloc/config.mk
index af1b590c98..33241ffac7 100644
--- a/source4/lib/talloc/config.mk
+++ b/source4/lib/talloc/config.mk
@@ -1,6 +1,8 @@
 [LIBRARY::LIBTALLOC]
 OUTPUT_TYPE = STATIC_LIBRARY
 OBJ_FILES = talloc.o
-MANPAGE = talloc.3
 CFLAGS = -Ilib/talloc
-PUBLIC_HEADERS = talloc.h
+
+
+MANPAGES += $(tallocdir)/talloc.3
+PUBLIC_HEADERS += $(tallocdir)/talloc.h
diff --git a/source4/lib/tdb/config.mk b/source4/lib/tdb/config.mk
index 89d6af9043..c69804fa13 100644
--- a/source4/lib/tdb/config.mk
+++ b/source4/lib/tdb/config.mk
@@ -7,11 +7,12 @@ OBJ_FILES = \
 	common/open.o common/traverse.o common/freelist.o \
 	common/error.o common/transaction.o
 CFLAGS = -Ilib/tdb/include
-PUBLIC_HEADERS = include/tdb.h
 #
 # End SUBSYSTEM ldb
 ################################################
 
+PUBLIC_HEADERS += $(tdbdir)/include/tdb.h
+
 ################################################
 # Start BINARY tdbtool
 [BINARY::tdbtool]
diff --git a/source4/lib/tdr/config.mk b/source4/lib/tdr/config.mk
index b8473e5ba8..eb3cde9bdf 100644
--- a/source4/lib/tdr/config.mk
+++ b/source4/lib/tdr/config.mk
@@ -1,6 +1,7 @@
 [SUBSYSTEM::TDR]
 CFLAGS = -Ilib/tdr
-PUBLIC_HEADERS = tdr.h
-PUBLIC_PROTO_HEADER = tdr_proto.h
+PRIVATE_PROTO_HEADER = tdr_proto.h
 PUBLIC_DEPENDENCIES = LIBTALLOC LIBSAMBA-UTIL
 OBJ_FILES = tdr.o
+
+PUBLIC_HEADERS += lib/tdr/tdr.h
diff --git a/source4/lib/util/config.mk b/source4/lib/util/config.mk
index f3e6cd7acf..16a0357df8 100644
--- a/source4/lib/util/config.mk
+++ b/source4/lib/util/config.mk
@@ -1,15 +1,6 @@
 [SUBSYSTEM::LIBSAMBA-UTIL]
 #VERSION = 0.0.1
 #SO_VERSION = 0
-PUBLIC_HEADERS = util.h \
-				 attr.h \
-				 byteorder.h \
-				 data_blob.h \
-				 debug.h \
-				 mutex.h \
-				 safe_string.h \
-				 time.h \
-				 xfile.h
 OBJ_FILES = xfile.o \
 		debug.o \
 		fault.o \
@@ -33,11 +24,22 @@ PUBLIC_DEPENDENCIES = \
 		SOCKET_WRAPPER EXT_NSL \
 		CHARSET EXECINFO
 
+PUBLIC_HEADERS += $(addprefix lib/util/, util.h \
+				 attr.h \
+				 byteorder.h \
+				 data_blob.h \
+				 debug.h \
+				 mutex.h \
+				 safe_string.h \
+				 time.h \
+				 xfile.h)
+
 [SUBSYSTEM::ASN1_UTIL]
-PUBLIC_PROTO_HEADER = asn1_proto.h
-PUBLIC_HEADERS = asn1.h
+PRIVATE_PROTO_HEADER = asn1_proto.h
 OBJ_FILES = asn1.o
 
+PUBLIC_HEADERS += lib/util/asn1.h
+
 [SUBSYSTEM::UNIX_PRIVS]
 PRIVATE_PROTO_HEADER = unix_privs.h
 OBJ_FILES = unix_privs.o
@@ -45,7 +47,7 @@ OBJ_FILES = unix_privs.o
 ################################################
 # Start SUBSYSTEM WRAP_XATTR
 [SUBSYSTEM::WRAP_XATTR]
-PUBLIC_PROTO_HEADER = wrap_xattr.h
+PRIVATE_PROTO_HEADER = wrap_xattr.h
 OBJ_FILES = \
 		wrap_xattr.o
 PUBLIC_DEPENDENCIES = XATTR
@@ -54,13 +56,13 @@ PUBLIC_DEPENDENCIES = XATTR
 ################################################
 
 [SUBSYSTEM::UTIL_TDB]
-PUBLIC_PROTO_HEADER = util_tdb.h
+PRIVATE_PROTO_HEADER = util_tdb.h
 OBJ_FILES = \
 		util_tdb.o
 PUBLIC_DEPENDENCIES = LIBTDB
 
 [SUBSYSTEM::UTIL_LDB]
-PUBLIC_PROTO_HEADER = util_ldb.h
+PRIVATE_PROTO_HEADER = util_ldb.h
 OBJ_FILES = \
 			util_ldb.o
 PUBLIC_DEPENDENCIES = LIBLDB
diff --git a/source4/libcli/auth/config.mk b/source4/libcli/auth/config.mk
index 6cea0a08f0..61d3fe8c94 100644
--- a/source4/libcli/auth/config.mk
+++ b/source4/libcli/auth/config.mk
@@ -1,7 +1,6 @@
 #################################
 # Start SUBSYSTEM LIBCLI_AUTH
 [SUBSYSTEM::LIBCLI_AUTH]
-PUBLIC_HEADERS = credentials.h
 PRIVATE_PROTO_HEADER = proto.h
 OBJ_FILES = credentials.o \
 		session.o \
@@ -12,3 +11,6 @@ PUBLIC_DEPENDENCIES = \
 		LIBSAMBA-CONFIG
 # End SUBSYSTEM LIBCLI_AUTH
 #################################
+
+
+PUBLIC_HEADERS += libcli/auth/credentials.h
diff --git a/source4/libcli/cldap/cldap.c b/source4/libcli/cldap/cldap.c
index 7c8d40e608..d10eeb8ffd 100644
--- a/source4/libcli/cldap/cldap.c
+++ b/source4/libcli/cldap/cldap.c
@@ -241,7 +241,8 @@ static void cldap_socket_handler(struct event_context *ev, struct fd_event *fde,
   then operations will use that event context
 */
 struct cldap_socket *cldap_socket_init(TALLOC_CTX *mem_ctx, 
-				       struct event_context *event_ctx)
+				       struct event_context *event_ctx,
+				       struct smb_iconv_convenience *iconv_convenience)
 {
 	struct cldap_socket *cldap;
 	NTSTATUS status;
@@ -270,6 +271,7 @@ struct cldap_socket *cldap_socket_init(TALLOC_CTX *mem_ctx,
 
 	cldap->send_queue = NULL;
 	cldap->incoming.handler = NULL;
+	cldap->iconv_convenience = iconv_convenience;
 	
 	return cldap;
 
@@ -618,7 +620,7 @@ NTSTATUS cldap_netlogon_recv(struct cldap_request *req,
 	data = search.out.response->attributes[0].values;
 
 	ndr_err = ndr_pull_union_blob_all(data, mem_ctx, 
-					  lp_iconv_convenience(global_loadparm),
+					  req->cldap->iconv_convenience,
 					  &io->out.netlogon,
 					  io->in.version & 0xF,
 					  (ndr_pull_flags_fn_t)ndr_pull_nbt_cldap_netlogon);
@@ -714,7 +716,7 @@ NTSTATUS cldap_netlogon_reply(struct cldap_socket *cldap,
 	DATA_BLOB blob;
 
 	ndr_err = ndr_push_union_blob(&blob, tmp_ctx, 
-				      lp_iconv_convenience(global_loadparm),
+				      cldap->iconv_convenience,
 				      netlogon, version & 0xF,
 				     (ndr_push_flags_fn_t)ndr_push_nbt_cldap_netlogon);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
diff --git a/source4/libcli/cldap/cldap.h b/source4/libcli/cldap/cldap.h
index 7a222e0652..eb0191d0f4 100644
--- a/source4/libcli/cldap/cldap.h
+++ b/source4/libcli/cldap/cldap.h
@@ -73,6 +73,7 @@ struct cldap_request {
 struct cldap_socket {
 	struct socket_context *sock;
 	struct event_context *event_ctx;
+	struct smb_iconv_convenience *iconv_convenience;
 
 	/* the fd event */
 	struct fd_event *fde;
@@ -111,7 +112,8 @@ struct cldap_search {
 };
 
 struct cldap_socket *cldap_socket_init(TALLOC_CTX *mem_ctx, 
-				       struct event_context *event_ctx);
+				       struct event_context *event_ctx, 
+				       struct smb_iconv_convenience *iconv_convenience);
 NTSTATUS cldap_set_incoming_handler(struct cldap_socket *cldap,
 				    void (*handler)(struct cldap_socket *, struct ldap_message *, 
 						    struct socket_address *),
diff --git a/source4/libcli/config.mk b/source4/libcli/config.mk
index e4b6c71c8c..d3a3beaaa9 100644
--- a/source4/libcli/config.mk
+++ b/source4/libcli/config.mk
@@ -3,11 +3,13 @@ mkinclude ldap/config.mk
 mkinclude security/config.mk
 
 [SUBSYSTEM::LIBSAMBA-ERRORS]
-PUBLIC_HEADERS = util/error.h util/ntstatus.h util/doserr.h util/werror.h
 OBJ_FILES = util/doserr.o \
 		    util/errormap.o \
 		    util/nterr.o \
 
+
+PUBLIC_HEADERS += $(addprefix libcli/, util/error.h util/ntstatus.h util/doserr.h util/werror.h)
+
 [SUBSYSTEM::LIBCLI_LSA]
 PRIVATE_PROTO_HEADER = util/clilsa.h
 OBJ_FILES = util/clilsa.o
@@ -68,10 +70,11 @@ PUBLIC_DEPENDENCIES = LIBCLI_NBT LIBNDR LIBCLI_RESOLVE
 
 [SUBSYSTEM::LIBCLI_CLDAP]
 OBJ_FILES = cldap/cldap.o
-PUBLIC_HEADERS = cldap/cldap.h
 PUBLIC_DEPENDENCIES = LIBCLI_LDAP
 PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBLDB
 
+PUBLIC_HEADERS += libcli/cldap/cldap.h
+
 [SUBSYSTEM::LIBCLI_WREPL]
 PRIVATE_PROTO_HEADER = wrepl/winsrepl_proto.h
 OBJ_FILES = \
@@ -102,8 +105,7 @@ OBJ_FILES = \
 PUBLIC_DEPENDENCIES = LIBCLI_NBT MESSAGING
 
 [SUBSYSTEM::LIBCLI_SMB]
-PUBLIC_HEADERS = libcli.h
-PUBLIC_PROTO_HEADER = libcli_proto.h
+PRIVATE_PROTO_HEADER = libcli_proto.h
 OBJ_FILES = clireadwrite.o \
 		cliconnect.o \
 		clifile.o \
@@ -115,6 +117,9 @@ PUBLIC_DEPENDENCIES = LIBCLI_RAW LIBSAMBA-ERRORS LIBCLI_AUTH \
 	LIBCLI_SMB_COMPOSITE LIBCLI_NBT LIBSECURITY LIBCLI_RESOLVE \
 	LIBCLI_DGRAM LIBCLI_SMB2 LIBCLI_FINDDCS samba-socket
 
+
+PUBLIC_HEADERS += libcli/libcli.h
+
 [SUBSYSTEM::LIBCLI_RAW]
 PRIVATE_PROTO_HEADER = raw/raw_proto.h
 PRIVATE_DEPENDENCIES = LIBCLI_COMPOSITE LP_RESOLVE gensec LIBCLI_RESOLVE LIBSECURITY LIBNDR
diff --git a/source4/libcli/dgram/dgramsocket.c b/source4/libcli/dgram/dgramsocket.c
index 7d6f5627c5..130d8ae870 100644
--- a/source4/libcli/dgram/dgramsocket.c
+++ b/source4/libcli/dgram/dgramsocket.c
@@ -158,7 +158,8 @@ static void dgm_socket_handler(struct event_context *ev, struct fd_event *fde,
   then operations will use that event context
 */
 struct nbt_dgram_socket *nbt_dgram_socket_init(TALLOC_CTX *mem_ctx, 
-					      struct event_context *event_ctx)
+					      struct event_context *event_ctx,
+					      struct smb_iconv_convenience *iconv_convenience)
 {
 	struct nbt_dgram_socket *dgmsock;
 	NTSTATUS status;
@@ -187,7 +188,7 @@ struct nbt_dgram_socket *nbt_dgram_socket_init(TALLOC_CTX *mem_ctx,
 	dgmsock->send_queue = NULL;
 	dgmsock->incoming.handler = NULL;
 	dgmsock->mailslot_handlers = NULL;
-	dgmsock->iconv_convenience = lp_iconv_convenience(global_loadparm);
+	dgmsock->iconv_convenience = iconv_convenience;
 	
 	return dgmsock;
 
diff --git a/source4/libcli/dgram/libdgram.h b/source4/libcli/dgram/libdgram.h
index 4645840971..707cca8cc5 100644
--- a/source4/libcli/dgram/libdgram.h
+++ b/source4/libcli/dgram/libdgram.h
@@ -93,7 +93,8 @@ NTSTATUS dgram_set_incoming_handler(struct nbt_dgram_socket *dgmsock,
 						    struct socket_address *),
 				    void *private);
 struct nbt_dgram_socket *nbt_dgram_socket_init(TALLOC_CTX *mem_ctx, 
-					       struct event_context *event_ctx);
+					       struct event_context *event_ctx,
+					       struct smb_iconv_convenience *);
 
 const char *dgram_mailslot_name(struct nbt_dgram_packet *packet);
 struct dgram_mailslot_handler *dgram_mailslot_find(struct nbt_dgram_socket *dgmsock,
diff --git a/source4/libcli/finddcs.c b/source4/libcli/finddcs.c
index 606809751e..56f931ce19 100644
--- a/source4/libcli/finddcs.c
+++ b/source4/libcli/finddcs.c
@@ -28,6 +28,7 @@
 #include "libcli/libcli.h"
 #include "libcli/resolve/resolve.h"
 #include "libcli/finddcs.h"
+#include "param/param.h"
 
 struct finddcs_state {
 	struct composite_context *ctx;
@@ -40,6 +41,8 @@ struct finddcs_state {
 	struct nbtd_getdcname r;
 	struct nbt_name_status node_status;
 
+	struct smb_iconv_convenience *iconv_convenience;
+
 	int num_dcs;
 	struct nbt_dc_name *dcs;
 	uint16_t nbt_port;
@@ -66,6 +69,7 @@ struct composite_context *finddcs_send(TALLOC_CTX *mem_ctx,
 				       const char *domain_name,
 				       int name_type,
 				       struct dom_sid *domain_sid,
+				       struct smb_iconv_convenience *iconv_convenience,
 				       struct resolve_context *resolve_ctx,
 				       struct event_context *event_ctx,
 				       struct messaging_context *msg_ctx)
@@ -86,6 +90,7 @@ struct composite_context *finddcs_send(TALLOC_CTX *mem_ctx,
 	state->nbt_port = nbt_port;
 	state->my_netbios_name = talloc_strdup(state, my_netbios_name);
 	state->domain_name = talloc_strdup(state, domain_name);
+	state->iconv_convenience = iconv_convenience;
 	if (composite_nomem(state->domain_name, c)) return c;
 
 	if (domain_sid) {
@@ -195,7 +200,8 @@ static void fallback_node_status(struct finddcs_state *state)
 	state->node_status.in.timeout = 1;
 	state->node_status.in.retries = 2;
 
-	nbtsock = nbt_name_socket_init(state, state->ctx->event_ctx);
+	nbtsock = nbt_name_socket_init(state, state->ctx->event_ctx, 
+				       state->iconv_convenience);
 	if (composite_nomem(nbtsock, state->ctx)) return;
 	
 	name_req = nbt_name_status_send(nbtsock, &state->node_status);
@@ -253,6 +259,7 @@ NTSTATUS finddcs(TALLOC_CTX *mem_ctx,
 		 uint16_t nbt_port,
 		 const char *domain_name, int name_type, 
 		 struct dom_sid *domain_sid,
+		 struct smb_iconv_convenience *iconv_convenience,
 		 struct resolve_context *resolve_ctx,
 		 struct event_context *event_ctx,
 		 struct messaging_context *msg_ctx,
@@ -262,7 +269,9 @@ NTSTATUS finddcs(TALLOC_CTX *mem_ctx,
 						   my_netbios_name,
 						   nbt_port,
 						   domain_name, name_type,
-						   domain_sid, resolve_ctx,
+						   domain_sid, 
+						   iconv_convenience,
+						   resolve_ctx,
 						   event_ctx, msg_ctx);
 	return finddcs_recv(c, mem_ctx, num_dcs, dcs);
 }
diff --git a/source4/libcli/ldap/config.mk b/source4/libcli/ldap/config.mk
index 239ee1f161..bcdedd3440 100644
--- a/source4/libcli/ldap/config.mk
+++ b/source4/libcli/ldap/config.mk
@@ -1,6 +1,5 @@
 [SUBSYSTEM::LIBCLI_LDAP]
-PUBLIC_PROTO_HEADER = ldap_proto.h
-PUBLIC_HEADERS = ldap.h
+PRIVATE_PROTO_HEADER = ldap_proto.h
 OBJ_FILES = ldap.o \
 		ldap_client.o \
 		ldap_bind.o \
@@ -11,8 +10,9 @@ PUBLIC_DEPENDENCIES = LIBSAMBA-ERRORS LIBEVENTS LIBPACKET
 PRIVATE_DEPENDENCIES = LIBCLI_COMPOSITE samba-socket NDR_SAMR LIBTLS ASN1_UTIL \
 					   LDAP_ENCODE LIBNDR LP_RESOLVE gensec
 
+PUBLIC_HEADERS += libcli/ldap/ldap.h
 
 [SUBSYSTEM::LDAP_ENCODE]
-PUBLIC_PROTO_HEADER = ldap_ndr.h
+PRIVATE_PROTO_HEADER = ldap_ndr.h
 OBJ_FILES = ldap_ndr.o
 # FIXME PRIVATE_DEPENDENCIES = LIBLDB
diff --git a/source4/libcli/nbt/libnbt.h b/source4/libcli/nbt/libnbt.h
index c95d99db54..bc85d87b89 100644
--- a/source4/libcli/nbt/libnbt.h
+++ b/source4/libcli/nbt/libnbt.h
@@ -94,6 +94,7 @@ struct nbt_name_request {
 struct nbt_name_socket {
 	struct socket_context *sock;
 	struct event_context *event_ctx;
+	struct smb_iconv_convenience *iconv_convenience;
 
 	/* a queue of requests pending to be sent */
 	struct nbt_name_request *send_queue;
diff --git a/source4/libcli/nbt/nbtsocket.c b/source4/libcli/nbt/nbtsocket.c
index 8bfe746294..95a1643efc 100644
--- a/source4/libcli/nbt/nbtsocket.c
+++ b/source4/libcli/nbt/nbtsocket.c
@@ -190,7 +190,7 @@ static void nbt_name_socket_recv(struct nbt_name_socket *nbtsock)
 	}
 
 	/* parse the request */
-	ndr_err = ndr_pull_struct_blob(&blob, packet, lp_iconv_convenience(global_loadparm), packet,
+	ndr_err = ndr_pull_struct_blob(&blob, packet, nbtsock->iconv_convenience, packet,
 				       (ndr_pull_flags_fn_t)ndr_pull_nbt_name_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		status = ndr_map_error2ntstatus(ndr_err);
@@ -309,7 +309,8 @@ static void nbt_name_socket_handler(struct event_context *ev, struct fd_event *f
   then operations will use that event context
 */
 _PUBLIC_ struct nbt_name_socket *nbt_name_socket_init(TALLOC_CTX *mem_ctx, 
-					     struct event_context *event_ctx)
+					     struct event_context *event_ctx,
+					     struct smb_iconv_convenience *iconv_convenience)
 {
 	struct nbt_name_socket *nbtsock;
 	NTSTATUS status;
@@ -338,6 +339,7 @@ _PUBLIC_ struct nbt_name_socket *nbt_name_socket_init(TALLOC_CTX *mem_ctx,
 	nbtsock->num_pending = 0;
 	nbtsock->incoming.handler = NULL;
 	nbtsock->unexpected.handler = NULL;
+	nbtsock->iconv_convenience = iconv_convenience;
 
 	nbtsock->fde = event_add_fd(nbtsock->event_ctx, nbtsock, 
 				    socket_get_fd(nbtsock->sock), 0,
@@ -395,7 +397,7 @@ struct nbt_name_request *nbt_name_request_send(struct nbt_name_socket *nbtsock,
 	talloc_set_destructor(req, nbt_name_request_destructor);	
 
 	ndr_err = ndr_push_struct_blob(&req->encoded, req, 
-				       lp_iconv_convenience(global_loadparm),
+				       req->nbtsock->iconv_convenience,
 				       request,
 				       (ndr_push_flags_fn_t)ndr_push_nbt_name_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) goto failed;
@@ -444,7 +446,7 @@ NTSTATUS nbt_name_reply_send(struct nbt_name_socket *nbtsock,
 	}
 
 	ndr_err = ndr_push_struct_blob(&req->encoded, req, 
-				       lp_iconv_convenience(global_loadparm),
+				       req->nbtsock->iconv_convenience,
 				       request,
 				       (ndr_push_flags_fn_t)ndr_push_nbt_name_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
diff --git a/source4/libcli/raw/clisession.c b/source4/libcli/raw/clisession.c
index 55cb3ef305..5a33d9cffc 100644
--- a/source4/libcli/raw/clisession.c
+++ b/source4/libcli/raw/clisession.c
@@ -22,6 +22,7 @@
 #include "includes.h"
 #include "libcli/raw/libcliraw.h"
 #include "system/filesys.h"
+#include "param/param.h"
 
 #define SETUP_REQUEST_SESSION(cmd, wct, buflen) do { \
 	req = smbcli_request_setup_session(session, cmd, wct, buflen); \
@@ -51,6 +52,9 @@ struct smbcli_session *smbcli_session_init(struct smbcli_transport *transport,
 	}
 	session->pid = (uint16_t)getpid();
 	session->vuid = UID_FIELD_INVALID;
+	session->options.lanman_auth = lp_client_lanman_auth(global_loadparm);
+	session->options.ntlmv2_auth = lp_client_ntlmv2_auth(global_loadparm);
+	session->options.plaintext_auth = lp_client_plaintext_auth(global_loadparm);
 	
 	capabilities = transport->negotiate.capabilities;
 
diff --git a/source4/libcli/raw/clisocket.c b/source4/libcli/raw/clisocket.c
index 8fcb8bb48c..eaa02e1047 100644
--- a/source4/libcli/raw/clisocket.c
+++ b/source4/libcli/raw/clisocket.c
@@ -33,6 +33,7 @@ struct sock_connect_state {
 	const char *host_name;
 	int num_ports;
 	uint16_t *ports;
+	const char *socket_options;
 	struct smbcli_socket *result;
 };
 
@@ -80,6 +81,7 @@ struct composite_context *smbcli_sock_connect_send(TALLOC_CTX *mem_ctx,
 	for (i=0;ports[i];i++) {
 		state->ports[i] = atoi(ports[i]);
 	}
+	state->socket_options = lp_socket_options(global_loadparm);
 
 	ctx = socket_connect_multi_send(state, host_addr,
 					state->num_ports, state->ports,
@@ -108,7 +110,7 @@ static void smbcli_sock_connect_recv_conn(struct composite_context *ctx)
 	if (!composite_is_ok(state->ctx)) return;
 
 	state->ctx->status =
-		socket_set_option(sock, lp_socket_options(global_loadparm), NULL);
+		socket_set_option(sock, state->socket_options, NULL);
 	if (!composite_is_ok(state->ctx)) return;
 
 
diff --git a/source4/libcli/raw/libcliraw.h b/source4/libcli/raw/libcliraw.h
index 7111649fc1..0578a9eab1 100644
--- a/source4/libcli/raw/libcliraw.h
+++ b/source4/libcli/raw/libcliraw.h
@@ -186,6 +186,12 @@ struct smbcli_session {
 
 	/* the spnego context if we use extented security */
 	struct gensec_security *gensec;
+
+	struct smbcli_session_options {
+		uint_t lanman_auth:1;
+		uint_t ntlmv2_auth:1;
+		uint_t plaintext_auth:1;
+	} options;
 };
 
 /* 
diff --git a/source4/libcli/resolve/bcast.c b/source4/libcli/resolve/bcast.c
index c8d4ab2df3..2e2eb05397 100644
--- a/source4/libcli/resolve/bcast.c
+++ b/source4/libcli/resolve/bcast.c
@@ -29,6 +29,7 @@
 struct resolve_bcast_data {
 	struct interface *ifaces;
 	uint16_t nbt_port;
+	int nbt_timeout;
 };
 
 /**
@@ -62,7 +63,7 @@ struct composite_context *resolve_name_bcast_send(TALLOC_CTX *mem_ctx,
 	}
 	address_list[count] = NULL;
 
-	c = resolve_name_nbtlist_send(mem_ctx, event_ctx, name, address_list, data->ifaces, data->nbt_port, true, false);
+	c = resolve_name_nbtlist_send(mem_ctx, event_ctx, name, address_list, data->ifaces, data->nbt_port, data->nbt_timeout, true, false);
 	talloc_free(address_list);
 
 	return c;	
@@ -84,22 +85,25 @@ NTSTATUS resolve_name_bcast(struct nbt_name *name,
 			    TALLOC_CTX *mem_ctx,
 			    struct interface *ifaces,
 			    uint16_t nbt_port,
+			    int nbt_timeout,
 			    const char **reply_addr)
 {
 	struct resolve_bcast_data *data = talloc(mem_ctx, struct resolve_bcast_data);
 	struct composite_context *c;
 	data->ifaces = talloc_reference(data, ifaces);
 	data->nbt_port = nbt_port;
+	data->nbt_timeout = nbt_timeout;
 	
 	c = resolve_name_bcast_send(mem_ctx, NULL, data, name);
 	return resolve_name_bcast_recv(c, mem_ctx, reply_addr);
 }
 
-bool resolve_context_add_bcast_method(struct resolve_context *ctx, struct interface *ifaces, uint16_t nbt_port)
+bool resolve_context_add_bcast_method(struct resolve_context *ctx, struct interface *ifaces, uint16_t nbt_port, int nbt_timeout)
 {
 	struct resolve_bcast_data *data = talloc(ctx, struct resolve_bcast_data);
 	data->ifaces = ifaces;
 	data->nbt_port = nbt_port;
+	data->nbt_timeout = nbt_timeout;
 	return resolve_context_add_method(ctx, resolve_name_bcast_send, resolve_name_bcast_recv, data);
 }
 
@@ -107,5 +111,5 @@ bool resolve_context_add_bcast_method_lp(struct resolve_context *ctx, struct loa
 {
 	struct interface *ifaces;
 	load_interfaces(ctx, lp_interfaces(lp_ctx), &ifaces);
-	return resolve_context_add_bcast_method(ctx, ifaces, lp_nbt_port(lp_ctx));
+	return resolve_context_add_bcast_method(ctx, ifaces, lp_nbt_port(lp_ctx), lp_parm_int(lp_ctx, NULL, "nbt", "timeout", 1));
 }
diff --git a/source4/libcli/resolve/nbtlist.c b/source4/libcli/resolve/nbtlist.c
index e1452c09d2..887bdd7ecf 100644
--- a/source4/libcli/resolve/nbtlist.c
+++ b/source4/libcli/resolve/nbtlist.c
@@ -102,6 +102,7 @@ struct composite_context *resolve_name_nbtlist_send(TALLOC_CTX *mem_ctx,
 						    const char **address_list,
 						    struct interface *ifaces,
 						    uint16_t nbt_port,
+						    int nbt_timeout,
 						    bool broadcast,
 						    bool wins_lookup)
 {
@@ -140,7 +141,8 @@ struct composite_context *resolve_name_nbtlist_send(TALLOC_CTX *mem_ctx,
 		return c;
 	}
 
-	state->nbtsock = nbt_name_socket_init(state, event_ctx);
+	state->nbtsock = nbt_name_socket_init(state, event_ctx, 
+					      lp_iconv_convenience(global_loadparm));
 	if (composite_nomem(state->nbtsock, c)) return c;
 
 	/* count the address_list size */
@@ -161,7 +163,7 @@ struct composite_context *resolve_name_nbtlist_send(TALLOC_CTX *mem_ctx,
 
 		state->io_queries[i].in.broadcast   = broadcast;
 		state->io_queries[i].in.wins_lookup = wins_lookup;
-		state->io_queries[i].in.timeout     = lp_parm_int(global_loadparm, NULL, "nbt", "timeout", 1);
+		state->io_queries[i].in.timeout     = nbt_timeout;
 		state->io_queries[i].in.retries     = 2;
 
 		state->queries[i] = nbt_name_query_send(state->nbtsock, &state->io_queries[i]);
@@ -201,12 +203,14 @@ NTSTATUS resolve_name_nbtlist(struct nbt_name *name,
 			      const char **address_list,
 			      struct interface *ifaces, 
 			      uint16_t nbt_port,
+			      int nbt_timeout,
 			      bool broadcast, bool wins_lookup,
 			      const char **reply_addr)
 {
 	struct composite_context *c = resolve_name_nbtlist_send(mem_ctx, NULL, 
 								name, address_list, 
 								ifaces, nbt_port,
+								nbt_timeout,
 							        broadcast, wins_lookup);
 	return resolve_name_nbtlist_recv(c, mem_ctx, reply_addr);
 }
diff --git a/source4/libcli/resolve/wins.c b/source4/libcli/resolve/wins.c
index 78624ad81a..3ec180f332 100644
--- a/source4/libcli/resolve/wins.c
+++ b/source4/libcli/resolve/wins.c
@@ -29,6 +29,7 @@ struct resolve_wins_data {
 	const char **address_list;
 	struct interface *ifaces;
 	uint16_t nbt_port;
+	int nbt_timeout;
 };
 
 /**
@@ -42,7 +43,7 @@ struct composite_context *resolve_name_wins_send(
 {
 	struct resolve_wins_data *wins_data = talloc_get_type(userdata, struct resolve_wins_data);
 	if (wins_data->address_list == NULL) return NULL;
-	return resolve_name_nbtlist_send(mem_ctx, event_ctx, name, wins_data->address_list, wins_data->ifaces, wins_data->nbt_port, false, true);
+	return resolve_name_nbtlist_send(mem_ctx, event_ctx, name, wins_data->address_list, wins_data->ifaces, wins_data->nbt_port, wins_data->nbt_timeout, false, true);
 }
 
 /*
@@ -62,6 +63,7 @@ NTSTATUS resolve_name_wins(struct nbt_name *name,
 			    const char **address_list,
 			    struct interface *ifaces,
 			    uint16_t nbt_port,
+			    int nbt_timeout,
 			    const char **reply_addr)
 {
 	struct composite_context *c;
@@ -69,16 +71,18 @@ NTSTATUS resolve_name_wins(struct nbt_name *name,
 	wins_data->address_list = address_list;
 	wins_data->ifaces = ifaces;
 	wins_data->nbt_port = nbt_port;
+	wins_data->nbt_timeout = nbt_timeout;
 	c = resolve_name_wins_send(mem_ctx, NULL, wins_data, name);
 	return resolve_name_wins_recv(c, mem_ctx, reply_addr);
 }
 
-bool resolve_context_add_wins_method(struct resolve_context *ctx, const char **address_list, struct interface *ifaces, uint16_t nbt_port)
+bool resolve_context_add_wins_method(struct resolve_context *ctx, const char **address_list, struct interface *ifaces, uint16_t nbt_port, int nbt_timeout)
 {
 	struct resolve_wins_data *wins_data = talloc(ctx, struct resolve_wins_data);
 	wins_data->address_list = str_list_copy(wins_data, address_list);
 	wins_data->ifaces = talloc_reference(wins_data, ifaces);
 	wins_data->nbt_port = nbt_port;
+	wins_data->nbt_timeout = nbt_timeout;
 	return resolve_context_add_method(ctx, resolve_name_wins_send, resolve_name_wins_recv,
 					  wins_data);
 }
@@ -87,5 +91,5 @@ bool resolve_context_add_wins_method_lp(struct resolve_context *ctx, struct load
 {
 	struct interface *ifaces;
 	load_interfaces(ctx, lp_interfaces(lp_ctx), &ifaces);
-	return resolve_context_add_wins_method(ctx, lp_wins_server_list(lp_ctx), ifaces, lp_nbt_port(lp_ctx));
+	return resolve_context_add_wins_method(ctx, lp_wins_server_list(lp_ctx), ifaces, lp_nbt_port(lp_ctx), lp_parm_int(lp_ctx, NULL, "nbt", "timeout", 1));
 }
diff --git a/source4/libcli/smb_composite/fetchfile.c b/source4/libcli/smb_composite/fetchfile.c
index e4312794c9..d8d7481270 100644
--- a/source4/libcli/smb_composite/fetchfile.c
+++ b/source4/libcli/smb_composite/fetchfile.c
@@ -150,7 +150,7 @@ struct composite_context *smb_composite_fetchfile_send(struct smb_composite_fetc
 	state->connect->in.options	= io->in.options;
 
 	state->creq = smb_composite_connect_send(state->connect, state, 
-						 lp_resolve_context(global_loadparm), event_ctx);
+						 io->in.resolve_ctx, event_ctx);
 	if (state->creq == NULL) goto failed;
 
 	state->creq->async.private_data = c;
diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c
index f5a976958d..75a2a579a2 100644
--- a/source4/libcli/smb_composite/sesssetup.c
+++ b/source4/libcli/smb_composite/sesssetup.c
@@ -226,11 +226,11 @@ static NTSTATUS session_setup_nt1(struct composite_context *c,
 	DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, lp_iconv_convenience(global_loadparm), session->transport->socket->hostname, lp_workgroup(global_loadparm));
 	DATA_BLOB session_key;
 	int flags = CLI_CRED_NTLM_AUTH;
-	if (lp_client_lanman_auth(global_loadparm)) {
+	if (session->options.lanman_auth) {
 		flags |= CLI_CRED_LANMAN_AUTH;
 	}
 
-	if (lp_client_ntlmv2_auth(global_loadparm)) {
+	if (session->options.ntlmv2_auth) {
 		flags |= CLI_CRED_NTLMv2_AUTH;
 	}
 
@@ -263,7 +263,7 @@ static NTSTATUS session_setup_nt1(struct composite_context *c,
 		set_user_session_key(session, &session_key);
 		
 		data_blob_free(&session_key);
-	} else if (lp_client_plaintext_auth(global_loadparm)) {
+	} else if (session->options.plaintext_auth) {
 		state->setup.nt1.in.password1 = data_blob_talloc(state, password, strlen(password));
 		state->setup.nt1.in.password2 = data_blob(NULL, 0);
 	} else {
@@ -293,11 +293,11 @@ static NTSTATUS session_setup_old(struct composite_context *c,
 	DATA_BLOB names_blob = NTLMv2_generate_names_blob(state, lp_iconv_convenience(global_loadparm), session->transport->socket->hostname, lp_workgroup(global_loadparm));
 	DATA_BLOB session_key;
 	int flags = 0;
-	if (lp_client_lanman_auth(global_loadparm)) {
+	if (session->options.lanman_auth) {
 		flags |= CLI_CRED_LANMAN_AUTH;
 	}
 
-	if (lp_client_ntlmv2_auth(global_loadparm)) {
+	if (session->options.ntlmv2_auth) {
 		flags |= CLI_CRED_NTLMv2_AUTH;
 	}
 
@@ -324,7 +324,7 @@ static NTSTATUS session_setup_old(struct composite_context *c,
 		set_user_session_key(session, &session_key);
 		
 		data_blob_free(&session_key);
-	} else if (lp_client_plaintext_auth(global_loadparm)) {
+	} else if (session->options.plaintext_auth) {
 		state->setup.old.in.password = data_blob_talloc(state, password, strlen(password));
 	} else {
 		/* could match windows client and return 'cannot logon from this workstation', but it just confuses everybody */
diff --git a/source4/libcli/smb_composite/smb_composite.h b/source4/libcli/smb_composite/smb_composite.h
index 964ffb0936..e7e131869c 100644
--- a/source4/libcli/smb_composite/smb_composite.h
+++ b/source4/libcli/smb_composite/smb_composite.h
@@ -56,6 +56,7 @@ struct smb_composite_fetchfile {
 		const char *workgroup;
 		const char *filename;
 		struct smbcli_options options;
+		struct resolve_context *resolve_ctx;
 	} in;
 	struct {
 		uint8_t *data;
diff --git a/source4/libcli/swig/libcli_nbt.i b/source4/libcli/swig/libcli_nbt.i
index 827230b113..e4e366873f 100644
--- a/source4/libcli/swig/libcli_nbt.i
+++ b/source4/libcli/swig/libcli_nbt.i
@@ -46,7 +46,8 @@
 
 /* Function prototypes */
 struct nbt_name_socket *nbt_name_socket_init(TALLOC_CTX *mem_ctx, 
-					     struct event_context *event_ctx);
+					     struct event_context *event_ctx,
+                         struct smb_iconv_convenience *iconv_convenience);
 
 enum nbt_name_type {
 	NBT_NAME_CLIENT=0x00,
diff --git a/source4/libcli/swig/libcli_nbt_wrap.c b/source4/libcli/swig/libcli_nbt_wrap.c
index 6c1b501359..f67e6dd0e3 100644
--- a/source4/libcli/swig/libcli_nbt_wrap.c
+++ b/source4/libcli/swig/libcli_nbt_wrap.c
@@ -2469,12 +2469,13 @@ SWIG_Python_MustGetPtr(PyObject *obj, swig_type_info *ty, int argnum, int flags)
 #define SWIGTYPE_p_p_char swig_types[10]
 #define SWIGTYPE_p_short swig_types[11]
 #define SWIGTYPE_p_signed_char swig_types[12]
-#define SWIGTYPE_p_unsigned_char swig_types[13]
-#define SWIGTYPE_p_unsigned_int swig_types[14]
-#define SWIGTYPE_p_unsigned_long_long swig_types[15]
-#define SWIGTYPE_p_unsigned_short swig_types[16]
-static swig_type_info *swig_types[18];
-static swig_module_info swig_module = {swig_types, 17, 0, 0, 0, 0};
+#define SWIGTYPE_p_smb_iconv_convenience swig_types[13]
+#define SWIGTYPE_p_unsigned_char swig_types[14]
+#define SWIGTYPE_p_unsigned_int swig_types[15]
+#define SWIGTYPE_p_unsigned_long_long swig_types[16]
+#define SWIGTYPE_p_unsigned_short swig_types[17]
+static swig_type_info *swig_types[19];
+static swig_module_info swig_module = {swig_types, 18, 0, 0, 0, 0};
 #define SWIG_TypeQuery(name) SWIG_TypeQueryModule(&swig_module, &swig_module, name)
 #define SWIG_MangledTypeQuery(name) SWIG_MangledTypeQueryModule(&swig_module, &swig_module, name)
 
@@ -2918,17 +2919,21 @@ SWIGINTERN PyObject *_wrap_nbt_name_socket_init(PyObject *SWIGUNUSEDPARM(self),
   PyObject *resultobj = 0;
   TALLOC_CTX *arg1 = (TALLOC_CTX *) 0 ;
   struct event_context *arg2 = (struct event_context *) 0 ;
+  struct smb_iconv_convenience *arg3 = (struct smb_iconv_convenience *) 0 ;
   struct nbt_name_socket *result = 0 ;
   void *argp2 = 0 ;
   int res2 = 0 ;
+  void *argp3 = 0 ;
+  int res3 = 0 ;
   PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
   char *  kwnames[] = {
-    (char *) "event_ctx", NULL 
+    (char *) "event_ctx",(char *) "iconv_convenience", NULL 
   };
   
   arg2 = event_context_init(NULL);
   arg1 = NULL;
-  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|O:nbt_name_socket_init",kwnames,&obj0)) SWIG_fail;
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|OO:nbt_name_socket_init",kwnames,&obj0,&obj1)) SWIG_fail;
   if (obj0) {
     res2 = SWIG_ConvertPtr(obj0, &argp2,SWIGTYPE_p_event_context, 0 |  0 );
     if (!SWIG_IsOK(res2)) {
@@ -2936,7 +2941,14 @@ SWIGINTERN PyObject *_wrap_nbt_name_socket_init(PyObject *SWIGUNUSEDPARM(self),
     }
     arg2 = (struct event_context *)(argp2);
   }
-  result = (struct nbt_name_socket *)nbt_name_socket_init(arg1,arg2);
+  if (obj1) {
+    res3 = SWIG_ConvertPtr(obj1, &argp3,SWIGTYPE_p_smb_iconv_convenience, 0 |  0 );
+    if (!SWIG_IsOK(res3)) {
+      SWIG_exception_fail(SWIG_ArgError(res3), "in method '" "nbt_name_socket_init" "', argument " "3"" of type '" "struct smb_iconv_convenience *""'"); 
+    }
+    arg3 = (struct smb_iconv_convenience *)(argp3);
+  }
+  result = (struct nbt_name_socket *)nbt_name_socket_init(arg1,arg2,arg3);
   resultobj = SWIG_NewPointerObj(SWIG_as_voidptr(result), SWIGTYPE_p_nbt_name_socket, 0 |  0 );
   return resultobj;
 fail:
@@ -4135,6 +4147,7 @@ static swig_type_info _swigt__p_nbt_name_socket = {"_p_nbt_name_socket", "struct
 static swig_type_info _swigt__p_p_char = {"_p_p_char", "char **", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_short = {"_p_short", "short *|int_least16_t *|int16_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_signed_char = {"_p_signed_char", "signed char *|int_least8_t *|int_fast8_t *|int8_t *", 0, 0, (void*)0, 0};
+static swig_type_info _swigt__p_smb_iconv_convenience = {"_p_smb_iconv_convenience", "struct smb_iconv_convenience *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_unsigned_char = {"_p_unsigned_char", "unsigned char *|uint_least8_t *|uint_fast8_t *|uint8_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_unsigned_int = {"_p_unsigned_int", "uintptr_t *|uint_least32_t *|uint_fast32_t *|uint32_t *|unsigned int *|uint_fast16_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_unsigned_long_long = {"_p_unsigned_long_long", "uint_least64_t *|uint_fast64_t *|uint64_t *|unsigned long long *|uintmax_t *", 0, 0, (void*)0, 0};
@@ -4154,6 +4167,7 @@ static swig_type_info *swig_type_initial[] = {
   &_swigt__p_p_char,
   &_swigt__p_short,
   &_swigt__p_signed_char,
+  &_swigt__p_smb_iconv_convenience,
   &_swigt__p_unsigned_char,
   &_swigt__p_unsigned_int,
   &_swigt__p_unsigned_long_long,
@@ -4173,6 +4187,7 @@ static swig_cast_info _swigc__p_nbt_name_socket[] = {  {&_swigt__p_nbt_name_sock
 static swig_cast_info _swigc__p_p_char[] = {  {&_swigt__p_p_char, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_short[] = {  {&_swigt__p_short, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_signed_char[] = {  {&_swigt__p_signed_char, 0, 0, 0},{0, 0, 0, 0}};
+static swig_cast_info _swigc__p_smb_iconv_convenience[] = {  {&_swigt__p_smb_iconv_convenience, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_unsigned_char[] = {  {&_swigt__p_unsigned_char, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_unsigned_int[] = {  {&_swigt__p_unsigned_int, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_unsigned_long_long[] = {  {&_swigt__p_unsigned_long_long, 0, 0, 0},{0, 0, 0, 0}};
@@ -4192,6 +4207,7 @@ static swig_cast_info *swig_cast_initial[] = {
   _swigc__p_p_char,
   _swigc__p_short,
   _swigc__p_signed_char,
+  _swigc__p_smb_iconv_convenience,
   _swigc__p_unsigned_char,
   _swigc__p_unsigned_int,
   _swigc__p_unsigned_long_long,
diff --git a/source4/libcli/wrepl/winsrepl.c b/source4/libcli/wrepl/winsrepl.c
index d027e88396..3e7793c0c7 100644
--- a/source4/libcli/wrepl/winsrepl.c
+++ b/source4/libcli/wrepl/winsrepl.c
@@ -102,7 +102,7 @@ static NTSTATUS wrepl_finish_recv(void *private, DATA_BLOB packet_blob_in)
 	blob.length = packet_blob_in.length - 4;
 	
 	/* we have a full request - parse it */
-	ndr_err = ndr_pull_struct_blob(&blob, req->packet, lp_iconv_convenience(global_loadparm), req->packet,
+	ndr_err = ndr_pull_struct_blob(&blob, req->packet, wrepl_socket->iconv_convenience, req->packet,
 				       (ndr_pull_flags_fn_t)ndr_pull_wrepl_packet);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
@@ -163,7 +163,8 @@ static int wrepl_socket_destructor(struct wrepl_socket *sock)
   operations will use that event context
 */
 struct wrepl_socket *wrepl_socket_init(TALLOC_CTX *mem_ctx, 
-				       struct event_context *event_ctx)
+				       struct event_context *event_ctx,
+				       struct smb_iconv_convenience *iconv_convenience)
 {
 	struct wrepl_socket *wrepl_socket;
 	NTSTATUS status;
@@ -178,6 +179,8 @@ struct wrepl_socket *wrepl_socket_init(TALLOC_CTX *mem_ctx,
 	}
 	if (!wrepl_socket->event.ctx) goto failed;
 
+	wrepl_socket->iconv_convenience = iconv_convenience;
+
 	status = socket_create("ip", SOCKET_TYPE_STREAM, &wrepl_socket->sock, 0);
 	if (!NT_STATUS_IS_OK(status)) goto failed;
 
@@ -308,6 +311,14 @@ static void wrepl_connect_handler(struct composite_context *creq)
 	composite_done(result);
 }
 
+const char *wrepl_best_ip(struct loadparm_context *lp_ctx, const char *peer_ip)
+{
+	struct interface *ifaces;
+	load_interfaces(lp_ctx, lp_interfaces(lp_ctx), &ifaces);
+	return iface_best_ip(ifaces, peer_ip);
+}
+
+
 /*
   connect a wrepl_socket to a WINS server
 */
@@ -331,12 +342,6 @@ struct composite_context *wrepl_connect_send(struct wrepl_socket *wrepl_socket,
 	state->result		= result;
 	state->wrepl_socket	= wrepl_socket;
 
-	if (!our_ip) {
-		struct interface *ifaces;
-		load_interfaces(state, lp_interfaces(global_loadparm), &ifaces);
-		our_ip = iface_best_ip(ifaces, peer_ip);
-	}
-
 	us = socket_address_from_strings(state, wrepl_socket->sock->backend_name, 
 					 our_ip, 0);
 	if (composite_nomem(us, result)) return result;
@@ -493,7 +498,7 @@ struct wrepl_request *wrepl_request_send(struct wrepl_socket *wrepl_socket,
 	}
 
 	wrap.packet = *packet;
-	ndr_err = ndr_push_struct_blob(&blob, req, lp_iconv_convenience(global_loadparm), &wrap, 
+	ndr_err = ndr_push_struct_blob(&blob, req, wrepl_socket->iconv_convenience, &wrap, 
 				       (ndr_push_flags_fn_t)ndr_push_wrepl_wrap);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		status = ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/libcli/wrepl/winsrepl.h b/source4/libcli/wrepl/winsrepl.h
index 52b0bee69e..f33e63119d 100644
--- a/source4/libcli/wrepl/winsrepl.h
+++ b/source4/libcli/wrepl/winsrepl.h
@@ -49,6 +49,8 @@ struct wrepl_socket {
 
 	/* remember if we need to free the wrepl_socket at the end of wrepl_socket_dead() */
 	bool free_skipped;
+
+	struct smb_iconv_convenience *iconv_convenience;
 };
 
 struct wrepl_send_ctrl {
diff --git a/source4/libnet/config.mk b/source4/libnet/config.mk
index a72ae5b51f..c35b7decc4 100644
--- a/source4/libnet/config.mk
+++ b/source4/libnet/config.mk
@@ -1,9 +1,5 @@
 [SUBSYSTEM::LIBSAMBA-NET]
 PRIVATE_PROTO_HEADER = libnet_proto.h
-PUBLIC_HEADERS = libnet.h libnet_join.h libnet_lookup.h libnet_passwd.h \
-				 libnet_rpc.h libnet_share.h libnet_time.h \
-				 libnet_user.h libnet_site.h libnet_vampire.h \
-				 userinfo.h userman.h
 OBJ_FILES = \
 		libnet.o \
 		libnet_passwd.o \
@@ -29,6 +25,12 @@ OBJ_FILES = \
 		prereq_domain.o
 PUBLIC_DEPENDENCIES = CREDENTIALS dcerpc dcerpc_samr RPC_NDR_LSA RPC_NDR_SRVSVC RPC_NDR_DRSUAPI LIBCLI_COMPOSITE LIBCLI_RESOLVE LIBCLI_FINDDCS LIBCLI_CLDAP LIBCLI_FINDDCS gensec_schannel LIBCLI_AUTH LIBNDR SMBPASSWD
 
+PUBLIC_HEADERS += $(addprefix libnet/, libnet.h libnet_join.h libnet_lookup.h libnet_passwd.h \
+				 libnet_rpc.h libnet_share.h libnet_time.h \
+				 libnet_user.h libnet_site.h libnet_vampire.h \
+				 userinfo.h userman.h)
+
+
 [PYTHON::swig_net]
 PRIVATE_DEPENDENCIES = LIBSAMBA-NET
 SWIG_FILE = net.i
diff --git a/source4/libnet/libnet_become_dc.c b/source4/libnet/libnet_become_dc.c
index c9185c749b..c4f9cabb11 100644
--- a/source4/libnet/libnet_become_dc.c
+++ b/source4/libnet/libnet_become_dc.c
@@ -747,7 +747,8 @@ static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
 	s->cldap.io.in.acct_control	= -1;
 	s->cldap.io.in.version		= 6;
 
-	s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx);
+	s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx, 
+					  lp_iconv_convenience(s->libnet->lp_ctx));
 	if (composite_nomem(s->cldap.sock, c)) return;
 
 	req = cldap_netlogon_send(s->cldap.sock, &s->cldap.io);
diff --git a/source4/libnet/libnet_lookup.c b/source4/libnet/libnet_lookup.c
index 409cc7575b..cab4d9e73f 100644
--- a/source4/libnet/libnet_lookup.c
+++ b/source4/libnet/libnet_lookup.c
@@ -197,7 +197,8 @@ struct composite_context* libnet_LookupDCs_send(struct libnet_context *ctx,
 
 	c = finddcs_send(mem_ctx, lp_netbios_name(ctx->lp_ctx), lp_nbt_port(ctx->lp_ctx),
 			 io->in.domain_name, io->in.name_type,
-			 NULL, ctx->resolve_ctx, ctx->event_ctx, msg_ctx);
+			 NULL, lp_iconv_convenience(ctx->lp_ctx), 
+			 ctx->resolve_ctx, ctx->event_ctx, msg_ctx);
 	return c;
 }
 
diff --git a/source4/libnet/libnet_site.c b/source4/libnet/libnet_site.c
index 9db9494865..dabd23a5be 100644
--- a/source4/libnet/libnet_site.c
+++ b/source4/libnet/libnet_site.c
@@ -55,7 +55,7 @@ NTSTATUS libnet_FindSite(TALLOC_CTX *ctx, struct libnet_JoinSite *r)
 	search.in.acct_control = -1;
 	search.in.version = 6;
 
-	cldap = cldap_socket_init(tmp_ctx, NULL);
+	cldap = cldap_socket_init(tmp_ctx, NULL, lp_iconv_convenience(global_loadparm));
 	status = cldap_netlogon(cldap, tmp_ctx, &search);
 	if (!NT_STATUS_IS_OK(status)) {
 		/*
diff --git a/source4/libnet/libnet_unbecome_dc.c b/source4/libnet/libnet_unbecome_dc.c
index 415912e34d..5d346ac166 100644
--- a/source4/libnet/libnet_unbecome_dc.c
+++ b/source4/libnet/libnet_unbecome_dc.c
@@ -267,7 +267,8 @@ static void unbecomeDC_send_cldap(struct libnet_UnbecomeDC_state *s)
 	s->cldap.io.in.acct_control	= -1;
 	s->cldap.io.in.version		= 6;
 
-	s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx);
+	s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx,
+					  lp_iconv_convenience(s->libnet->lp_ctx));
 	if (composite_nomem(s->cldap.sock, c)) return;
 
 	req = cldap_netlogon_send(s->cldap.sock, &s->cldap.io);
diff --git a/source4/libnet/libnet_user.c b/source4/libnet/libnet_user.c
index d5ccf34a57..678c7a226e 100644
--- a/source4/libnet/libnet_user.c
+++ b/source4/libnet/libnet_user.c
@@ -534,7 +534,7 @@ static NTSTATUS set_user_changes(TALLOC_CTX *mem_ctx, struct usermod_change *mod
 	SET_FIELD_NTTIME(r->in, user, mod, acct_expiry, USERMOD_FIELD_ACCT_EXPIRY);
 
 	/* account flags change */
-	SET_FIELD_UINT32(r->in, user, mod, acct_flags, USERMOD_FIELD_ACCT_FLAGS);
+	SET_FIELD_ACCT_FLAGS(r->in, user, mod, acct_flags, USERMOD_FIELD_ACCT_FLAGS);
 
 	return NT_STATUS_OK;
 }
diff --git a/source4/libnet/libnet_user.h b/source4/libnet/libnet_user.h
index ece06f08fc..94aa38464f 100644
--- a/source4/libnet/libnet_user.h
+++ b/source4/libnet/libnet_user.h
@@ -91,6 +91,14 @@ struct libnet_ModifyUser {
 		mod->fields |= flag; \
 	}
 
+#define SET_FIELD_ACCT_FLAGS(new, current, mod, field, flag) \
+	if (new.field) { \
+		if (current->field != new.field) {	\
+			mod->field = new.field;		\
+			mod->fields |= flag;		\
+		}					\
+	}
+
 
 struct libnet_UserInfo {
 	struct {
diff --git a/source4/librpc/config.mk b/source4/librpc/config.mk
index 2fdef41b2a..7abc693960 100644
--- a/source4/librpc/config.mk
+++ b/source4/librpc/config.mk
@@ -4,8 +4,7 @@
 VERSION = 0.0.1
 SO_VERSION = 0
 PC_FILE = ndr.pc
-PUBLIC_HEADERS = ndr/libndr.h
-PUBLIC_PROTO_HEADER = ndr/libndr_proto.h
+PRIVATE_PROTO_HEADER = ndr/libndr_proto.h
 OBJ_FILES = \
 		ndr/ndr.o \
 		ndr/ndr_basic.o \
@@ -16,6 +15,8 @@ PUBLIC_DEPENDENCIES = LIBSAMBA-ERRORS LIBTALLOC LIBSAMBA-UTIL CHARSET EXT_NSL \
 # End SUBSYSTEM LIBNDR
 ################################################
 
+PUBLIC_HEADERS += librpc/ndr/libndr.h
+
 #################################
 # Start BINARY ndrdump
 [BINARY::ndrdump]
@@ -29,11 +30,12 @@ PRIVATE_DEPENDENCIES = \
 		POPT_SAMBA \
 		NDR_TABLE \
 		LIBSAMBA-ERRORS
-MANPAGE = tools/ndrdump.1
 # FIXME: ndrdump shouldn't have to depend on RPC...
 # End BINARY ndrdump
 #################################
 
+MANPAGES += librpc/tools/ndrdump.1
+
 ################################################
 # Start SUBSYSTEM NDR_COMPRESSION
 [SUBSYSTEM::NDR_COMPRESSION]
@@ -46,9 +48,10 @@ PUBLIC_DEPENDENCIES = LIBCOMPRESSION LIBSAMBA-ERRORS LIBNDR
 
 [SUBSYSTEM::NDR_SECURITY]
 OBJ_FILES = gen_ndr/ndr_security.o ndr/ndr_sec_helper.o 
-PUBLIC_HEADERS = gen_ndr/security.h
 PUBLIC_DEPENDENCIES = NDR_MISC LIBSECURITY
 
+PUBLIC_HEADERS += librpc/gen_ndr/security.h
+
 [SUBSYSTEM::NDR_AUDIOSRV]
 OBJ_FILES = gen_ndr/ndr_audiosrv.o
 PUBLIC_DEPENDENCIES = LIBNDR
@@ -79,18 +82,20 @@ PUBLIC_DEPENDENCIES = LIBNDR NDR_SECURITY
 
 [SUBSYSTEM::NDR_MISC]
 OBJ_FILES = gen_ndr/ndr_misc.o ndr/ndr_misc.o
-PUBLIC_HEADERS = gen_ndr/misc.h gen_ndr/ndr_misc.h
 PUBLIC_DEPENDENCIES = LIBNDR
 
+PUBLIC_HEADERS += librpc/gen_ndr/misc.h librpc/gen_ndr/ndr_misc.h
+
 [SUBSYSTEM::NDR_ROT]
 OBJ_FILES = gen_ndr/ndr_rot.o
 PUBLIC_DEPENDENCIES = LIBNDR NDR_ORPC
 
 [SUBSYSTEM::NDR_LSA]
 OBJ_FILES = gen_ndr/ndr_lsa.o
-PUBLIC_HEADERS = gen_ndr/lsa.h
 PUBLIC_DEPENDENCIES = LIBNDR NDR_SECURITY
 
+PUBLIC_HEADERS += librpc/gen_ndr/lsa.h
+
 [SUBSYSTEM::NDR_DFS]
 OBJ_FILES = gen_ndr/ndr_dfs.o
 PUBLIC_DEPENDENCIES = LIBNDR NDR_MISC
@@ -125,9 +130,10 @@ PUBLIC_DEPENDENCIES = LIBNDR NDR_SECURITY
 
 [SUBSYSTEM::NDR_SAMR]
 OBJ_FILES = gen_ndr/ndr_samr.o
-PUBLIC_HEADERS = gen_ndr/samr.h gen_ndr/ndr_samr.h gen_ndr/ndr_samr_c.h
 PUBLIC_DEPENDENCIES = LIBNDR NDR_MISC NDR_LSA NDR_SECURITY
 
+PUBLIC_HEADERS += $(addprefix librpc/, gen_ndr/samr.h gen_ndr/ndr_samr.h gen_ndr/ndr_samr_c.h)
+
 [SUBSYSTEM::NDR_NFS4ACL]
 OBJ_FILES = gen_ndr/ndr_nfs4acl.o
 PUBLIC_DEPENDENCIES = LIBNDR NDR_MISC NDR_SECURITY
@@ -150,14 +156,16 @@ PUBLIC_DEPENDENCIES = LIBNDR NDR_SVCCTL NDR_SECURITY
 
 [SUBSYSTEM::NDR_SVCCTL]
 OBJ_FILES = gen_ndr/ndr_svcctl.o
-PUBLIC_HEADERS = gen_ndr/ndr_svcctl.h gen_ndr/svcctl.h
 PUBLIC_DEPENDENCIES = LIBNDR NDR_MISC
 
+PUBLIC_HEADERS += $(addprefix librpc/, gen_ndr/ndr_svcctl.h gen_ndr/svcctl.h)
+
 [SUBSYSTEM::NDR_ATSVC]
 OBJ_FILES = gen_ndr/ndr_atsvc.o
-PUBLIC_HEADERS = gen_ndr/atsvc.h gen_ndr/ndr_atsvc.h
 PUBLIC_DEPENDENCIES = LIBNDR
 
+PUBLIC_HEADERS += $(addprefix librpc/, gen_ndr/atsvc.h gen_ndr/ndr_atsvc.h)
+
 [SUBSYSTEM::NDR_EVENTLOG]
 OBJ_FILES = gen_ndr/ndr_eventlog.o
 PUBLIC_DEPENDENCIES = LIBNDR NDR_LSA
@@ -232,9 +240,10 @@ PUBLIC_DEPENDENCIES = LIBNDR
 
 [SUBSYSTEM::NDR_NETLOGON]
 OBJ_FILES = gen_ndr/ndr_netlogon.o
-PUBLIC_HEADERS = gen_ndr/netlogon.h
 PUBLIC_DEPENDENCIES = LIBNDR NDR_SAMR NDR_LSA NDR_SECURITY
 
+PUBLIC_HEADERS += $(addprefix librpc/, gen_ndr/netlogon.h)
+
 [SUBSYSTEM::NDR_TRKWKS]
 OBJ_FILES = gen_ndr/ndr_trkwks.o
 PUBLIC_DEPENDENCIES = LIBNDR
@@ -265,24 +274,32 @@ PUBLIC_DEPENDENCIES = LIBNDR NDR_NBT
 
 [SUBSYSTEM::NDR_NBT]
 OBJ_FILES = gen_ndr/ndr_nbt.o
-PUBLIC_HEADERS = gen_ndr/nbt.h
 PUBLIC_DEPENDENCIES = LIBNDR NDR_MISC NDR_NBT_BUF NDR_SVCCTL NDR_SECURITY
 
+PUBLIC_HEADERS += librpc/gen_ndr/nbt.h
+
 [SUBSYSTEM::NDR_WINSREPL]
 OBJ_FILES = gen_ndr/ndr_winsrepl.o
 PUBLIC_DEPENDENCIES = LIBNDR NDR_NBT
 
 [SUBSYSTEM::NDR_WINBIND]
 OBJ_FILES = gen_ndr/ndr_winbind.o
-PUBLIC_HEADERS = gen_ndr/winbind.h
 PUBLIC_DEPENDENCIES = LIBNDR NDR_NETLOGON
 
-mkinclude ../heimdal_build/perl_path_wrapper.sh ../librpc/idl-deps.pl librpc/idl/*.idl|
+PUBLIC_HEADERS += librpc/gen_ndr/winbind.h
+
+librpc/idl-deps:
+	./librpc/idl-deps.pl librpc/idl/*.idl >$@
+
+clean:: 
+	rm -f librpc/idl-deps
+
+include librpc/idl-deps
 
 librpc/gen_ndr/tables.c: $(IDL_NDR_PARSE_H_FILES)
-	@echo Generating librpc/gen_ndr/tables.c
-	@$(PERL) $(srcdir)/librpc/tables.pl --output=librpc/gen_ndr/tables.c $(IDL_NDR_PARSE_H_FILES) > librpc/gen_ndr/tables.x
-	mv librpc/gen_ndr/tables.x librpc/gen_ndr/tables.c
+	@echo Generating $@
+	@$(PERL) $(srcdir)/librpc/tables.pl --output=$@ $^ > librpc/gen_ndr/tables.x
+	@mv librpc/gen_ndr/tables.x $@
 
 [SUBSYSTEM::NDR_TABLE]
 OBJ_FILES = ndr/ndr_table.o gen_ndr/tables.o
@@ -364,14 +381,16 @@ PUBLIC_DEPENDENCIES = dcerpc NDR_SRVSVC
 
 [SUBSYSTEM::RPC_NDR_SVCCTL]
 OBJ_FILES = gen_ndr/ndr_svcctl_c.o
-PUBLIC_HEADERS = gen_ndr/ndr_svcctl_c.h
 PUBLIC_DEPENDENCIES = dcerpc NDR_SVCCTL
 
+PUBLIC_HEADERS += librpc/gen_ndr/ndr_svcctl_c.h
+
 [SUBSYSTEM::dcerpc_atsvc]
 OBJ_FILES = gen_ndr/ndr_atsvc_c.o
-PUBLIC_HEADERS = gen_ndr/ndr_atsvc_c.h
 PUBLIC_DEPENDENCIES = dcerpc NDR_ATSVC
 
+PUBLIC_HEADERS += librpc/gen_ndr/ndr_atsvc_c.h
+
 [SUBSYSTEM::RPC_NDR_EVENTLOG]
 OBJ_FILES = gen_ndr/ndr_eventlog_c.o
 PUBLIC_DEPENDENCIES = dcerpc NDR_EVENTLOG
@@ -451,7 +470,8 @@ PUBLIC_DEPENDENCIES = dcerpc NDR_KEYSVC
 [SUBSYSTEM::NDR_DCERPC]
 OBJ_FILES = gen_ndr/ndr_dcerpc.o
 PUBLIC_DEPENDENCIES = LIBNDR NDR_MISC
-PUBLIC_HEADERS = gen_ndr/dcerpc.h gen_ndr/ndr_dcerpc.h
+
+PUBLIC_HEADERS += $(addprefix librpc/, gen_ndr/dcerpc.h gen_ndr/ndr_dcerpc.h)
 
 ################################################
 # Start SUBSYSTEM dcerpc
@@ -459,10 +479,7 @@ PUBLIC_HEADERS = gen_ndr/dcerpc.h gen_ndr/ndr_dcerpc.h
 VERSION = 0.0.1
 SO_VERSION = 0
 PC_FILE = dcerpc.pc
-PUBLIC_HEADERS = rpc/dcerpc.h \
-			gen_ndr/mgmt.h gen_ndr/ndr_mgmt.h gen_ndr/ndr_mgmt_c.h \
-			gen_ndr/epmapper.h gen_ndr/ndr_epmapper.h gen_ndr/ndr_epmapper_c.h
-PUBLIC_PROTO_HEADER = rpc/dcerpc_proto.h
+PRIVATE_PROTO_HEADER = rpc/dcerpc_proto.h
 OBJ_FILES = \
 		rpc/dcerpc.o \
 		rpc/dcerpc_auth.o \
@@ -484,6 +501,11 @@ PUBLIC_DEPENDENCIES = CREDENTIALS
 # End SUBSYSTEM dcerpc
 ################################################
 
+PUBLIC_HEADERS += $(addprefix librpc/, rpc/dcerpc.h \
+			gen_ndr/mgmt.h gen_ndr/ndr_mgmt.h gen_ndr/ndr_mgmt_c.h \
+			gen_ndr/epmapper.h gen_ndr/ndr_epmapper.h gen_ndr/ndr_epmapper_c.h)
+
+
 [MODULE::RPC_EJS_ECHO]
 INIT_FUNCTION = ejs_init_rpcecho
 OBJ_FILES = gen_ndr/ndr_echo_ejs.o
diff --git a/source4/librpc/idl/unixinfo.idl b/source4/librpc/idl/unixinfo.idl
index 48bc565fff..6929e86e61 100644
--- a/source4/librpc/idl/unixinfo.idl
+++ b/source4/librpc/idl/unixinfo.idl
@@ -42,8 +42,8 @@ import "security.idl";
 
 	typedef struct {
 		NTSTATUS status;
-		utf8string homedir;
-		utf8string shell;
+		[charset(UTF8),string] uint8 homedir[];
+		[charset(UTF8),string] uint8 shell[];
 	} unixinfo_GetPWUidInfo;
 
 	/******************/
diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index b19a5d7160..a379398f19 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -351,7 +351,7 @@ static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c,
 	/* non-signed packets are simpler */
 	if (!c->security_state.auth_info || 
 	    !c->security_state.generic_state) {
-		return ncacn_push_auth(blob, mem_ctx, pkt, c->security_state.auth_info);
+		return ncacn_push_auth(blob, mem_ctx, c->iconv_convenience, pkt, c->security_state.auth_info);
 	}
 
 	ndr = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
@@ -750,7 +750,7 @@ struct composite_context *dcerpc_bind_send(struct dcerpc_pipe *p,
 	pkt.u.bind.auth_info = data_blob(NULL, 0);
 
 	/* construct the NDR form of the packet */
-	c->status = ncacn_push_auth(&blob, c, &pkt,
+	c->status = ncacn_push_auth(&blob, c, p->conn->iconv_convenience, &pkt,
 				    p->conn->security_state.auth_info);
 	if (!composite_is_ok(c)) return c;
 
@@ -813,7 +813,7 @@ NTSTATUS dcerpc_auth3(struct dcerpc_connection *c,
 	pkt.u.auth3.auth_info = data_blob(NULL, 0);
 
 	/* construct the NDR form of the packet */
-	status = ncacn_push_auth(&blob, mem_ctx, &pkt, c->security_state.auth_info);
+	status = ncacn_push_auth(&blob, mem_ctx, c->iconv_convenience, &pkt, c->security_state.auth_info);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -1646,7 +1646,7 @@ struct composite_context *dcerpc_alter_context_send(struct dcerpc_pipe *p,
 	pkt.u.alter.auth_info = data_blob(NULL, 0);
 
 	/* construct the NDR form of the packet */
-	c->status = ncacn_push_auth(&blob, mem_ctx, &pkt,
+	c->status = ncacn_push_auth(&blob, mem_ctx, p->conn->iconv_convenience, &pkt,
 				    p->conn->security_state.auth_info);
 	if (!composite_is_ok(c)) return c;
 
diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c
index 4e5d049d66..b8128baf43 100644
--- a/source4/librpc/rpc/dcerpc_util.c
+++ b/source4/librpc/rpc/dcerpc_util.c
@@ -50,13 +50,14 @@ const struct ndr_interface_call *dcerpc_iface_find_call(const struct ndr_interfa
    push a ncacn_packet into a blob, potentially with auth info
 */
 NTSTATUS ncacn_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, 
+			 struct smb_iconv_convenience *iconv_convenience,
 			  struct ncacn_packet *pkt,
 			  struct dcerpc_auth *auth_info)
 {
 	struct ndr_push *ndr;
 	enum ndr_err_code ndr_err;
 
-	ndr = ndr_push_init_ctx(mem_ctx, lp_iconv_convenience(global_loadparm));
+	ndr = ndr_push_init_ctx(mem_ctx, iconv_convenience);
 	if (!ndr) {
 		return NT_STATUS_NO_MEMORY;
 	}
diff --git a/source4/nbt_server/dgram/request.c b/source4/nbt_server/dgram/request.c
index 45426c31ba..205a544209 100644
--- a/source4/nbt_server/dgram/request.c
+++ b/source4/nbt_server/dgram/request.c
@@ -73,7 +73,9 @@ NTSTATUS nbtd_dgram_setup(struct nbtd_interface *iface, const char *bind_address
 
 	if (strcmp("0.0.0.0", iface->netmask) != 0) {
 		/* listen for broadcasts on port 138 */
-		bcast_dgmsock = nbt_dgram_socket_init(iface, nbtsrv->task->event_ctx);
+		bcast_dgmsock = nbt_dgram_socket_init(iface, 
+						      nbtsrv->task->event_ctx,
+						      lp_iconv_convenience(nbtsrv->task->lp_ctx));
 		if (!bcast_dgmsock) {
 			talloc_free(tmp_ctx);
 			return NT_STATUS_NO_MEMORY;
@@ -100,7 +102,8 @@ NTSTATUS nbtd_dgram_setup(struct nbtd_interface *iface, const char *bind_address
 	}
 
 	/* listen for unicasts on port 138 */
-	iface->dgmsock = nbt_dgram_socket_init(iface, nbtsrv->task->event_ctx);
+	iface->dgmsock = nbt_dgram_socket_init(iface, nbtsrv->task->event_ctx,
+					       lp_iconv_convenience(nbtsrv->task->lp_ctx));
 	if (!iface->dgmsock) {
 		talloc_free(tmp_ctx);
 		return NT_STATUS_NO_MEMORY;
diff --git a/source4/nbt_server/interfaces.c b/source4/nbt_server/interfaces.c
index 486acfbad5..e59475051b 100644
--- a/source4/nbt_server/interfaces.c
+++ b/source4/nbt_server/interfaces.c
@@ -130,7 +130,7 @@ static NTSTATUS nbtd_add_socket(struct nbtd_server *nbtsrv,
 		struct nbt_name_socket *bcast_nbtsock;
 
 		/* listen for broadcasts on port 137 */
-		bcast_nbtsock = nbt_name_socket_init(iface, nbtsrv->task->event_ctx);
+		bcast_nbtsock = nbt_name_socket_init(iface, nbtsrv->task->event_ctx, lp_iconv_convenience(nbtsrv->task->lp_ctx));
 		if (!bcast_nbtsock) {
 			talloc_free(iface);
 			return NT_STATUS_NO_MEMORY;
@@ -156,7 +156,8 @@ static NTSTATUS nbtd_add_socket(struct nbtd_server *nbtsrv,
 	}
 
 	/* listen for unicasts on port 137 */
-	iface->nbtsock = nbt_name_socket_init(iface, nbtsrv->task->event_ctx);
+	iface->nbtsock = nbt_name_socket_init(iface, nbtsrv->task->event_ctx, 
+					      lp_iconv_convenience(nbtsrv->task->lp_ctx));
 	if (!iface->nbtsock) {
 		talloc_free(iface);
 		return NT_STATUS_NO_MEMORY;
diff --git a/source4/ntvfs/common/notify.c b/source4/ntvfs/common/notify.c
index 94d32488eb..23aa3fb668 100644
--- a/source4/ntvfs/common/notify.c
+++ b/source4/ntvfs/common/notify.c
@@ -45,6 +45,7 @@ struct notify_context {
 	struct notify_array *array;
 	int seqnum;
 	struct sys_notify_context *sys_notify_ctx;
+	struct smb_iconv_convenience *iconv_convenience;
 };
 
 
@@ -107,6 +108,7 @@ struct notify_context *notify_init(TALLOC_CTX *mem_ctx, struct server_id server,
 	notify->messaging_ctx = messaging_ctx;
 	notify->list = NULL;
 	notify->array = NULL;
+	notify->iconv_convenience = lp_iconv_convenience(lp_ctx);
 	notify->seqnum = tdb_get_seqnum(notify->w->tdb);
 
 	talloc_set_destructor(notify, notify_destructor);
@@ -171,7 +173,7 @@ static NTSTATUS notify_load(struct notify_context *notify)
 	blob.data = dbuf.dptr;
 	blob.length = dbuf.dsize;
 
-	ndr_err = ndr_pull_struct_blob(&blob, notify->array, lp_iconv_convenience(global_loadparm),
+	ndr_err = ndr_pull_struct_blob(&blob, notify->array, notify->iconv_convenience,
 				       notify->array,
 				       (ndr_pull_flags_fn_t)ndr_pull_notify_array);
 	free(dbuf.dptr);
@@ -220,7 +222,7 @@ static NTSTATUS notify_save(struct notify_context *notify)
 	tmp_ctx = talloc_new(notify);
 	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
-	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, lp_iconv_convenience(global_loadparm), notify->array,
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, notify->iconv_convenience, notify->array,
 				       (ndr_push_flags_fn_t)ndr_push_notify_array);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
@@ -256,7 +258,7 @@ static void notify_handler(struct messaging_context *msg_ctx, void *private_data
 		return;
 	}
 
-	ndr_err = ndr_pull_struct_blob(data, tmp_ctx, lp_iconv_convenience(global_loadparm), &ev,
+	ndr_err = ndr_pull_struct_blob(data, tmp_ctx, notify->iconv_convenience, &ev,
 				      (ndr_pull_flags_fn_t)ndr_pull_notify_event);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
@@ -555,7 +557,7 @@ static void notify_send(struct notify_context *notify, struct notify_entry *e,
 
 	tmp_ctx = talloc_new(notify);
 
-	ndr_err = ndr_push_struct_blob(&data, tmp_ctx, lp_iconv_convenience(global_loadparm), &ev, (ndr_push_flags_fn_t)ndr_push_notify_event);
+	ndr_err = ndr_push_struct_blob(&data, tmp_ctx, notify->iconv_convenience, &ev, (ndr_push_flags_fn_t)ndr_push_notify_event);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
 		return;
diff --git a/source4/ntvfs/common/opendb.c b/source4/ntvfs/common/opendb.c
index 36144d0406..6c1a9c070a 100644
--- a/source4/ntvfs/common/opendb.c
+++ b/source4/ntvfs/common/opendb.c
@@ -118,9 +118,10 @@ _PUBLIC_ NTSTATUS odb_open_file_pending(struct odb_lock *lck, void *private)
 /*
   remove a opendb entry
 */
-_PUBLIC_ NTSTATUS odb_close_file(struct odb_lock *lck, void *file_handle)
+_PUBLIC_ NTSTATUS odb_close_file(struct odb_lock *lck, void *file_handle,
+				 const char **delete_path)
 {
-	return ops->odb_close_file(lck, file_handle);
+	return ops->odb_close_file(lck, file_handle, delete_path);
 }
 
 
@@ -142,6 +143,14 @@ _PUBLIC_ NTSTATUS odb_rename(struct odb_lock *lck, const char *path)
 }
 
 /*
+  get back the path of an open file
+*/
+_PUBLIC_ NTSTATUS odb_get_path(struct odb_lock *lck, const char **path)
+{
+	return ops->odb_get_path(lck, path);
+}
+
+/*
   update delete on close flag on an open file
 */
 _PUBLIC_ NTSTATUS odb_set_delete_on_close(struct odb_lock *lck, bool del_on_close)
@@ -154,10 +163,9 @@ _PUBLIC_ NTSTATUS odb_set_delete_on_close(struct odb_lock *lck, bool del_on_clos
   people still have the file open
 */
 _PUBLIC_ NTSTATUS odb_get_delete_on_close(struct odb_context *odb, 
-					  DATA_BLOB *key, bool *del_on_close, 
-					  int *open_count, char **path)
+					  DATA_BLOB *key, bool *del_on_close)
 {
-	return ops->odb_get_delete_on_close(odb, key, del_on_close, open_count, path);
+	return ops->odb_get_delete_on_close(odb, key, del_on_close);
 }
 
 
diff --git a/source4/ntvfs/common/opendb.h b/source4/ntvfs/common/opendb.h
index 9591bcf6b9..69a7f718ba 100644
--- a/source4/ntvfs/common/opendb.h
+++ b/source4/ntvfs/common/opendb.h
@@ -32,13 +32,14 @@ struct opendb_ops {
 				  uint32_t open_disposition, bool break_to_none,
 				  uint32_t oplock_level, uint32_t *oplock_granted);
 	NTSTATUS (*odb_open_file_pending)(struct odb_lock *lck, void *private);
-	NTSTATUS (*odb_close_file)(struct odb_lock *lck, void *file_handle);
+	NTSTATUS (*odb_close_file)(struct odb_lock *lck, void *file_handle,
+				   const char **delete_path);
 	NTSTATUS (*odb_remove_pending)(struct odb_lock *lck, void *private);
 	NTSTATUS (*odb_rename)(struct odb_lock *lck, const char *path);
+	NTSTATUS (*odb_get_path)(struct odb_lock *lck, const char **path);
 	NTSTATUS (*odb_set_delete_on_close)(struct odb_lock *lck, bool del_on_close);
 	NTSTATUS (*odb_get_delete_on_close)(struct odb_context *odb, 
-					    DATA_BLOB *key, bool *del_on_close, 
-					    int *open_count, char **path);
+					    DATA_BLOB *key, bool *del_on_close);
 	NTSTATUS (*odb_can_open)(struct odb_lock *lck,
 				 uint32_t stream_id, uint32_t share_access,
 				 uint32_t access_mask, bool delete_on_close,
diff --git a/source4/ntvfs/common/opendb_tdb.c b/source4/ntvfs/common/opendb_tdb.c
index fe5a0a8864..47b35f594c 100644
--- a/source4/ntvfs/common/opendb_tdb.c
+++ b/source4/ntvfs/common/opendb_tdb.c
@@ -376,8 +376,26 @@ static NTSTATUS odb_tdb_open_can_internal(struct odb_context *odb,
 	   exclusive oplocks afterwards. */
 	for (i=0;i<file->num_entries;i++) {
 		if (file->entries[i].oplock_level == OPLOCK_EXCLUSIVE) {
+			bool oplock_return = OPLOCK_BREAK_TO_LEVEL_II;
+			/* if this is an attribute only access
+			 * it doesn't conflict with an EXCLUSIVE oplock
+			 * but we'll not grant the oplock below
+			 */
+			attrs_only = access_attributes_only(access_mask,
+							    open_disposition,
+							    break_to_none);
+			if (attrs_only) {
+				break;
+			}
+			/*
+			 * send an oplock break to the holder of the
+			 * oplock and tell caller to retry later
+			 */
+			if (break_to_none) {
+				oplock_return = OPLOCK_BREAK_TO_NONE;
+			}
 			odb_oplock_break_send(odb, &file->entries[i],
-					      OPLOCK_BREAK_TO_NONE);
+					      oplock_return);
 			return NT_STATUS_OPLOCK_NOT_GRANTED;
 		}
 	}
@@ -449,8 +467,8 @@ static NTSTATUS odb_tdb_open_file(struct odb_lock *lck,
 				e.oplock_level	= OPLOCK_EXCLUSIVE;
 				*oplock_granted	= EXCLUSIVE_OPLOCK_RETURN;
 			} else {
-				e.oplock_level	= OPLOCK_NONE;
-				*oplock_granted	= NO_OPLOCK_RETURN;
+				e.oplock_level	= OPLOCK_LEVEL_II;
+				*oplock_granted	= LEVEL_II_OPLOCK_RETURN;
 			}
 		} else if (oplock_level == OPLOCK_BATCH) {
 			if (file.num_entries == 0) {
@@ -509,10 +527,12 @@ static NTSTATUS odb_tdb_open_file_pending(struct odb_lock *lck, void *private)
 /*
   remove a opendb entry
 */
-static NTSTATUS odb_tdb_close_file(struct odb_lock *lck, void *file_handle)
+static NTSTATUS odb_tdb_close_file(struct odb_lock *lck, void *file_handle,
+				   const char **_delete_path)
 {
 	struct odb_context *odb = lck->odb;
 	struct opendb_file file;
+	const char *delete_path = NULL;
 	int i;
 	NTSTATUS status;
 
@@ -548,7 +568,16 @@ static NTSTATUS odb_tdb_close_file(struct odb_lock *lck, void *file_handle)
 	file.num_pending = 0;
 
 	file.num_entries--;
-	
+
+	if (file.num_entries == 0 && file.delete_on_close) {
+		delete_path = talloc_strdup(lck, file.path);
+		NT_STATUS_HAVE_NO_MEMORY(delete_path);
+	}
+
+	if (_delete_path) {
+		*_delete_path = delete_path;
+	}
+
 	return odb_push_record(lck, &file);
 }
 
@@ -685,6 +714,25 @@ static NTSTATUS odb_tdb_rename(struct odb_lock *lck, const char *path)
 }
 
 /*
+  get the path of an open file
+*/
+static NTSTATUS odb_tdb_get_path(struct odb_lock *lck, const char **path)
+{
+	struct opendb_file file;
+	NTSTATUS status;
+
+	*path = NULL;
+
+	status = odb_pull_record(lck, &file);
+	/* we don't ignore NT_STATUS_OBJECT_NAME_NOT_FOUND here */
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	*path = file.path;
+
+	return NT_STATUS_OK;
+}
+
+/*
   update delete on close flag on an open file
 */
 static NTSTATUS odb_tdb_set_delete_on_close(struct odb_lock *lck, bool del_on_close)
@@ -705,20 +753,20 @@ static NTSTATUS odb_tdb_set_delete_on_close(struct odb_lock *lck, bool del_on_cl
   people still have the file open
 */
 static NTSTATUS odb_tdb_get_delete_on_close(struct odb_context *odb, 
-					    DATA_BLOB *key, bool *del_on_close, 
-					    int *open_count, char **path)
+					    DATA_BLOB *key, bool *del_on_close)
 {
 	NTSTATUS status;
 	struct opendb_file file;
 	struct odb_lock *lck;
 
+	(*del_on_close) = false;
+
 	lck = odb_lock(odb, odb, key);
 	NT_STATUS_HAVE_NO_MEMORY(lck);
 
 	status = odb_pull_record(lck, &file);
 	if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_NOT_FOUND, status)) {
 		talloc_free(lck);
-		(*del_on_close) = false;
 		return NT_STATUS_OK;
 	}
 	if (!NT_STATUS_IS_OK(status)) {
@@ -727,16 +775,6 @@ static NTSTATUS odb_tdb_get_delete_on_close(struct odb_context *odb,
 	}
 
 	(*del_on_close) = file.delete_on_close;
-	if (open_count != NULL) {
-		(*open_count) = file.num_entries;
-	}
-	if (path != NULL) {
-		*path = talloc_strdup(odb, file.path);
-		NT_STATUS_HAVE_NO_MEMORY(*path);
-		if (file.num_entries == 1 && file.entries[0].delete_on_close) {
-			(*del_on_close) = true;
-		}
-	}
 
 	talloc_free(lck);
 
@@ -783,6 +821,7 @@ static const struct opendb_ops opendb_tdb_ops = {
 	.odb_close_file          = odb_tdb_close_file,
 	.odb_remove_pending      = odb_tdb_remove_pending,
 	.odb_rename              = odb_tdb_rename,
+	.odb_get_path            = odb_tdb_get_path,
 	.odb_set_delete_on_close = odb_tdb_set_delete_on_close,
 	.odb_get_delete_on_close = odb_tdb_get_delete_on_close,
 	.odb_can_open            = odb_tdb_can_open,
diff --git a/source4/ntvfs/config.mk b/source4/ntvfs/config.mk
index dbc1a4c277..0f8e88eaa6 100644
--- a/source4/ntvfs/config.mk
+++ b/source4/ntvfs/config.mk
@@ -80,13 +80,14 @@ OBJ_FILES = \
 ################################################
 # Start SUBSYSTEM NTVFS
 [SUBSYSTEM::ntvfs]
-PUBLIC_HEADERS = ntvfs.h
 PRIVATE_PROTO_HEADER = ntvfs_proto.h
 OBJ_FILES = \
 		ntvfs_base.o \
 		ntvfs_generic.o \
 		ntvfs_interface.o \
 		ntvfs_util.o
+
+PUBLIC_HEADERS += ntvfs/ntvfs.h
 #
 # End SUBSYSTEM NTVFS
 ################################################
diff --git a/source4/ntvfs/posix/pvfs_open.c b/source4/ntvfs/posix/pvfs_open.c
index a01352f60c..adf4c1ac18 100644
--- a/source4/ntvfs/posix/pvfs_open.c
+++ b/source4/ntvfs/posix/pvfs_open.c
@@ -50,29 +50,10 @@ struct pvfs_file *pvfs_find_fd(struct pvfs_state *pvfs,
 */
 static int pvfs_dir_handle_destructor(struct pvfs_file_handle *h)
 {
-	int open_count;
-	char *path = NULL;
-
-	if (h->name->stream_name == NULL && 
-	    pvfs_delete_on_close_set(h->pvfs, h, &open_count, &path) &&
-	    open_count == 1) {
-		NTSTATUS status;
-		status = pvfs_xattr_unlink_hook(h->pvfs, path);
-		if (!NT_STATUS_IS_OK(status)) {
-			DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
-				 path, nt_errstr(status)));
-		}
-		if (rmdir(path) != 0) {
-			DEBUG(0,("pvfs_dir_handle_destructor: failed to rmdir '%s' - %s\n", 
-				 path, strerror(errno)));
-		}
-	}
-
-	talloc_free(path);
-
 	if (h->have_opendb_entry) {
 		struct odb_lock *lck;
 		NTSTATUS status;
+		const char *delete_path = NULL;
 
 		lck = odb_lock(h, h->pvfs->odb_context, &h->odb_locking_key);
 		if (lck == NULL) {
@@ -80,12 +61,24 @@ static int pvfs_dir_handle_destructor(struct pvfs_file_handle *h)
 			return 0;
 		}
 
-		status = odb_close_file(lck, h);
+		status = odb_close_file(lck, h, &delete_path);
 		if (!NT_STATUS_IS_OK(status)) {
-			DEBUG(0,("Unable to remove opendb entry for '%s' - %s\n", 
+			DEBUG(0,("Unable to remove opendb entry for '%s' - %s\n",
 				 h->name->full_name, nt_errstr(status)));
 		}
 
+		if (h->name->stream_name == NULL && delete_path) {
+			status = pvfs_xattr_unlink_hook(h->pvfs, delete_path);
+			if (!NT_STATUS_IS_OK(status)) {
+				DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
+					 delete_path, nt_errstr(status)));
+			}
+			if (rmdir(delete_path) != 0) {
+				DEBUG(0,("pvfs_dir_handle_destructor: failed to rmdir '%s' - %s\n",
+					 delete_path, strerror(errno)));
+			}
+		}
+
 		talloc_free(lck);
 	}
 
@@ -151,8 +144,8 @@ static NTSTATUS pvfs_open_setup_eas_acl(struct pvfs_state *pvfs,
   form the lock context used for opendb locking. Note that we must
   zero here to take account of possible padding on some architectures
 */
-static NTSTATUS pvfs_locking_key(struct pvfs_filename *name, 
-				 TALLOC_CTX *mem_ctx, DATA_BLOB *key)
+NTSTATUS pvfs_locking_key(struct pvfs_filename *name,
+			  TALLOC_CTX *mem_ctx, DATA_BLOB *key)
 {
 	struct {
 		dev_t device;
@@ -410,9 +403,6 @@ cleanup_delete:
 */
 static int pvfs_handle_destructor(struct pvfs_file_handle *h)
 {
-	int open_count;
-	char *path = NULL;
-
 	/* the write time is no longer sticky */
 	if (h->sticky_write_time) {
 		NTSTATUS status;
@@ -441,32 +431,10 @@ static int pvfs_handle_destructor(struct pvfs_file_handle *h)
 		h->fd = -1;
 	}
 
-	if (h->name->stream_name == NULL && 
-	    h->open_completed &&
-	    pvfs_delete_on_close_set(h->pvfs, h, &open_count, &path) &&
-	    open_count == 1) {
-		NTSTATUS status;
-		status = pvfs_xattr_unlink_hook(h->pvfs, path);
-		if (!NT_STATUS_IS_OK(status)) {
-			DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
-				 path, nt_errstr(status)));
-		}
-		if (unlink(path) != 0) {
-			DEBUG(0,("pvfs_close: failed to delete '%s' - %s\n", 
-				 path, strerror(errno)));
-		} else {
-			notify_trigger(h->pvfs->notify_context, 
-				       NOTIFY_ACTION_REMOVED, 
-				       FILE_NOTIFY_CHANGE_FILE_NAME,
-				       path);
-		}
-	}
-
-	talloc_free(path);
-
 	if (h->have_opendb_entry) {
 		struct odb_lock *lck;
 		NTSTATUS status;
+		const char *delete_path = NULL;
 
 		lck = odb_lock(h, h->pvfs->odb_context, &h->odb_locking_key);
 		if (lck == NULL) {
@@ -474,12 +442,30 @@ static int pvfs_handle_destructor(struct pvfs_file_handle *h)
 			return 0;
 		}
 
-		status = odb_close_file(lck, h);
+		status = odb_close_file(lck, h, &delete_path);
 		if (!NT_STATUS_IS_OK(status)) {
 			DEBUG(0,("Unable to remove opendb entry for '%s' - %s\n", 
 				 h->name->full_name, nt_errstr(status)));
 		}
 
+		if (h->name->stream_name == NULL &&
+		    h->open_completed && delete_path) {
+			status = pvfs_xattr_unlink_hook(h->pvfs, delete_path);
+			if (!NT_STATUS_IS_OK(status)) {
+				DEBUG(0,("Warning: xattr unlink hook failed for '%s' - %s\n",
+					 delete_path, nt_errstr(status)));
+			}
+			if (unlink(delete_path) != 0) {
+				DEBUG(0,("pvfs_close: failed to delete '%s' - %s\n",
+					 delete_path, strerror(errno)));
+			} else {
+				notify_trigger(h->pvfs->notify_context,
+					       NOTIFY_ACTION_REMOVED,
+					       FILE_NOTIFY_CHANGE_FILE_NAME,
+					       delete_path);
+			}
+		}
+
 		talloc_free(lck);
 	}
 
@@ -574,7 +560,7 @@ static NTSTATUS pvfs_create_file(struct pvfs_state *pvfs,
 		status = pvfs_locking_key(parent, req, &locking_key);
 		NT_STATUS_NOT_OK_RETURN(status);
 		status = odb_get_delete_on_close(pvfs->odb_context, &locking_key, 
-						 &del_on_close, NULL, NULL);
+						 &del_on_close);
 		NT_STATUS_NOT_OK_RETURN(status);
 		if (del_on_close) {
 			return NT_STATUS_DELETE_PENDING;
@@ -1738,14 +1724,13 @@ NTSTATUS pvfs_can_stat(struct pvfs_state *pvfs,
 /*
   determine if delete on close is set on 
 */
-bool pvfs_delete_on_close_set(struct pvfs_state *pvfs, struct pvfs_file_handle *h, 
-			      int *open_count, char **path)
+bool pvfs_delete_on_close_set(struct pvfs_state *pvfs, struct pvfs_file_handle *h)
 {
 	NTSTATUS status;
 	bool del_on_close;
 
 	status = odb_get_delete_on_close(pvfs->odb_context, &h->odb_locking_key, 
-					 &del_on_close, open_count, path);
+					 &del_on_close);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(1,("WARNING: unable to determine delete on close status for open file\n"));
 		return false;
diff --git a/source4/ntvfs/posix/pvfs_qfileinfo.c b/source4/ntvfs/posix/pvfs_qfileinfo.c
index 8d23d707a4..6bc21e5e3e 100644
--- a/source4/ntvfs/posix/pvfs_qfileinfo.c
+++ b/source4/ntvfs/posix/pvfs_qfileinfo.c
@@ -368,7 +368,7 @@ NTSTATUS pvfs_qfileinfo(struct ntvfs_module_context *ntvfs,
 	}
 
 	/* update the file information */
-	status = pvfs_resolve_name_fd(pvfs, h->fd, h->name);
+	status = pvfs_resolve_name_handle(pvfs, h);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -380,7 +380,7 @@ NTSTATUS pvfs_qfileinfo(struct ntvfs_module_context *ntvfs,
 	switch (info->generic.level) {
 	case RAW_FILEINFO_STANDARD_INFO:
 	case RAW_FILEINFO_STANDARD_INFORMATION:
-		if (pvfs_delete_on_close_set(pvfs, h, NULL, NULL)) {
+		if (pvfs_delete_on_close_set(pvfs, h)) {
 			info->standard_info.out.delete_pending = 1;
 			info->standard_info.out.nlink--;
 		}
@@ -388,7 +388,7 @@ NTSTATUS pvfs_qfileinfo(struct ntvfs_module_context *ntvfs,
 
 	case RAW_FILEINFO_ALL_INFO:
 	case RAW_FILEINFO_ALL_INFORMATION:
-		if (pvfs_delete_on_close_set(pvfs, h, NULL, NULL)) {
+		if (pvfs_delete_on_close_set(pvfs, h)) {
 			info->all_info.out.delete_pending = 1;
 			info->all_info.out.nlink--;
 		}
@@ -407,7 +407,7 @@ NTSTATUS pvfs_qfileinfo(struct ntvfs_module_context *ntvfs,
 		break;
 
 	case RAW_FILEINFO_SMB2_ALL_INFORMATION:
-		if (pvfs_delete_on_close_set(pvfs, h, NULL, NULL)) {
+		if (pvfs_delete_on_close_set(pvfs, h)) {
 			info->all_info2.out.delete_pending = 1;
 			info->all_info2.out.nlink--;
 		}
diff --git a/source4/ntvfs/posix/pvfs_rename.c b/source4/ntvfs/posix/pvfs_rename.c
index 5693e79314..29b2d03005 100644
--- a/source4/ntvfs/posix/pvfs_rename.c
+++ b/source4/ntvfs/posix/pvfs_rename.c
@@ -28,16 +28,22 @@
 /*
   do a file rename, and send any notify triggers
 */
-NTSTATUS pvfs_do_rename(struct pvfs_state *pvfs, const struct pvfs_filename *name1, 
+NTSTATUS pvfs_do_rename(struct pvfs_state *pvfs,
+			struct odb_lock *lck,
+			const struct pvfs_filename *name1,
 			const char *name2)
 {
 	const char *r1, *r2;
 	uint32_t mask;
+	NTSTATUS status;
 
 	if (rename(name1->full_name, name2) == -1) {
 		return pvfs_map_errno(pvfs, errno);
 	}
 
+	status = odb_rename(lck, name2);
+	NT_STATUS_NOT_OK_RETURN(status);
+
 	if (name1->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) {
 		mask = FILE_NOTIFY_CHANGE_DIR_NAME;
 	} else {
@@ -134,12 +140,12 @@ static const char *pvfs_resolve_wildcard_component(TALLOC_CTX *mem_ctx,
   resolve a wildcard rename pattern.
 */
 static const char *pvfs_resolve_wildcard(TALLOC_CTX *mem_ctx, 
+					 struct smb_iconv_convenience *iconv_convenience,
 					 const char *fname, 
 					 const char *pattern)
 {
 	const char *base1, *base2;
 	const char *ext1, *ext2;
-	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 	char *p;
 
 	/* break into base part plus extension */
@@ -181,6 +187,84 @@ static const char *pvfs_resolve_wildcard(TALLOC_CTX *mem_ctx,
 }
 
 /*
+  retry an rename after a sharing violation
+*/
+static void pvfs_retry_rename(struct pvfs_odb_retry *r,
+			      struct ntvfs_module_context *ntvfs,
+			      struct ntvfs_request *req,
+			      void *_io,
+			      void *private_data,
+			      enum pvfs_wait_notice reason)
+{
+	union smb_rename *io = talloc_get_type(_io, union smb_rename);
+	NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
+
+	talloc_free(r);
+
+	switch (reason) {
+	case PVFS_WAIT_CANCEL:
+/*TODO*/
+		status = NT_STATUS_CANCELLED;
+		break;
+	case PVFS_WAIT_TIMEOUT:
+		/* if it timed out, then give the failure
+		   immediately */
+/*TODO*/
+		status = NT_STATUS_SHARING_VIOLATION;
+		break;
+	case PVFS_WAIT_EVENT:
+
+		/* try the open again, which could trigger another retry setup
+		   if it wants to, so we have to unmark the async flag so we
+		   will know if it does a second async reply */
+		req->async_states->state &= ~NTVFS_ASYNC_STATE_ASYNC;
+
+		status = pvfs_rename(ntvfs, req, io);
+		if (req->async_states->state & NTVFS_ASYNC_STATE_ASYNC) {
+			/* the 2nd try also replied async, so we don't send
+			   the reply yet */
+			return;
+		}
+
+		/* re-mark it async, just in case someone up the chain does
+		   paranoid checking */
+		req->async_states->state |= NTVFS_ASYNC_STATE_ASYNC;
+		break;
+	}
+
+	/* send the reply up the chain */
+	req->async_states->status = status;
+	req->async_states->send_fn(req);
+}
+
+/*
+  setup for a rename retry after a sharing violation
+  or a non granted oplock
+*/
+static NTSTATUS pvfs_rename_setup_retry(struct ntvfs_module_context *ntvfs,
+					struct ntvfs_request *req,
+					union smb_rename *io,
+					struct odb_lock *lck,
+					NTSTATUS status)
+{
+	struct pvfs_state *pvfs = ntvfs->private_data;
+	struct timeval end_time;
+
+	if (NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION)) {
+		end_time = timeval_add(&req->statistics.request_time,
+				       0, pvfs->sharing_violation_delay);
+	} else if (NT_STATUS_EQUAL(status, NT_STATUS_OPLOCK_NOT_GRANTED)) {
+		end_time = timeval_add(&req->statistics.request_time,
+				       pvfs->oplock_break_timeout, 0);
+	} else {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	return pvfs_odb_retry_setup(ntvfs, req, lck, end_time, io, NULL,
+				    pvfs_retry_rename);
+}
+
+/*
   rename one file from a wildcard set
 */
 static NTSTATUS pvfs_rename_one(struct pvfs_state *pvfs, 
@@ -196,7 +280,7 @@ static NTSTATUS pvfs_rename_one(struct pvfs_state *pvfs,
 	NTSTATUS status;
 
 	/* resolve the wildcard pattern for this name */
-	fname2 = pvfs_resolve_wildcard(mem_ctx, fname1, fname2);
+	fname2 = pvfs_resolve_wildcard(mem_ctx, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), fname1, fname2);
 	if (fname2 == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -237,11 +321,7 @@ static NTSTATUS pvfs_rename_one(struct pvfs_state *pvfs,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = pvfs_do_rename(pvfs, name1, fname2);
-
-	if (NT_STATUS_IS_OK(status)) {
-		status = odb_rename(lck, fname2);
-	}
+	status = pvfs_do_rename(pvfs, lck, name1, fname2);
 
 failed:
 	talloc_free(mem_ctx);
@@ -354,14 +434,25 @@ static NTSTATUS pvfs_rename_mv(struct ntvfs_module_context *ntvfs,
 	}
 
 	status = pvfs_can_rename(pvfs, req, name1, &lck);
+	/*
+	 * on a sharing violation we need to retry when the file is closed by
+	 * the other user, or after 1 second
+	 * on a non granted oplock we need to retry when the file is closed by
+	 * the other user, or after 30 seconds
+	 */
+	if ((NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION) ||
+	     NT_STATUS_EQUAL(status, NT_STATUS_OPLOCK_NOT_GRANTED)) &&
+	    (req->async_states->state & NTVFS_ASYNC_STATE_MAY_ASYNC)) {
+		return pvfs_rename_setup_retry(pvfs->ntvfs, req, ren, lck, status);
+	}
+
 	if (!NT_STATUS_IS_OK(status)) {
-		talloc_free(lck);
 		return status;
 	}
 
-	status = pvfs_do_rename(pvfs, name1, name2->full_name);
-	if (NT_STATUS_IS_OK(status)) {
-		status = odb_rename(lck, name2->full_name);
+	status = pvfs_do_rename(pvfs, lck, name1, name2->full_name);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
 	}
 	
 	return NT_STATUS_OK;
@@ -377,6 +468,7 @@ static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 	struct pvfs_state *pvfs = ntvfs->private_data;
 	NTSTATUS status;
 	struct pvfs_filename *name1, *name2;
+	struct odb_lock *lck = NULL;
 
 	switch (ren->ntrename.in.flags) {
 	case RENAME_FLAG_RENAME:
@@ -422,7 +514,18 @@ static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 		return status;
 	}
 
-	status = pvfs_can_rename(pvfs, req, name1, NULL);
+	status = pvfs_can_rename(pvfs, req, name1, &lck);
+	/*
+	 * on a sharing violation we need to retry when the file is closed by
+	 * the other user, or after 1 second
+	 * on a non granted oplock we need to retry when the file is closed by
+	 * the other user, or after 30 seconds
+	 */
+	if ((NT_STATUS_EQUAL(status, NT_STATUS_SHARING_VIOLATION) ||
+	     NT_STATUS_EQUAL(status, NT_STATUS_OPLOCK_NOT_GRANTED)) &&
+	    (req->async_states->state & NTVFS_ASYNC_STATE_MAY_ASYNC)) {
+		return pvfs_rename_setup_retry(pvfs->ntvfs, req, ren, lck, status);
+	}
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -431,7 +534,7 @@ static NTSTATUS pvfs_rename_nt(struct ntvfs_module_context *ntvfs,
 	case RENAME_FLAG_RENAME:
 		status = pvfs_access_check_parent(pvfs, req, name2, SEC_DIR_ADD_FILE);
 		NT_STATUS_NOT_OK_RETURN(status);
-		status = pvfs_do_rename(pvfs, name1, name2->full_name);
+		status = pvfs_do_rename(pvfs, lck, name1, name2->full_name);
 		NT_STATUS_NOT_OK_RETURN(status);
 		break;
 
diff --git a/source4/ntvfs/posix/pvfs_resolve.c b/source4/ntvfs/posix/pvfs_resolve.c
index cf74816391..325bc74f8f 100644
--- a/source4/ntvfs/posix/pvfs_resolve.c
+++ b/source4/ntvfs/posix/pvfs_resolve.c
@@ -265,8 +265,15 @@ static NTSTATUS pvfs_unix_path(struct pvfs_state *pvfs, const char *cifs_name,
 				   of a name */
 				return NT_STATUS_ILLEGAL_CHARACTER;
 			}
-			if (p > p_start && p[1] == 0) {
-				*p = 0;
+			if (p > p_start && (p[1] == '\\' || p[1] == '\0')) {
+				/* see if it is definately a "\\" or
+				 * a trailing "\". If it is then fail here,
+				 * and let the next layer up try again after
+				 * pvfs_reduce_name() if it wants to. This is
+				 * much more efficient on average than always
+				 * scanning for these separately
+				 */
+				return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 			} else {
 				*p = '/';
 			}
@@ -329,14 +336,15 @@ static NTSTATUS pvfs_unix_path(struct pvfs_state *pvfs, const char *cifs_name,
   reduce a name that contains .. components or repeated \ separators
   return NULL if it can't be reduced
 */
-static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx, const char **fname, uint_t flags)
+static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx, 
+				 struct smb_iconv_convenience *iconv_convenience, 
+				 const char **fname, uint_t flags)
 {
 	codepoint_t c;
 	size_t c_size, len;
 	int i, num_components, err_count;
 	char **components;
 	char *p, *s, *ret;
-	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(global_loadparm);
 
 	s = talloc_strdup(mem_ctx, *fname);
 	if (s == NULL) return NT_STATUS_NO_MEMORY;
@@ -398,7 +406,7 @@ static NTSTATUS pvfs_reduce_name(TALLOC_CTX *mem_ctx, const char **fname, uint_t
 		if (ISDOTDOT(components[i])) {
 			if (i < 1) return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 			memmove(&components[i-1], &components[i+1], 
-				sizeof(char *)*(num_components-(i+1)));
+				sizeof(char *)*(num_components-i));
 			i -= 2;
 			continue;
 		}
@@ -471,7 +479,7 @@ NTSTATUS pvfs_resolve_name(struct pvfs_state *pvfs, TALLOC_CTX *mem_ctx,
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_PATH_SYNTAX_BAD)) {
 		/* it might contain .. components which need to be reduced */
-		status = pvfs_reduce_name(*name, &cifs_name, flags);
+		status = pvfs_reduce_name(*name, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), &cifs_name, flags);
 		if (!NT_STATUS_IS_OK(status)) {
 			return status;
 		}
@@ -615,6 +623,86 @@ NTSTATUS pvfs_resolve_name_fd(struct pvfs_state *pvfs, int fd,
 	return pvfs_fill_dos_info(pvfs, name, fd);
 }
 
+/*
+  fill in the pvfs_filename info for an open file, given the current
+  info for a (possibly) non-open file. This is used by places that need
+  to update the pvfs_filename stat information, and the path
+  after a possible rename on a different handle.
+*/
+NTSTATUS pvfs_resolve_name_handle(struct pvfs_state *pvfs,
+				  struct pvfs_file_handle *h)
+{
+	NTSTATUS status;
+
+	if (h->have_opendb_entry) {
+		struct odb_lock *lck;
+		const char *name = NULL;
+
+		lck = odb_lock(h, h->pvfs->odb_context, &h->odb_locking_key);
+		if (lck == NULL) {
+			DEBUG(0,("%s: failed to lock file '%s' in opendb\n",
+				 __FUNCTION__, h->name->full_name));
+			/* we were supposed to do a blocking lock, so something
+			   is badly wrong! */
+			return NT_STATUS_INTERNAL_DB_CORRUPTION;
+		}
+
+		status = odb_get_path(lck, &name);
+		if (NT_STATUS_IS_OK(status)) {
+			/*
+			 * This relies an the fact that
+			 * renames of open files are only
+			 * allowed by setpathinfo() and setfileinfo()
+			 * and there're only renames within the same
+			 * directory supported
+			 */
+			if (strcmp(h->name->full_name, name) != 0) {
+				const char *orig_dir;
+				const char *new_file;
+				const char *new_orig;
+				char *delim;
+
+				delim = strrchr(name, '/');
+				if (!delim) {
+					talloc_free(lck);
+					return NT_STATUS_INTERNAL_ERROR;
+				}
+
+				new_file = delim + 1;
+				delim = strrchr(h->name->original_name, '\\');
+				if (delim) {
+					delim[0] = '\0';
+					orig_dir = h->name->original_name;
+					new_orig = talloc_asprintf(h->name, "%s\\%s",
+								   orig_dir, new_file);
+					if (!new_orig) {
+						talloc_free(lck);
+						return NT_STATUS_NO_MEMORY;
+					}
+				} else {
+					new_orig = talloc_strdup(h->name, new_file);
+					if (!new_orig) {
+						talloc_free(lck);
+						return NT_STATUS_NO_MEMORY;
+					}
+				}
+
+				talloc_free(h->name->original_name);
+				talloc_free(h->name->full_name);
+				h->name->full_name = talloc_steal(h->name, name);
+				h->name->original_name = new_orig;
+			}
+		}
+
+		talloc_free(lck);
+	}
+
+	status = pvfs_resolve_name_fd(pvfs, h->fd, h->name);
+	NT_STATUS_NOT_OK_RETURN(status);
+
+	return NT_STATUS_OK;
+}
+
 
 /*
   resolve the parent of a given name
diff --git a/source4/ntvfs/posix/pvfs_setfileinfo.c b/source4/ntvfs/posix/pvfs_setfileinfo.c
index da1e31e639..ad47fe90c9 100644
--- a/source4/ntvfs/posix/pvfs_setfileinfo.c
+++ b/source4/ntvfs/posix/pvfs_setfileinfo.c
@@ -82,11 +82,13 @@ static uint32_t pvfs_setfileinfo_access(union smb_setfileinfo *info)
 static NTSTATUS pvfs_setfileinfo_rename(struct pvfs_state *pvfs, 
 					struct ntvfs_request *req, 
 					struct pvfs_filename *name,
+					DATA_BLOB *odb_locking_key,
 					union smb_setfileinfo *info)
 {
 	NTSTATUS status;
 	struct pvfs_filename *name2;
 	char *new_name, *p;
+	struct odb_lock *lck = NULL;
 
 	/* renames are only allowed within a directory */
 	if (strchr_m(info->rename_information.in.new_name, '\\') &&
@@ -94,11 +96,6 @@ static NTSTATUS pvfs_setfileinfo_rename(struct pvfs_state *pvfs,
 		return NT_STATUS_NOT_SUPPORTED;
 	}
 
-	if (name->dos.attrib & FILE_ATTRIBUTE_DIRECTORY) {
-		/* don't allow this for now */
-		return NT_STATUS_FILE_IS_A_DIRECTORY;
-	}
-
 	/* don't allow stream renames for now */
 	if (name->stream_name) {
 		return NT_STATUS_INVALID_PARAMETER;
@@ -168,7 +165,15 @@ static NTSTATUS pvfs_setfileinfo_rename(struct pvfs_state *pvfs,
 		return status;
 	}
 
-	status = pvfs_do_rename(pvfs, name, name2->full_name);
+	lck = odb_lock(req, pvfs->odb_context, odb_locking_key);
+	if (lck == NULL) {
+		DEBUG(0,("Unable to lock opendb for can_stat\n"));
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+
+	status = pvfs_do_rename(pvfs, lck, name, name2->full_name);
+	talloc_free(lck);
+	NT_STATUS_NOT_OK_RETURN(status);
 	if (NT_STATUS_IS_OK(status)) {
 		name->full_name = talloc_steal(name, name2->full_name);
 		name->original_name = talloc_steal(name, name2->original_name);
@@ -289,7 +294,7 @@ NTSTATUS pvfs_setfileinfo(struct ntvfs_module_context *ntvfs,
 	}
 
 	/* update the file information */
-	status = pvfs_resolve_name_fd(pvfs, h->fd, h->name);
+	status = pvfs_resolve_name_handle(pvfs, h);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -391,7 +396,8 @@ NTSTATUS pvfs_setfileinfo(struct ntvfs_module_context *ntvfs,
 
 	case RAW_SFILEINFO_RENAME_INFORMATION:
 	case RAW_SFILEINFO_RENAME_INFORMATION_SMB2:
-		return pvfs_setfileinfo_rename(pvfs, req, h->name, 
+		return pvfs_setfileinfo_rename(pvfs, req, h->name,
+					       &h->odb_locking_key,
 					       info);
 
 	case RAW_SFILEINFO_SEC_DESC:
@@ -565,6 +571,7 @@ NTSTATUS pvfs_setpathinfo(struct ntvfs_module_context *ntvfs,
 	uint32_t access_needed;
 	uint32_t change_mask = 0;
 	struct odb_lock *lck = NULL;
+	DATA_BLOB odb_locking_key;
 
 	/* resolve the cifs name to a posix name */
 	status = pvfs_resolve_name(pvfs, req, info->generic.in.file.path, 
@@ -696,8 +703,12 @@ NTSTATUS pvfs_setpathinfo(struct ntvfs_module_context *ntvfs,
 
 	case RAW_SFILEINFO_RENAME_INFORMATION:
 	case RAW_SFILEINFO_RENAME_INFORMATION_SMB2:
-		return pvfs_setfileinfo_rename(pvfs, req, name, 
-					       info);
+		status = pvfs_locking_key(name, name, &odb_locking_key);
+		NT_STATUS_NOT_OK_RETURN(status);
+		status = pvfs_setfileinfo_rename(pvfs, req, name,
+						 &odb_locking_key, info);
+		NT_STATUS_NOT_OK_RETURN(status);
+		return NT_STATUS_OK;
 
 	case RAW_SFILEINFO_DISPOSITION_INFO:
 	case RAW_SFILEINFO_DISPOSITION_INFORMATION:
diff --git a/source4/ntvfs/posix/pvfs_xattr.c b/source4/ntvfs/posix/pvfs_xattr.c
index 39090bf702..b66d252a45 100644
--- a/source4/ntvfs/posix/pvfs_xattr.c
+++ b/source4/ntvfs/posix/pvfs_xattr.c
@@ -140,7 +140,7 @@ _PUBLIC_ NTSTATUS pvfs_xattr_ndr_save(struct pvfs_state *pvfs,
 	NTSTATUS status;
 	enum ndr_err_code ndr_err;
 
-	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, lp_iconv_convenience(global_loadparm), p, (ndr_push_flags_fn_t)push_fn);
+	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), p, (ndr_push_flags_fn_t)push_fn);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(mem_ctx);
 		return ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/ntvfs/sysdep/inotify.c b/source4/ntvfs/sysdep/inotify.c
index 3fa710415b..093c15abab 100644
--- a/source4/ntvfs/sysdep/inotify.c
+++ b/source4/ntvfs/sysdep/inotify.c
@@ -244,11 +244,6 @@ static void inotify_handler(struct event_context *ev, struct fd_event *fde,
 static NTSTATUS inotify_setup(struct sys_notify_context *ctx)
 {
 	struct inotify_private *in;
-
-	if (!lp_parm_bool(global_loadparm, NULL, "notify", "inotify", true)) {
-		return NT_STATUS_INVALID_SYSTEM_SERVICE;
-	}
-
 	in = talloc(ctx, struct inotify_private);
 	NT_STATUS_HAVE_NO_MEMORY(in);
 	in->fd = inotify_init();
@@ -339,6 +334,10 @@ static NTSTATUS inotify_watch(struct sys_notify_context *ctx,
 	/* maybe setup the inotify fd */
 	if (ctx->private_data == NULL) {
 		NTSTATUS status;
+		if (!lp_parm_bool(global_loadparm, NULL, "notify", "inotify", true)) {
+			return NT_STATUS_INVALID_SYSTEM_SERVICE;
+		}
+
 		status = inotify_setup(ctx);
 		NT_STATUS_NOT_OK_RETURN(status);
 	}
diff --git a/source4/param/config.mk b/source4/param/config.mk
index c3f50b13fe..f43c9d8a1b 100644
--- a/source4/param/config.mk
+++ b/source4/param/config.mk
@@ -6,19 +6,21 @@ OBJ_FILES = loadparm.o \
 			../lib/version.o
 PUBLIC_DEPENDENCIES = LIBSAMBA-UTIL 
 PRIVATE_DEPENDENCIES = DYNCONFIG LIBREPLACE_EXT CHARSET
-PUBLIC_PROTO_HEADER = proto.h
-PUBLIC_HEADERS = param.h
+PRIVATE_PROTO_HEADER = proto.h
+
+PUBLIC_HEADERS += param/param.h
 
 #################################
 # Start SUBSYSTEM share
 [SUBSYSTEM::share]
-PUBLIC_HEADERS = share.h
-PUBLIC_PROTO_HEADER = share_proto.h
+PRIVATE_PROTO_HEADER = share_proto.h
 OBJ_FILES = share.o
 PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL
 # End SUBSYSTEM share
 #################################
 
+PUBLIC_HEADERS += param/share.h
+
 ################################################
 # Start MODULE share_classic
 [MODULE::share_classic]
diff --git a/source4/param/generic.c b/source4/param/generic.c
index 2327000fc9..b86e3ad234 100644
--- a/source4/param/generic.c
+++ b/source4/param/generic.c
@@ -259,11 +259,8 @@ int param_use(struct loadparm_context *lp_ctx, struct param_context *ctx)
 				struct loadparm_service *service = 
 							lp_service(lp_ctx, section->name);
 				if (service == NULL)
-					service = lp_add_service(lp_ctx, &sDefault, section->name);
-				lp_do_service_parameter(lp_ctx, 
-							service,
-							param->key,
-							param->value);
+					service = lp_add_service(lp_ctx, lp_default_service(lp_ctx), section->name);
+				lp_do_service_parameter(lp_ctx, service, param->key, param->value);
 			}
 		}
 	}
diff --git a/source4/param/loadparm.c b/source4/param/loadparm.c
index bad90fc74a..d94ab92ac9 100644
--- a/source4/param/loadparm.c
+++ b/source4/param/loadparm.c
@@ -224,44 +224,11 @@ struct loadparm_service
 };
 
 
-/* This is a default service used to prime a services structure */
-struct loadparm_service sDefault = {
-	.szService = NULL,
-	.szPath = NULL,
-	.szCopy = NULL,
-	.szInclude = NULL,
-	.szPrintername = NULL,
-	.szHostsallow = NULL,
-	.szHostsdeny = NULL,
-	.comment = NULL,
-	.volume = NULL,
-	.fstype = NULL,
-	.ntvfs_handler = NULL,
-	.iMaxPrintJobs = 1000,
-	.iMaxConnections = 0,
-	.iCSCPolicy = 0,
-	.bAvailable = true,
-	.bBrowseable = true,
-	.bRead_only = true,
-	.bPrint_ok = false,
-	.bMap_system = false,
-	.bMap_hidden = false,
-	.bMap_archive = true,
-	.bStrictLocking = true,
-	.iCreate_mask = 0744,
-	.iCreate_force_mode = 0000,
-	.iDir_mask = 0755,
-	.iDir_force_mode = 0000,
-	.copymap = NULL,
-	.bMSDfsRoot = false,
-	.bStrictSync = false,
-	.bCIFileSystem = false,
-};
-
 struct loadparm_context *global_loadparm = NULL;
 
 #define NUMPARAMETERS (sizeof(parm_table) / sizeof(struct parm_struct))
 
+
 /* prototypes for the special type handlers */
 static bool handle_include(struct loadparm_context *lp_ctx,
 			   const char *pszParmValue, char **ptr);
@@ -521,11 +488,13 @@ static struct parm_struct parm_table[] = {
 	{NULL, P_BOOL, P_NONE, 0, NULL, NULL}
 };
 
+
 /* local variables */
 struct loadparm_context {
 	const char *szConfigFile;
 	struct loadparm_global *globals;
 	struct loadparm_service **services;
+	struct loadparm_service *sDefault;
 	int iNumServices;
 	struct loadparm_service *currentService;
 	bool bInGlobalSection;
@@ -540,6 +509,10 @@ struct loadparm_context {
 };
 
 
+struct loadparm_service *lp_default_service(struct loadparm_context *lp_ctx)
+{
+	return lp_ctx->sDefault;
+}
 
 /*
   return the parameter table
@@ -619,15 +592,13 @@ static const char *lp_string(const char *s)
  int fn_name(struct loadparm_context *lp_ctx) {return lp_ctx->globals->var_name;}
 
 #define FN_LOCAL_STRING(fn_name,val) \
- const char *fn_name(struct loadparm_service *service) {return(lp_string((const char *)((service != NULL && service->val != NULL) ? service->val : sDefault.val)));}
-#define FN_LOCAL_CONST_STRING(fn_name,val) \
- const char *fn_name(struct loadparm_service *service) {return (const char *)(service != NULL && service->val != NULL) ? service->val : sDefault.val;}
+ const char *fn_name(struct loadparm_service *service, struct loadparm_service *sDefault) {return(lp_string((const char *)((service != NULL && service->val != NULL) ? service->val : sDefault->val)));}
 #define FN_LOCAL_LIST(fn_name,val) \
- const char **fn_name(struct loadparm_service *service) {return(const char **)(service != NULL && service->val != NULL? service->val : sDefault.val);}
+ const char **fn_name(struct loadparm_service *service, struct loadparm_service *sDefault) {return(const char **)(service != NULL && service->val != NULL? service->val : sDefault->val);}
 #define FN_LOCAL_BOOL(fn_name,val) \
- bool fn_name(struct loadparm_service *service) {return((service != NULL)? service->val : sDefault.val);}
+ bool fn_name(struct loadparm_service *service, struct loadparm_service *sDefault) {return((service != NULL)? service->val : sDefault->val);}
 #define FN_LOCAL_INTEGER(fn_name,val) \
- int fn_name(struct loadparm_service *service) {return((service != NULL)? service->val : sDefault.val);}
+ int fn_name(struct loadparm_service *service, struct loadparm_service *sDefault) {return((service != NULL)? service->val : sDefault->val);}
 
 _PUBLIC_ FN_GLOBAL_INTEGER(lp_server_role, server_role)
 _PUBLIC_ FN_GLOBAL_LIST(lp_smb_ports, smb_ports)
@@ -722,8 +693,11 @@ _PUBLIC_ FN_GLOBAL_INTEGER(lp_security, security)
 _PUBLIC_ FN_GLOBAL_BOOL(lp_paranoid_server_security, paranoid_server_security)
 _PUBLIC_ FN_GLOBAL_INTEGER(lp_announce_as, announce_as)
 _PUBLIC_ FN_GLOBAL_LIST(lp_js_include, jsInclude)
-_PUBLIC_ FN_LOCAL_STRING(lp_servicename, szService)
-_PUBLIC_ FN_LOCAL_CONST_STRING(lp_const_servicename, szService)
+const char *lp_servicename(const struct loadparm_service *service)
+{
+	return lp_string((const char *)service->szService);
+}
+
 _PUBLIC_ FN_LOCAL_STRING(lp_pathname, szPath)
 static FN_LOCAL_STRING(_lp_printername, szPrintername)
 _PUBLIC_ FN_LOCAL_LIST(lp_hostsallow, szHostsallow)
@@ -999,11 +973,11 @@ bool lp_parm_bool(struct loadparm_context *lp_ctx,
  * Initialise a service to the defaults.
  */
 
-static struct loadparm_service *init_service(TALLOC_CTX *mem_ctx)
+static struct loadparm_service *init_service(TALLOC_CTX *mem_ctx, struct loadparm_service *sDefault)
 {
 	struct loadparm_service *pservice =
 		talloc_zero(mem_ctx, struct loadparm_service);
-	copy_service(pservice, &sDefault, NULL);
+	copy_service(pservice, sDefault, NULL);
 	return pservice;
 }
 
@@ -1085,7 +1059,7 @@ struct loadparm_service *lp_add_service(struct loadparm_context *lp_ctx,
 		lp_ctx->iNumServices++;
 	}
 
-	lp_ctx->services[i] = init_service(lp_ctx->services);
+	lp_ctx->services[i] = init_service(lp_ctx->services, lp_ctx->sDefault);
 	if (lp_ctx->services[i] == NULL) {
 		DEBUG(0,("lp_add_service: out of memory!\n"));
 		return NULL;
@@ -1114,10 +1088,10 @@ bool lp_add_home(struct loadparm_context *lp_ctx,
 		return false;
 
 	if (!(*(default_service->szPath))
-	    || strequal(default_service->szPath, sDefault.szPath)) {
+	    || strequal(default_service->szPath, lp_ctx->sDefault->szPath)) {
 		service->szPath = talloc_strdup(service, pszHomedir);
 	} else {
-		service->szPath = string_sub_talloc(service, lp_pathname(default_service),"%H", pszHomedir); 
+		service->szPath = string_sub_talloc(service, lp_pathname(default_service, lp_ctx->sDefault), "%H", pszHomedir); 
 	}
 
 	if (!(*(service->comment))) {
@@ -1139,7 +1113,7 @@ bool lp_add_home(struct loadparm_context *lp_ctx,
 static bool lp_add_hidden(struct loadparm_context *lp_ctx, const char *name,
 			  const char *fstype)
 {
-	struct loadparm_service *service = lp_add_service(lp_ctx, &sDefault, name);
+	struct loadparm_service *service = lp_add_service(lp_ctx, lp_ctx->sDefault, name);
 
 	if (service == NULL)
 		return false;
@@ -1243,7 +1217,7 @@ void *lp_parm_ptr(struct loadparm_context *lp_ctx,
 {
 	if (service == NULL) {
 		if (parm->class == P_LOCAL)
-			return ((char *)&sDefault)+parm->offset;
+			return ((char *)lp_ctx->sDefault)+parm->offset;
 		else if (parm->class == P_GLOBAL)
 			return ((char *)lp_ctx->globals)+parm->offset;
 		else return NULL;
@@ -2019,7 +1993,7 @@ static bool do_section(const char *pszSectionName, void *userdata)
 		/* issued by the post-processing of a previous section. */
 		DEBUG(2, ("Processing section \"[%s]\"\n", pszSectionName));
 
-		if ((lp_ctx->currentService = lp_add_service(lp_ctx, &sDefault,
+		if ((lp_ctx->currentService = lp_add_service(lp_ctx, lp_ctx->sDefault,
 							     pszSectionName))
 		    == NULL) {
 			DEBUG(0, ("Failed to add a new service\n"));
@@ -2032,12 +2006,12 @@ static bool do_section(const char *pszSectionName, void *userdata)
 
 
 /**
- * Determine if a partcular base parameter is currentl set to the default value.
+ * Determine if a particular base parameter is currently set to the default value.
  */
 
-static bool is_default(int i)
+static bool is_default(struct loadparm_service *sDefault, int i)
 {
-	void *def_ptr = ((char *)&sDefault) + parm_table[i].offset;
+	void *def_ptr = ((char *)sDefault) + parm_table[i].offset;
 	if (!defaults_saved)
 		return false;
 	switch (parm_table[i].type) {
@@ -2096,12 +2070,12 @@ static void dump_globals(struct loadparm_context *lp_ctx, FILE *f,
  * Display the contents of a single services record.
  */
 
-static void dump_a_service(struct loadparm_service * pService, FILE * f)
+static void dump_a_service(struct loadparm_service * pService, struct loadparm_service *sDefault, FILE * f)
 {
 	int i;
 	struct param_opt *data;
 
-	if (pService != &sDefault)
+	if (pService != sDefault)
 		fprintf(f, "\n[%s]\n", pService->szService);
 
 	for (i = 0; parm_table[i].label; i++)
@@ -2109,14 +2083,14 @@ static void dump_a_service(struct loadparm_service * pService, FILE * f)
 		    parm_table[i].offset != -1 &&
 		    (*parm_table[i].label != '-') &&
 		    (i == 0 || (parm_table[i].offset != parm_table[i - 1].offset))) {
-			if (pService == &sDefault) {
-				if (defaults_saved && is_default(i))
+			if (pService == sDefault) {
+				if (defaults_saved && is_default(sDefault, i))
 					continue;
 			} else {
 				if (equal_parameter(parm_table[i].type,
 						    ((char *)pService) +
 						    parm_table[i].offset,
-						    ((char *)&sDefault) +
+						    ((char *)sDefault) +
 						    parm_table[i].offset))
 					continue;
 			}
@@ -2189,7 +2163,7 @@ struct parm_struct *lp_next_parameter(struct loadparm_context *lp_ctx, int snum,
 				    !equal_parameter(parm_table[*i].type,
 						     ((char *)pService) +
 						     parm_table[*i].offset,
-						     ((char *)&sDefault) +
+						     ((char *)lp_ctx->sDefault) +
 						     parm_table[*i].offset))
 				{
 					return &parm_table[(*i)++];
@@ -2266,6 +2240,18 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
 	talloc_set_destructor(lp_ctx, lp_destructor);
 	lp_ctx->bInGlobalSection = true;
 	lp_ctx->globals = talloc_zero(lp_ctx, struct loadparm_global);
+	lp_ctx->sDefault = talloc_zero(lp_ctx, struct loadparm_service);
+
+	lp_ctx->sDefault->iMaxPrintJobs = 1000;
+	lp_ctx->sDefault->bAvailable = true;
+	lp_ctx->sDefault->bBrowseable = true;
+	lp_ctx->sDefault->bRead_only = true;
+	lp_ctx->sDefault->bMap_archive = true;
+	lp_ctx->sDefault->bStrictLocking = true;
+	lp_ctx->sDefault->iCreate_mask = 0744;
+	lp_ctx->sDefault->iCreate_force_mode = 0000;
+	lp_ctx->sDefault->iDir_mask = 0755;
+	lp_ctx->sDefault->iDir_force_mode = 0000;
 
 	DEBUG(3, ("Initialising global parameters\n"));
 
@@ -2276,7 +2262,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
 		    !(lp_ctx->flags[i] & FLAG_CMDLINE)) {
 			char **r;
 			if (parm_table[i].class == P_LOCAL) {
-				r = (char **)(((char *)&sDefault) + parm_table[i].offset);
+				r = (char **)(((char *)lp_ctx->sDefault) + parm_table[i].offset);
 			} else {
 				r = (char **)(((char *)lp_ctx->globals) + parm_table[i].offset);
 			}
@@ -2512,21 +2498,21 @@ void lp_dump(struct loadparm_context *lp_ctx, FILE *f, bool show_defaults,
 
 	dump_globals(lp_ctx, f, show_defaults);
 
-	dump_a_service(&sDefault, f);
+	dump_a_service(lp_ctx->sDefault, lp_ctx->sDefault, f);
 
 	for (iService = 0; iService < maxtoprint; iService++)
-		lp_dump_one(f, show_defaults, lp_ctx->services[iService]);
+		lp_dump_one(f, show_defaults, lp_ctx->services[iService], lp_ctx->sDefault);
 }
 
 /**
  * Display the contents of one service in human-readable form.
  */
-void lp_dump_one(FILE *f, bool show_defaults, struct loadparm_service *service)
+void lp_dump_one(FILE *f, bool show_defaults, struct loadparm_service *service, struct loadparm_service *sDefault)
 {
 	if (service != NULL) {
 		if (service->szService[0] == '\0')
 			return;
-		dump_a_service(service, f);
+		dump_a_service(service, sDefault, f);
 	}
 }
 
@@ -2565,9 +2551,9 @@ struct loadparm_service *lp_service(struct loadparm_context *lp_ctx,
 /**
  * A useful volume label function.
  */
-const char *volume_label(struct loadparm_service *service)
+const char *volume_label(struct loadparm_service *service, struct loadparm_service *sDefault)
 {
-	const char *ret = lp_volume(service);
+	const char *ret = lp_volume(service, sDefault);
 	if (!*ret)
 		return lp_servicename(service);
 	return ret;
@@ -2577,11 +2563,11 @@ const char *volume_label(struct loadparm_service *service)
 /**
  * If we are PDC then prefer us as DMB
  */
-const char *lp_printername(struct loadparm_service *service)
+const char *lp_printername(struct loadparm_service *service, struct loadparm_service *sDefault)
 {
-	const char *ret = _lp_printername(service);
+	const char *ret = _lp_printername(service, sDefault);
 	if (ret == NULL || (ret != NULL && *ret == '\0'))
-		ret = lp_const_servicename(service);
+		ret = lp_servicename(service);
 
 	return ret;
 }
@@ -2590,9 +2576,9 @@ const char *lp_printername(struct loadparm_service *service)
 /**
  * Return the max print jobs per queue.
  */
-int lp_maxprintjobs(struct loadparm_service *service)
+int lp_maxprintjobs(struct loadparm_service *service, struct loadparm_service *sDefault)
 {
-	int maxjobs = (service != NULL) ? service->iMaxPrintJobs : sDefault.iMaxPrintJobs;
+	int maxjobs = (service != NULL) ? service->iMaxPrintJobs : sDefault->iMaxPrintJobs;
 	if (maxjobs <= 0 || maxjobs >= PRINT_MAX_JOBID)
 		maxjobs = PRINT_MAX_JOBID - 1;
 
diff --git a/source4/param/loadparm.h b/source4/param/loadparm.h
index 842e1ce437..cd3c0b9595 100644
--- a/source4/param/loadparm.h
+++ b/source4/param/loadparm.h
@@ -59,6 +59,9 @@ struct parm_struct {
 	} def;
 };
 
+
+
+
 #define FLAG_DEFAULT    0x0001 /* this option was a default */
 #define FLAG_CMDLINE    0x0002 /* this option was set from the command line */
 
diff --git a/source4/param/param.h b/source4/param/param.h
index 098a73deec..84f864edaa 100644
--- a/source4/param/param.h
+++ b/source4/param/param.h
@@ -64,6 +64,5 @@ struct smbcli_options;
 #include "param/proto.h"
 
 extern struct loadparm_context *global_loadparm;
-extern struct loadparm_service sDefault;
 
 #endif /* _PARAM_H */
diff --git a/source4/param/param.i b/source4/param/param.i
index 7322302117..77d781d6ff 100644
--- a/source4/param/param.i
+++ b/source4/param/param.i
@@ -49,6 +49,7 @@ typedef struct param_opt param_opt;
 typedef struct loadparm_context {
     %extend {
         loadparm_context(TALLOC_CTX *mem_ctx) { return loadparm_init(mem_ctx); }
+        struct loadparm_service *default_service() { return lp_default_service($self); }
         bool load(const char *filename) { return lp_load($self, filename); }
         bool load_default() { return lp_load_default($self); }
 #ifdef SWIGPYTHON
@@ -167,9 +168,9 @@ typedef struct loadparm_context {
 
 typedef struct loadparm_service {
     %extend { 
-        const char *volume_label() { return volume_label($self); }
-        const char *printername() { return lp_printername($self); }
-        int maxprintjobs() { return lp_maxprintjobs($self); } 
+        const char *volume_label(struct loadparm_service *sDefault) { return volume_label($self, sDefault); }
+        const char *printername(struct loadparm_service *sDefault) { return lp_printername($self, sDefault); }
+        int maxprintjobs(struct loadparm_service *sDefault) { return lp_maxprintjobs($self, sDefault); } 
     }
 } loadparm_service;
 
diff --git a/source4/param/param.py b/source4/param/param.py
index 5adf7a4ecc..025acc6be1 100644
--- a/source4/param/param.py
+++ b/source4/param/param.py
@@ -63,6 +63,7 @@ class LoadParm(object):
     def __init__(self, *args, **kwargs): 
         _param.LoadParm_swiginit(self,_param.new_LoadParm(*args, **kwargs))
     __swig_destroy__ = _param.delete_LoadParm
+LoadParm.default_service = new_instancemethod(_param.LoadParm_default_service,None,LoadParm)
 LoadParm.load = new_instancemethod(_param.LoadParm_load,None,LoadParm)
 LoadParm.load_default = new_instancemethod(_param.LoadParm_load_default,None,LoadParm)
 LoadParm.__len__ = new_instancemethod(_param.LoadParm___len__,None,LoadParm)
diff --git a/source4/param/param_wrap.c b/source4/param/param_wrap.c
index 275e2d67ec..e74f902645 100644
--- a/source4/param/param_wrap.c
+++ b/source4/param/param_wrap.c
@@ -2526,6 +2526,7 @@ typedef struct param_section param_section;
 typedef struct param_opt param_opt;
 
 SWIGINTERN loadparm_context *new_loadparm_context(TALLOC_CTX *mem_ctx){ return loadparm_init(mem_ctx); }
+SWIGINTERN struct loadparm_service *loadparm_context_default_service(loadparm_context *self){ return lp_default_service(self); }
 
 SWIGINTERN swig_type_info*
 SWIG_pchar_descriptor(void)
@@ -2742,9 +2743,9 @@ SWIGINTERN PyObject *loadparm_context_get(loadparm_context *self,char const *par
             return Py_None;
         }
 SWIGINTERN void delete_loadparm_context(loadparm_context *self){ talloc_free(self); }
-SWIGINTERN char const *loadparm_service_volume_label(loadparm_service *self){ return volume_label(self); }
-SWIGINTERN char const *loadparm_service_printername(loadparm_service *self){ return lp_printername(self); }
-SWIGINTERN int loadparm_service_maxprintjobs(loadparm_service *self){ return lp_maxprintjobs(self); }
+SWIGINTERN char const *loadparm_service_volume_label(loadparm_service *self,struct loadparm_service *sDefault){ return volume_label(self, sDefault); }
+SWIGINTERN char const *loadparm_service_printername(loadparm_service *self,struct loadparm_service *sDefault){ return lp_printername(self, sDefault); }
+SWIGINTERN int loadparm_service_maxprintjobs(loadparm_service *self,struct loadparm_service *sDefault){ return lp_maxprintjobs(self, sDefault); }
 SWIGINTERN param *new_param(TALLOC_CTX *mem_ctx){ return param_init(mem_ctx); }
 SWIGINTERN int param_set(param *self,char const *parameter,PyObject *ob,char const *section_name){
             struct param_opt *opt = param_get_add(self, parameter, section_name);
@@ -2799,6 +2800,34 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_LoadParm_default_service(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  loadparm_context *arg1 = (loadparm_context *) 0 ;
+  struct loadparm_service *result = 0 ;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  PyObject * obj0 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self", NULL 
+  };
+  
+  arg1 = loadparm_init(NULL);
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|O:LoadParm_default_service",kwnames,&obj0)) SWIG_fail;
+  if (obj0) {
+    res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_loadparm_context, 0 |  0 );
+    if (!SWIG_IsOK(res1)) {
+      SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "LoadParm_default_service" "', argument " "1"" of type '" "loadparm_context *""'"); 
+    }
+    arg1 = (loadparm_context *)(argp1);
+  }
+  result = (struct loadparm_service *)loadparm_context_default_service(arg1);
+  resultobj = SWIG_NewPointerObj(SWIG_as_voidptr(result), SWIGTYPE_p_loadparm_service, 0 |  0 );
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_LoadParm_load(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   loadparm_context *arg1 = (loadparm_context *) 0 ;
@@ -3241,22 +3270,33 @@ SWIGINTERN PyObject *LoadParm_swiginit(PyObject *SWIGUNUSEDPARM(self), PyObject
   return SWIG_Python_InitShadowInstance(args);
 }
 
-SWIGINTERN PyObject *_wrap_loadparm_service_volume_label(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
+SWIGINTERN PyObject *_wrap_loadparm_service_volume_label(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   loadparm_service *arg1 = (loadparm_service *) 0 ;
+  struct loadparm_service *arg2 = (struct loadparm_service *) 0 ;
   char *result = 0 ;
   void *argp1 = 0 ;
   int res1 = 0 ;
-  PyObject *swig_obj[1] ;
+  void *argp2 = 0 ;
+  int res2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "sDefault", NULL 
+  };
   
-  if (!args) SWIG_fail;
-  swig_obj[0] = args;
-  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:loadparm_service_volume_label",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
   if (!SWIG_IsOK(res1)) {
     SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "loadparm_service_volume_label" "', argument " "1"" of type '" "loadparm_service *""'"); 
   }
   arg1 = (loadparm_service *)(argp1);
-  result = (char *)loadparm_service_volume_label(arg1);
+  res2 = SWIG_ConvertPtr(obj1, &argp2,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "loadparm_service_volume_label" "', argument " "2"" of type '" "struct loadparm_service *""'"); 
+  }
+  arg2 = (struct loadparm_service *)(argp2);
+  result = (char *)loadparm_service_volume_label(arg1,arg2);
   resultobj = SWIG_FromCharPtr((const char *)result);
   return resultobj;
 fail:
@@ -3264,22 +3304,33 @@ fail:
 }
 
 
-SWIGINTERN PyObject *_wrap_loadparm_service_printername(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
+SWIGINTERN PyObject *_wrap_loadparm_service_printername(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   loadparm_service *arg1 = (loadparm_service *) 0 ;
+  struct loadparm_service *arg2 = (struct loadparm_service *) 0 ;
   char *result = 0 ;
   void *argp1 = 0 ;
   int res1 = 0 ;
-  PyObject *swig_obj[1] ;
+  void *argp2 = 0 ;
+  int res2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "sDefault", NULL 
+  };
   
-  if (!args) SWIG_fail;
-  swig_obj[0] = args;
-  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:loadparm_service_printername",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
   if (!SWIG_IsOK(res1)) {
     SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "loadparm_service_printername" "', argument " "1"" of type '" "loadparm_service *""'"); 
   }
   arg1 = (loadparm_service *)(argp1);
-  result = (char *)loadparm_service_printername(arg1);
+  res2 = SWIG_ConvertPtr(obj1, &argp2,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "loadparm_service_printername" "', argument " "2"" of type '" "struct loadparm_service *""'"); 
+  }
+  arg2 = (struct loadparm_service *)(argp2);
+  result = (char *)loadparm_service_printername(arg1,arg2);
   resultobj = SWIG_FromCharPtr((const char *)result);
   return resultobj;
 fail:
@@ -3287,22 +3338,33 @@ fail:
 }
 
 
-SWIGINTERN PyObject *_wrap_loadparm_service_maxprintjobs(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
+SWIGINTERN PyObject *_wrap_loadparm_service_maxprintjobs(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   loadparm_service *arg1 = (loadparm_service *) 0 ;
+  struct loadparm_service *arg2 = (struct loadparm_service *) 0 ;
   int result;
   void *argp1 = 0 ;
   int res1 = 0 ;
-  PyObject *swig_obj[1] ;
+  void *argp2 = 0 ;
+  int res2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "sDefault", NULL 
+  };
   
-  if (!args) SWIG_fail;
-  swig_obj[0] = args;
-  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:loadparm_service_maxprintjobs",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_loadparm_service, 0 |  0 );
   if (!SWIG_IsOK(res1)) {
     SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "loadparm_service_maxprintjobs" "', argument " "1"" of type '" "loadparm_service *""'"); 
   }
   arg1 = (loadparm_service *)(argp1);
-  result = (int)loadparm_service_maxprintjobs(arg1);
+  res2 = SWIG_ConvertPtr(obj1, &argp2,SWIGTYPE_p_loadparm_service, 0 |  0 );
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "loadparm_service_maxprintjobs" "', argument " "2"" of type '" "struct loadparm_service *""'"); 
+  }
+  arg2 = (struct loadparm_service *)(argp2);
+  result = (int)loadparm_service_maxprintjobs(arg1,arg2);
   resultobj = SWIG_From_int((int)(result));
   return resultobj;
 fail:
@@ -4078,6 +4140,7 @@ SWIGINTERN PyObject *Swig_var_default_config_get(void) {
 
 static PyMethodDef SwigMethods[] = {
 	 { (char *)"new_LoadParm", (PyCFunction)_wrap_new_LoadParm, METH_NOARGS, NULL},
+	 { (char *)"LoadParm_default_service", (PyCFunction) _wrap_LoadParm_default_service, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm_load", (PyCFunction) _wrap_LoadParm_load, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm_load_default", (PyCFunction) _wrap_LoadParm_load_default, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm___len__", (PyCFunction) _wrap_LoadParm___len__, METH_VARARGS | METH_KEYWORDS, NULL},
@@ -4091,9 +4154,9 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"delete_LoadParm", (PyCFunction) _wrap_delete_LoadParm, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm_swigregister", LoadParm_swigregister, METH_VARARGS, NULL},
 	 { (char *)"LoadParm_swiginit", LoadParm_swiginit, METH_VARARGS, NULL},
-	 { (char *)"loadparm_service_volume_label", (PyCFunction)_wrap_loadparm_service_volume_label, METH_O, NULL},
-	 { (char *)"loadparm_service_printername", (PyCFunction)_wrap_loadparm_service_printername, METH_O, NULL},
-	 { (char *)"loadparm_service_maxprintjobs", (PyCFunction)_wrap_loadparm_service_maxprintjobs, METH_O, NULL},
+	 { (char *)"loadparm_service_volume_label", (PyCFunction) _wrap_loadparm_service_volume_label, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"loadparm_service_printername", (PyCFunction) _wrap_loadparm_service_printername, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"loadparm_service_maxprintjobs", (PyCFunction) _wrap_loadparm_service_maxprintjobs, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"loadparm_service_swigregister", loadparm_service_swigregister, METH_VARARGS, NULL},
 	 { (char *)"new_ParamFile", (PyCFunction)_wrap_new_ParamFile, METH_NOARGS, NULL},
 	 { (char *)"ParamFile_get_section", (PyCFunction) _wrap_ParamFile_get_section, METH_VARARGS | METH_KEYWORDS, NULL},
diff --git a/source4/param/share.c b/source4/param/share.c
index 2c97625bcc..bc2999b03d 100644
--- a/source4/param/share.c
+++ b/source4/param/share.c
@@ -1,7 +1,7 @@
 /* 
    Unix SMB/CIFS implementation.
    
-   Modular services configuration system
+   Modular shares configuration system
    
    Copyright (C) Simo Sorce	2006
    
diff --git a/source4/param/share_classic.c b/source4/param/share_classic.c
index b517c9c4c2..f5a6fa67a4 100644
--- a/source4/param/share_classic.c
+++ b/source4/param/share_classic.c
@@ -1,7 +1,7 @@
 /* 
    Unix SMB/CIFS implementation.
    
-   Classic file based services configuration
+   Classic file based shares configuration
    
    Copyright (C) Simo Sorce	2006
    
@@ -73,25 +73,25 @@ static const char *sclassic_string_option(struct share_config *scfg,
 	}
 
 	if (strcmp(opt_name, SHARE_PATH) == 0) {
-		return lp_pathname(s);
+		return lp_pathname(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_COMMENT) == 0) {
-		return lp_comment(s);
+		return lp_comment(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_VOLUME) == 0) {
-		return volume_label(s);
+		return volume_label(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_TYPE) == 0) {
-		if (lp_print_ok(s)) {
+		if (lp_print_ok(s, lp_default_service(lp_ctx))) {
 			return "PRINTER";
 		}
-		if (strcmp("NTFS", lp_fstype(s)) == 0) {
+		if (strcmp("NTFS", lp_fstype(s, lp_default_service(lp_ctx))) == 0) {
 			return "DISK";
 		}
-		return lp_fstype(s);
+		return lp_fstype(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_PASSWORD) == 0) {
@@ -131,27 +131,27 @@ static int sclassic_int_option(struct share_config *scfg, const char *opt_name,
 	}
 
 	if (strcmp(opt_name, SHARE_CSC_POLICY) == 0) {
-		return lp_csc_policy(s);
+		return lp_csc_policy(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MAX_CONNECTIONS) == 0) {
-		return lp_max_connections(s);
+		return lp_max_connections(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_CREATE_MASK) == 0) {
-		return lp_create_mask(s);
+		return lp_create_mask(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_DIR_MASK) == 0) {
-		return lp_dir_mask(s);
+		return lp_dir_mask(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_FORCE_DIR_MODE) == 0) {
-		return lp_force_dir_mode(s);
+		return lp_force_dir_mode(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_FORCE_CREATE_MODE) == 0) {
-		return lp_force_create_mode(s);
+		return lp_force_create_mode(s, lp_default_service(lp_ctx));
 	}
 
 
@@ -190,39 +190,39 @@ static bool sclassic_bool_option(struct share_config *scfg, const char *opt_name
 	}
 
 	if (strcmp(opt_name, SHARE_BROWSEABLE) == 0) {
-		return lp_browseable(s);
+		return lp_browseable(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_READONLY) == 0) {
-		return lp_readonly(s);
+		return lp_readonly(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MAP_SYSTEM) == 0) {
-		return lp_map_system(s);
+		return lp_map_system(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MAP_HIDDEN) == 0) {
-		return lp_map_hidden(s);
+		return lp_map_hidden(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MAP_ARCHIVE) == 0) {
-		return lp_map_archive(s);
+		return lp_map_archive(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_STRICT_LOCKING) == 0) {
-		return lp_strict_locking(s);
+		return lp_strict_locking(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_STRICT_SYNC) == 0) {
-		return lp_strict_sync(s);
+		return lp_strict_sync(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_MSDFS_ROOT) == 0) {
-		return lp_msdfs_root(s);
+		return lp_msdfs_root(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_CI_FILESYSTEM) == 0) {
-		return lp_ci_filesystem(s);
+		return lp_ci_filesystem(s, lp_default_service(lp_ctx));
 	}
 
 	DEBUG(0,("request for unknown share bool option '%s'\n",
@@ -255,15 +255,15 @@ static const char **sclassic_string_list_option(TALLOC_CTX *mem_ctx, struct shar
 	}
 
 	if (strcmp(opt_name, SHARE_HOSTS_ALLOW) == 0) {
-		return lp_hostsallow(s);
+		return lp_hostsallow(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_HOSTS_DENY) == 0) {
-		return lp_hostsdeny(s);
+		return lp_hostsdeny(s, lp_default_service(lp_ctx));
 	}
 
 	if (strcmp(opt_name, SHARE_NTVFS_HANDLER) == 0) {
-		return lp_ntvfs_handler(s);
+		return lp_ntvfs_handler(s, lp_default_service(lp_ctx));
 	}
 
 	DEBUG(0,("request for unknown share list option '%s'\n",
diff --git a/source4/param/share_ldb.c b/source4/param/share_ldb.c
index bdea94a5cd..fb40f1e9bf 100644
--- a/source4/param/share_ldb.c
+++ b/source4/param/share_ldb.c
@@ -1,7 +1,7 @@
 /* 
    Unix SMB/CIFS implementation.
    
-   LDB based services configuration
+   LDB based shares configuration
    
    Copyright (C) Simo Sorce	2006
    
diff --git a/source4/param/tests/loadparm.c b/source4/param/tests/loadparm.c
index 92871e043d..49fcdf7249 100644
--- a/source4/param/tests/loadparm.c
+++ b/source4/param/tests/loadparm.c
@@ -129,7 +129,7 @@ static bool test_lp_parm_bytes(struct torture_context *tctx)
 static bool test_lp_do_service_parameter(struct torture_context *tctx)
 {
 	struct loadparm_context *lp_ctx = loadparm_init(tctx);
-	struct loadparm_service *service = lp_add_service(lp_ctx, &sDefault, "foo");
+	struct loadparm_service *service = lp_add_service(lp_ctx, lp_default_service(lp_ctx), "foo");
 	torture_assert(tctx, lp_do_service_parameter(lp_ctx, service, 
 						     "some:thing", "foo"), "lp_set_option failed");
 	torture_assert_str_equal(tctx, lp_parm_string(lp_ctx, service, "some", "thing"), "foo",
@@ -140,7 +140,7 @@ static bool test_lp_do_service_parameter(struct torture_context *tctx)
 static bool test_lp_service(struct torture_context *tctx)
 {
 	struct loadparm_context *lp_ctx = loadparm_init(tctx);
-	struct loadparm_service *service = lp_add_service(lp_ctx, &sDefault, "foo");
+	struct loadparm_service *service = lp_add_service(lp_ctx, lp_default_service(lp_ctx), "foo");
 	torture_assert(tctx, service == lp_service(lp_ctx, "foo"), "invalid service");
 	return true;
 }
diff --git a/source4/rpc_server/config.mk b/source4/rpc_server/config.mk
index 0032a867d1..c2cf0e355a 100644
--- a/source4/rpc_server/config.mk
+++ b/source4/rpc_server/config.mk
@@ -3,8 +3,7 @@
 ################################################
 # Start SUBSYSTEM DCERPC_COMMON
 [SUBSYSTEM::DCERPC_COMMON]
-PUBLIC_PROTO_HEADER = common/proto.h
-PUBLIC_HEADERS = common/common.h
+PRIVATE_PROTO_HEADER = common/proto.h
 OBJ_FILES = \
 		common/server_info.o \
 		common/share_info.o
@@ -12,6 +11,8 @@ OBJ_FILES = \
 # End SUBSYSTEM DCERPC_COMMON
 ################################################
 
+PUBLIC_HEADERS += rpc_server/common/common.h
+
 ################################################
 # Start MODULE dcerpc_rpcecho
 [MODULE::dcerpc_rpcecho]
@@ -183,8 +184,7 @@ PRIVATE_DEPENDENCIES = \
 ################################################
 # Start SUBSYSTEM dcerpc_server
 [SUBSYSTEM::dcerpc_server]
-PUBLIC_HEADERS = dcerpc_server.h
-PUBLIC_PROTO_HEADER = dcerpc_server_proto.h
+PRIVATE_PROTO_HEADER = dcerpc_server_proto.h
 OBJ_FILES = \
 		dcerpc_server.o \
 		dcesrv_auth.o \
@@ -198,6 +198,8 @@ PRIVATE_DEPENDENCIES = \
 # End SUBSYSTEM DCERPC
 ################################################
 
+PUBLIC_HEADERS += rpc_server/dcerpc_server.h
+
 [MODULE::DCESRV]
 INIT_FUNCTION = server_service_rpc_init
 OBJ_FILES = service_rpc.o
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index b043424faa..6e53c7c8ae 100644
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -462,7 +462,7 @@ static NTSTATUS dcesrv_fault(struct dcesrv_call_state *call, uint32_t fault_code
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = ncacn_push_auth(&rep->blob, call, &pkt, NULL);
+	status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -501,7 +501,7 @@ static NTSTATUS dcesrv_bind_nak(struct dcesrv_call_state *call, uint32_t reason)
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = ncacn_push_auth(&rep->blob, call, &pkt, NULL);
+	status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, NULL);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -642,8 +642,7 @@ static NTSTATUS dcesrv_bind(struct dcesrv_call_state *call)
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = ncacn_push_auth(&rep->blob, call, &pkt, 
-				  call->conn->auth_state.auth_info);
+	status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, call->conn->auth_state.auth_info);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -787,8 +786,7 @@ static NTSTATUS dcesrv_alter(struct dcesrv_call_state *call)
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = ncacn_push_auth(&rep->blob, call, &pkt, 
-				  call->conn->auth_state.auth_info);
+	status = ncacn_push_auth(&rep->blob, call, lp_iconv_convenience(call->conn->dce_ctx->lp_ctx), &pkt, call->conn->auth_state.auth_info);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index dce775591b..75b13bb824 100644
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -402,7 +402,7 @@ bool dcesrv_auth_response(struct dcesrv_call_state *call,
 
 	/* non-signed packets are simple */
 	if (!dce_conn->auth_state.auth_info || !dce_conn->auth_state.gensec_security) {
-		status = ncacn_push_auth(blob, call, pkt, NULL);
+		status = ncacn_push_auth(blob, call, lp_iconv_convenience(dce_conn->dce_ctx->lp_ctx), pkt, NULL);
 		return NT_STATUS_IS_OK(status);
 	}
 
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 4d38dc069e..37e6351864 100644
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -27,6 +27,7 @@
 #include "auth/auth.h"
 #include "auth/auth_sam_reply.h"
 #include "dsdb/samdb/samdb.h"
+#include "dsdb/common/flags.h"
 #include "rpc_server/samr/proto.h"
 #include "util/util_ldb.h"
 #include "libcli/auth/libcli_auth.h"
@@ -76,7 +77,7 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3(struct dcesrv_call_state *dce_ca
 	struct creds_CredentialState *creds;
 	void *sam_ctx;
 	struct samr_Password *mach_pwd;
-	uint16_t acct_flags;
+	uint32_t user_account_control;
 	int num_records;
 	struct ldb_message **msgs;
 	NTSTATUS nt_status;
@@ -113,27 +114,28 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3(struct dcesrv_call_state *dce_ca
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
-	acct_flags = samdb_result_acct_flags(msgs[0], 
-					     "userAccountControl");
+	
+	user_account_control = ldb_msg_find_attr_as_uint(msgs[0], "userAccountControl", 0);
 
-	if (acct_flags & ACB_DISABLED) {
+	if (user_account_control & UF_ACCOUNTDISABLE) {
 		DEBUG(1, ("Account [%s] is disabled\n", r->in.account_name));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
 	if (r->in.secure_channel_type == SEC_CHAN_WKSTA) {
-		if (!(acct_flags & ACB_WSTRUST)) {
-			DEBUG(1, ("Client asked for a workstation secure channel, but is not a workstation (member server) acb flags: 0x%x\n", acct_flags));
+		if (!(user_account_control & UF_WORKSTATION_TRUST_ACCOUNT)) {
+			DEBUG(1, ("Client asked for a workstation secure channel, but is not a workstation (member server) acb flags: 0x%x\n", user_account_control));
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	} else if (r->in.secure_channel_type == SEC_CHAN_DOMAIN) {
-		if (!(acct_flags & ACB_DOMTRUST)) {
-			DEBUG(1, ("Client asked for a trusted domain secure channel, but is not a trusted domain: acb flags: 0x%x\n", acct_flags));
+		if (!(user_account_control & UF_INTERDOMAIN_TRUST_ACCOUNT)) {
+			DEBUG(1, ("Client asked for a trusted domain secure channel, but is not a trusted domain: acb flags: 0x%x\n", user_account_control));
+			
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	} else if (r->in.secure_channel_type == SEC_CHAN_BDC) {
-		if (!(acct_flags & ACB_SVRTRUST)) {
-			DEBUG(1, ("Client asked for a server secure channel, but is not a server (domain controller): acb flags: 0x%x\n", acct_flags));
+		if (!(user_account_control & UF_SERVER_TRUST_ACCOUNT)) {
+			DEBUG(1, ("Client asked for a server secure channel, but is not a server (domain controller): acb flags: 0x%x\n", user_account_control));
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	} else {
diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c
index 760d774f2e..8193e0a882 100644
--- a/source4/rpc_server/samr/dcesrv_samr.c
+++ b/source4/rpc_server/samr/dcesrv_samr.c
@@ -56,7 +56,7 @@
 #define QUERY_LHOURS(msg, field, attr) \
 	r->out.info->field = samdb_result_logon_hours(mem_ctx, msg, attr);
 #define QUERY_AFLAGS(msg, field, attr) \
-	r->out.info->field = samdb_result_acct_flags(msg, attr);
+	r->out.info->field = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, a_state->domain_state->domain_dn);
 
 
 /* these are used to make the Set[User|Group]Info code easier to follow */
@@ -102,10 +102,25 @@
         set_el = ldb_msg_find_element(msg, attr);			\
  	set_el->flags = LDB_FLAG_MOD_REPLACE;				\
 } while (0)								
-									
+
+#define CHECK_FOR_MULTIPLES(value, flag, poss_flags)	\
+	do { \
+		if ((value & flag) && ((value & flag) != (value & (poss_flags)))) { \
+			return NT_STATUS_INVALID_PARAMETER;		\
+		}							\
+	} while (0)							\
+	
+/* Set account flags, discarding flags that cannot be set with SAMR */								
 #define SET_AFLAGS(msg, field, attr) do {				\
 	struct ldb_message_element *set_el;				\
-	if (samdb_msg_add_acct_flags(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != 0) { \
+	if ((r->in.info->field & (ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST)) == 0) { \
+		return NT_STATUS_INVALID_PARAMETER; \
+	}								\
+	CHECK_FOR_MULTIPLES(r->in.info->field, ACB_NORMAL, ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST); \
+	CHECK_FOR_MULTIPLES(r->in.info->field, ACB_DOMTRUST, ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST); \
+	CHECK_FOR_MULTIPLES(r->in.info->field, ACB_WSTRUST, ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST); \
+	CHECK_FOR_MULTIPLES(r->in.info->field, ACB_SVRTRUST, ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST); \
+	if (samdb_msg_add_acct_flags(sam_ctx, mem_ctx, msg, attr, (r->in.info->field & ~(ACB_AUTOLOCK|ACB_PW_EXPIRED))) != 0) { \
 		return NT_STATUS_NO_MEMORY;				\
 	}								\
         set_el = ldb_msg_find_element(msg, attr);			\
@@ -1484,8 +1499,8 @@ static NTSTATUS dcesrv_samr_EnumDomainUsers(struct dcesrv_call_state *dce_call,
 	for (i=0;i<count;i++) {
 		/* Check if a mask has been requested */
 		if (r->in.acct_flags
-		    && ((samdb_result_acct_flags(res[i], 
-						 "userAccountControl") & r->in.acct_flags) == 0)) {
+		    && ((samdb_result_acct_flags(d_state->sam_ctx, mem_ctx, res[i], 
+						 d_state->domain_dn) & r->in.acct_flags) == 0)) {
 			continue;
 		}
 		entries[num_filtered_entries].idx = samdb_result_rid_from_sid(mem_ctx, res[i], "objectSid", 0);
@@ -3066,7 +3081,7 @@ static NTSTATUS dcesrv_samr_QueryUserInfo(struct dcesrv_call_state *dce_call, TA
 	}
 	case 16:
 	{
-		static const char * const attrs2[] = {"userAccountControl", NULL};
+		static const char * const attrs2[] = {"userAccountControl", "pwdLastSet", NULL};
 		attrs = attrs2;
 		break;
 	}
@@ -3613,7 +3628,7 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
 	struct ldb_message **res;
 	int ldb_cnt, count, i;
 	const char * const attrs[] = { "objectSid", "sAMAccountName", "displayName",
-					"description", "userAccountControl", NULL };
+				       "description", "userAccountControl", "pwdLastSet", NULL };
 	struct samr_DispEntryFull *entriesFull = NULL;
 	struct samr_DispEntryFullGroup *entriesFullGroup = NULL;
 	struct samr_DispEntryAscii *entriesAscii = NULL;
@@ -3702,8 +3717,9 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
 			entriesGeneral[count].rid = 
 				objectsid->sub_auths[objectsid->num_auths-1];
 			entriesGeneral[count].acct_flags =
-				samdb_result_acct_flags(res[i], 
-							"userAccountControl");
+				samdb_result_acct_flags(d_state->sam_ctx, mem_ctx,
+							res[i], 
+							d_state->domain_dn);
 			entriesGeneral[count].account_name.string =
 				samdb_result_string(res[i],
 						    "sAMAccountName", "");
@@ -3719,8 +3735,9 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
 
 			/* No idea why we need to or in ACB_NORMAL here, but this is what Win2k3 seems to do... */
 			entriesFull[count].acct_flags =
-				samdb_result_acct_flags(res[i], 
-							"userAccountControl") | ACB_NORMAL;
+				samdb_result_acct_flags(d_state->sam_ctx, mem_ctx,
+							res[i], 
+							d_state->domain_dn) | ACB_NORMAL;
 			entriesFull[count].account_name.string =
 				samdb_result_string(res[i], "sAMAccountName",
 						    "");
@@ -3731,9 +3748,6 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
 			entriesFullGroup[count].idx = count + 1;
 			entriesFullGroup[count].rid =
 				objectsid->sub_auths[objectsid->num_auths-1];
-			entriesFullGroup[count].acct_flags =
-				samdb_result_acct_flags(res[i], 
-							"userAccountControl");
 			/* We get a "7" here for groups */
 			entriesFullGroup[count].acct_flags
 				= SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED;
diff --git a/source4/rules.mk b/source4/rules.mk
index b6a54fae25..5f91f8132e 100644
--- a/source4/rules.mk
+++ b/source4/rules.mk
@@ -1,41 +1,27 @@
 # Dependencies command
 DEPENDS = $(CC) -M -MG -MP -MT $(<:.c=.o) -MT $@ \
-    $(CFLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
-    $(CPPFLAGS) $(FIRST_PREREQ) -o $@
+    $(CFLAGS) $(CPPFLAGS) $< -o $@
 # Dependencies for host objects
 HDEPENDS = $(CC) -M -MG -MP -MT $(<:.c=.ho) -MT $@ \
-    $(HOSTCC_FLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
-    $(CPPFLAGS) $(FIRST_PREREQ) -o $@
+    $(HOSTCC_FLAGS) $(CPPFLAGS) $< -o $@
 # Dependencies for precompiled headers
 PCHDEPENDS = $(CC) -M -MG -MT include/includes.h.gch -MT $@ \
-    $(CFLAGS) $(CPPFLAGS) $(FIRST_PREREQ) -o $@
-
-# $< is broken in older BSD versions:
-# when $@ is foo/bar.o, $< could be torture/foo/bar.c
-# if it also exists. So better use $* which is foo/bar
-# and append .c manually to get foo/bar.c
-#
-# If we have GNU Make, it is safe to use $<, which also lets
-# building with $srcdir != $builddir work.
+    $(CFLAGS) $(CPPFLAGS) $< -o $@
 
 # Run a static analysis checker
-CHECK = $(CC_CHECKER) $(CFLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
-    $(PICFLAG) $(CPPLAGS) -c $(FIRST_PREREQ) -o $@
+CHECK = $(CC_CHECKER) $(CFLAGS) $(PICFLAG) $(CPPLAGS) -c $< -o $@
 
 # Run the configured compiler
 COMPILE = $(CC) $(CFLAGS) $(PICFLAG) \
-          `$(PERL) $(srcdir)/script/cflags.pl $@` \
 		  $(CPPFLAGS) \
-		  -c $(FIRST_PREREQ) -o $@
+		  -c $< -o $@
 
 # Run the compiler for the build host
-HCOMPILE = $(HOSTCC) $(HOSTCC_FLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
-	 $(CPPFLAGS) -c $(FIRST_PREREQ) -o $@
+HCOMPILE = $(HOSTCC) $(HOSTCC_FLAGS) $(CPPFLAGS) -c $< -o $@
 
 # Precompile headers
 PCHCOMPILE = @$(CC) -Ilib/replace \
-    $(CFLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
-    $(PICFLAG) $(CPPFLAGS) -c $(FIRST_PREREQ) -o $@
+    $(CFLAGS) $(PICFLAG) $(CPPFLAGS) -c $< -o $@
 
 # Partial linking
 PARTLINK = @$(PROG_LD) -r
@@ -100,6 +86,13 @@ check:: test
 unused_macros:
 	$(srcdir)/script/find_unused_macros.pl `find . -name "*.[ch]"` | sort
 
+# Create a static library
+%.a:
+	@echo Linking $@
+	@rm -f $@
+	@mkdir -p $(@D)
+	@$(STLD) $(STLD_FLAGS) $@ $^
+
 ###############################################################################
 # File types
 ###############################################################################
@@ -127,9 +120,11 @@ include/includes.d: include/includes.h
 	@-mkdir -p `dirname $@`
 	@$(COMPILE) && exit 0 ; \
 		echo "The following command failed:" 1>&2;\
-		echo "$(COMPILE)" 1>&2;\
 		$(COMPILE) >/dev/null 2>&1
 
+
+#		echo "$(COMPILE)" 1>&2;\
+
 .c.ho:
 	@echo "Compiling $< with host compiler"
 	@-mkdir -p `dirname $@`
@@ -167,9 +162,6 @@ DOCBOOK_MANPAGE_URL = http://docbook.sourceforge.net/release/xsl/current/manpage
 .8.xml.8:
 	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
 
-DEP_FILES = $(patsubst %.ho,%.hd,$(patsubst %.o,%.d,$(ALL_OBJS))) \
-		   include/includes.d
-
 dist:: idl_full manpages configure distclean 
 
 configure: 
diff --git a/source4/script/cflags.pl b/source4/script/cflags.pl
deleted file mode 100755
index 37b5aa7e71..0000000000
--- a/source4/script/cflags.pl
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env perl
-
-# This is a hack to allow per target cflags. It isn't very elegant, but it
-# is the most portable idea we have come up with yet
-# tridge@samba.org, July 2005
-# jelmer@samba.org, March 2006
-use strict;
-
-my $target = shift;
-
-my $vars = {};
-
-sub check_flags($$);
-sub check_flags($$)
-{
-	my ($path, $name)=@_;
-	open (IN, $path);
-	foreach my $line (<IN>) {
-		if ($line =~ /^include (.*)$/) {
-			check_flags($1, $name);
-		} elsif ($line =~ /^([A-Za-z0-9_]+) =(.*)$/) {
-			$vars->{$1} = $2;
-		} elsif ($line =~ /^([^:]+): (.*)$/) {
-			next unless (grep(/^$target$/, (split / /, $1)));
-			my $data = $2;
-			$data =~ s/^CFLAGS\+=//;
-			foreach my $key (keys %$vars) {
-				my $val = $vars->{$key};
-				$data =~ s/\$\($key\)/$val/g;
-			}
-			# Remove undefined variables
-			$data =~ s/\$\([A-Za-z0-9_]+\)//g;
-			print "$data ";
-		}
-	}
-	close(IN);
-}
-
-check_flags("extra_cflags.txt", $target);
-print "\n";
-
-exit 0;
diff --git a/source4/script/mkproto.pl b/source4/script/mkproto.pl
index 3ed845e2bb..87a68e33fa 100755
--- a/source4/script/mkproto.pl
+++ b/source4/script/mkproto.pl
@@ -144,7 +144,7 @@ sub handle_loadparm($$)
 
 		my %smap = (
 			    "GLOBAL" => "struct loadparm_context *",
-			    "LOCAL" => "struct loadparm_service *"
+			    "LOCAL" => "struct loadparm_service *, struct loadparm_service *"
 			    );
 
 		$file->("$tmap{$type}$name($smap{$scope});\n");
@@ -157,7 +157,9 @@ sub process_file($$$)
 
 	$filename =~ s/\.o$/\.c/g;
 
-	if (!open(FH, "< $builddir/$filename")) {
+	if ($filename =~ /^\//) {
+		open(FH, "<$filename") or die("Failed to open $filename");
+	} elsif (!open(FH, "< $builddir/$filename")) {
 	    open(FH, "< $srcdir/$filename") || die "Failed to open $filename";
 	}
 
diff --git a/source4/scripting/ejs/ejsnet/net_ctx.c b/source4/scripting/ejs/ejsnet/net_ctx.c
index 396718367a..99be1c4ef8 100644
--- a/source4/scripting/ejs/ejsnet/net_ctx.c
+++ b/source4/scripting/ejs/ejsnet/net_ctx.c
@@ -52,7 +52,7 @@ static int ejs_net_context(MprVarHandle eid, int argc, struct MprVar **argv)
 	}
 	ev = event_context_find(event_mem_ctx);
 
-	ctx = libnet_context_init(ev, global_loadparm);
+	ctx = libnet_context_init(ev, mprLpCtx());
 	/* IF we generated a new event context, it will be under here,
 	 * and we need it to last as long as the libnet context, so
 	 * make it a child */
@@ -68,7 +68,7 @@ static int ejs_net_context(MprVarHandle eid, int argc, struct MprVar **argv)
 			talloc_free(ctx);
 			return -1;
 		}
-		cli_credentials_set_conf(creds, global_loadparm);
+		cli_credentials_set_conf(creds, mprLpCtx());
 		cli_credentials_set_anonymous(creds);
 
 		mprCreds = mprCredentials(creds);
diff --git a/source4/scripting/ejs/smbcalls.c b/source4/scripting/ejs/smbcalls.c
index 1f29fce002..63a80e17db 100644
--- a/source4/scripting/ejs/smbcalls.c
+++ b/source4/scripting/ejs/smbcalls.c
@@ -111,7 +111,7 @@ static int ejs_typeof_native(MprVarHandle eid, int argc, struct MprVar **argv)
 static int ejs_libinclude(int eid, int argc, char **argv)
 {
 	int i, j;
-	const char **js_include = lp_js_include(global_loadparm);
+	const char **js_include = lp_js_include(mprLpCtx());
 
 	if (js_include == NULL || js_include[0] == NULL) {
 		ejsSetErrorMsg(eid, "js include path not set");
@@ -184,7 +184,7 @@ void smb_setup_ejs_functions(void (*exception_handler)(const char *))
 	smb_setup_ejs_param();
         smb_setup_ejs_literal();
 	
-	shared_init = load_samba_modules(NULL, global_loadparm, "smbcalls");
+	shared_init = load_samba_modules(NULL, mprLpCtx(), "smbcalls");
 	
 	run_init_functions(static_init);
 	run_init_functions(shared_init);
diff --git a/source4/scripting/ejs/smbcalls_auth.c b/source4/scripting/ejs/smbcalls_auth.c
index 89370890c8..908a009159 100644
--- a/source4/scripting/ejs/smbcalls_auth.c
+++ b/source4/scripting/ejs/smbcalls_auth.c
@@ -56,14 +56,14 @@ static int ejs_doauth(MprVarHandle eid,
 	} else {
 		/* Hope we can find the event context somewhere up there... */
 		ev = event_context_find(tmp_ctx);
-		msg = messaging_client_init(tmp_ctx, lp_messaging_path(tmp_ctx, global_loadparm), 
-					    lp_iconv_convenience(global_loadparm), ev);
+		msg = messaging_client_init(tmp_ctx, lp_messaging_path(tmp_ctx, mprLpCtx()), 
+					    lp_iconv_convenience(mprLpCtx()), ev);
 	}
 
 	if (auth_types) {
-		nt_status = auth_context_create_methods(tmp_ctx, auth_types, ev, msg, global_loadparm, &auth_context);
+		nt_status = auth_context_create_methods(tmp_ctx, auth_types, ev, msg, mprLpCtx(), &auth_context);
 	} else {
-		nt_status = auth_context_create(tmp_ctx, ev, msg, global_loadparm, &auth_context);
+		nt_status = auth_context_create(tmp_ctx, ev, msg, mprLpCtx(), &auth_context);
 	}
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		mprSetPropertyValue(auth, "result", mprCreateBoolVar(false));
@@ -109,7 +109,7 @@ static int ejs_doauth(MprVarHandle eid,
 		goto done;
 	}
 
-	nt_status = auth_generate_session_info(tmp_ctx, global_loadparm, server_info, &session_info);
+	nt_status = auth_generate_session_info(tmp_ctx, mprLpCtx(), server_info, &session_info);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		mprSetPropertyValue(auth, "report", mprString("Session Info generation failed"));
 		mprSetPropertyValue(auth, "result", mprCreateBoolVar(false));
@@ -222,7 +222,7 @@ static int ejs_userAuth(MprVarHandle eid, int argc, struct MprVar **argv)
 static int ejs_system_session(MprVarHandle eid, int argc, struct MprVar **argv)
 {
 	struct MprVar *obj = mprInitObject(eid, "session_info", argc, argv);
-	struct auth_session_info *session_info = system_session(mprMemCtx(), global_loadparm);
+	struct auth_session_info *session_info = system_session(mprMemCtx(), mprLpCtx());
 
 	if (session_info == NULL) {
 		return -1;
diff --git a/source4/scripting/ejs/smbcalls_cli.c b/source4/scripting/ejs/smbcalls_cli.c
index 8295a0879f..dbb36312da 100644
--- a/source4/scripting/ejs/smbcalls_cli.c
+++ b/source4/scripting/ejs/smbcalls_cli.c
@@ -432,23 +432,23 @@ static int ejs_tree_connect(MprVarHandle eid, int argc, char **argv)
 	/* Set up credentials */
 
 	creds = cli_credentials_init(NULL);
-	cli_credentials_set_conf(creds, global_loadparm);
+	cli_credentials_set_conf(creds, mprLpCtx());
 	cli_credentials_parse_string(creds, argv[1], CRED_SPECIFIED);
 
 	/* Do connect */
 
 	io.in.dest_host              = hostname;
-	io.in.dest_ports             = lp_smb_ports(global_loadparm);
+	io.in.dest_ports             = lp_smb_ports(mprLpCtx());
 	io.in.called_name            = strupper_talloc(mem_ctx, hostname);
 	io.in.service                = sharename;
 	io.in.service_type           = "?????";
 	io.in.credentials            = creds;
 	io.in.fallback_to_anonymous  = false;
-	io.in.workgroup              = lp_workgroup(global_loadparm);
-	lp_smbcli_options(global_loadparm, &io.in.options);
+	io.in.workgroup              = lp_workgroup(mprLpCtx());
+	lp_smbcli_options(mprLpCtx(), &io.in.options);
 
 	result = smb_composite_connect(&io, mem_ctx, 
-				       lp_resolve_context(global_loadparm), 
+				       lp_resolve_context(mprLpCtx()), 
 				       NULL);
 	tree = io.out.tree;
 
diff --git a/source4/scripting/ejs/smbcalls_config.c b/source4/scripting/ejs/smbcalls_config.c
index 07e0f479da..eb673b3a23 100644
--- a/source4/scripting/ejs/smbcalls_config.c
+++ b/source4/scripting/ejs/smbcalls_config.c
@@ -36,8 +36,8 @@ static int ejs_lpServices(MprVarHandle eid, int argc, char **argv)
 	const char **list = NULL;
 	if (argc != 0) return -1;
 	
-	for (i=0;i<lp_numservices(global_loadparm);i++) {
-		list = str_list_add(list, lp_servicename(lp_servicebynum(global_loadparm, i)));
+	for (i=0;i<lp_numservices(mprLpCtx());i++) {
+		list = str_list_add(list, lp_servicename(lp_servicebynum(mprLpCtx(), i)));
 	}
 	talloc_steal(mprMemCtx(), list);
 	mpr_Return(eid, mprList("services", list));
@@ -68,7 +68,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 	if (argc == 2) {
 		struct loadparm_service *service;
 		/* its a share parameter */
-		service = lp_service(global_loadparm, argv[0]);
+		service = lp_service(mprLpCtx(), argv[0]);
 		if (service == NULL) {
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
@@ -84,7 +84,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 				mpr_Return(eid, mprCreateUndefinedVar());
 				return 0;
 			}
-			value = lp_get_parametric(global_loadparm, service, type, option);
+			value = lp_get_parametric(mprLpCtx(), service, type, option);
 			if (value == NULL) {
 				mpr_Return(eid, mprCreateUndefinedVar());
 				return 0;
@@ -98,7 +98,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
 		}
-		parm_ptr = lp_parm_ptr(global_loadparm, service, parm);
+		parm_ptr = lp_parm_ptr(mprLpCtx(), service, parm);
 	} else if (strchr(argv[0], ':')) {
 		/* its a global parametric option */
 		const char *type = talloc_strndup(mprMemCtx(), 
@@ -109,7 +109,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
 		}
-		value = lp_get_parametric(global_loadparm, NULL, type, option);
+		value = lp_get_parametric(mprLpCtx(), NULL, type, option);
 		if (value == NULL) {
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
@@ -123,7 +123,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 			mpr_Return(eid, mprCreateUndefinedVar());
 			return 0;
 		}
-		parm_ptr = lp_parm_ptr(global_loadparm, NULL, parm);
+		parm_ptr = lp_parm_ptr(mprLpCtx(), NULL, parm);
 	}
 
 	if (parm == NULL || parm_ptr == NULL) {
@@ -166,7 +166,7 @@ static int ejs_lpGet(MprVarHandle eid, int argc, char **argv)
 */
 static int ejs_lpFilename(MprVarHandle eid, int argc, char **argv)
 {
-	mpr_ReturnString(eid, lp_configfile(global_loadparm));
+	mpr_ReturnString(eid, lp_configfile(mprLpCtx()));
 	return 0;
 }
 
@@ -184,7 +184,7 @@ static int ejs_lpSet(MprVarHandle eid, int argc, char **argv)
 		return -1;
 	}
 
-	mpr_Return(eid, mprCreateBoolVar(lp_set_cmdline(global_loadparm, argv[0], argv[1])));
+	mpr_Return(eid, mprCreateBoolVar(lp_set_cmdline(mprLpCtx(), argv[0], argv[1])));
 	return 0;
 }
 
@@ -196,9 +196,9 @@ static int ejs_lpSet(MprVarHandle eid, int argc, char **argv)
 static int ejs_lpReload(MprVarHandle eid, int argc, char **argv)
 {
 	bool ret;
-	const char *filename = lp_configfile(global_loadparm);
+	const char *filename = lp_configfile(mprLpCtx());
 
-	ret = lp_load(global_loadparm, filename);
+	ret = lp_load(mprLpCtx(), filename);
 	mpr_Return(eid, mprCreateBoolVar(ret));
 	return 0;
 }
diff --git a/source4/scripting/ejs/smbcalls_creds.c b/source4/scripting/ejs/smbcalls_creds.c
index 6dfff8f925..fd73f0751f 100644
--- a/source4/scripting/ejs/smbcalls_creds.c
+++ b/source4/scripting/ejs/smbcalls_creds.c
@@ -192,7 +192,7 @@ static int ejs_creds_set_machine_account(MprVarHandle eid, int argc, struct MprV
 		return -1;
 	}
 	
-	if (NT_STATUS_IS_OK(cli_credentials_set_machine_account(creds, global_loadparm))) {
+	if (NT_STATUS_IS_OK(cli_credentials_set_machine_account(creds, mprLpCtx()))) {
 		mpr_Return(eid, mprCreateBoolVar(true));
 	} else {
 		mpr_Return(eid, mprCreateBoolVar(false));
@@ -248,7 +248,7 @@ static int ejs_credentials_init(MprVarHandle eid, int argc, struct MprVar **argv
 		return -1;
 	}
 
-	cli_credentials_set_conf(creds, global_loadparm);
+	cli_credentials_set_conf(creds, mprLpCtx());
 
 	return ejs_credentials_obj(obj, creds);
 }
diff --git a/source4/scripting/ejs/smbcalls_data.c b/source4/scripting/ejs/smbcalls_data.c
index 3ea41d46fb..19e1e173d6 100644
--- a/source4/scripting/ejs/smbcalls_data.c
+++ b/source4/scripting/ejs/smbcalls_data.c
@@ -177,7 +177,7 @@ static int ejs_regToVar(MprVarHandle eid, int argc, struct MprVar **argv)
 	case REG_EXPAND_SZ: {
 		char *s;
 		ssize_t len;
-		len = convert_string_talloc(mprMemCtx(), lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX, 
+		len = convert_string_talloc(mprMemCtx(), lp_iconv_convenience(mprLpCtx()), CH_UTF16, CH_UNIX, 
 					    blob->data, blob->length, (void **)&s);
 		if (len == -1) {
 			ejsSetErrorMsg(eid, "regToVar invalid REG_SZ string");
@@ -225,7 +225,7 @@ static int ejs_regToVar(MprVarHandle eid, int argc, struct MprVar **argv)
 			if (slen == 2 && b.length == 2 && SVAL(b.data, 0) == 0) {
 				break;
 			}
-			len = convert_string_talloc(mprMemCtx(), lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX, 
+			len = convert_string_talloc(mprMemCtx(), lp_iconv_convenience(mprLpCtx()), CH_UTF16, CH_UNIX, 
 						    b.data, slen, (void **)&s);
 			if (len == -1) {
 				ejsSetErrorMsg(eid, "regToVar invalid REG_MULTI_SZ string");
diff --git a/source4/scripting/ejs/smbcalls_ldb.c b/source4/scripting/ejs/smbcalls_ldb.c
index 7599cbf443..f47920b9bb 100644
--- a/source4/scripting/ejs/smbcalls_ldb.c
+++ b/source4/scripting/ejs/smbcalls_ldb.c
@@ -453,7 +453,7 @@ static int ejs_ldbConnect(MprVarHandle eid, int argc, char **argv)
 
 	dbfile = argv[0];
 
-	ldb = ldb_wrap_connect(mprMemCtx(), global_loadparm, dbfile, 
+	ldb = ldb_wrap_connect(mprMemCtx(), mprLpCtx(), dbfile, 
 			       session_info, creds,
 			       0, (const char **)(argv+1));
 	if (ldb == NULL) {
diff --git a/source4/scripting/ejs/smbcalls_nbt.c b/source4/scripting/ejs/smbcalls_nbt.c
index c3679b1ec7..67a85414ca 100644
--- a/source4/scripting/ejs/smbcalls_nbt.c
+++ b/source4/scripting/ejs/smbcalls_nbt.c
@@ -70,7 +70,7 @@ static int ejs_resolve_name(MprVarHandle eid, int argc, struct MprVar **argv)
 
 	result = 0;
 
-	nt_status = resolve_name(lp_resolve_context(global_loadparm), &name, tmp_ctx, &reply_addr, event_context_find(tmp_ctx));
+	nt_status = resolve_name(lp_resolve_context(mprLpCtx()), &name, tmp_ctx, &reply_addr, event_context_find(tmp_ctx));
 
 	if (NT_STATUS_IS_OK(nt_status)) {
 		mprSetPropertyValue(argv[0], "value", mprString(reply_addr));
diff --git a/source4/scripting/ejs/smbcalls_reg.c b/source4/scripting/ejs/smbcalls_reg.c
index 30e5357cfb..e20d91ad2e 100644
--- a/source4/scripting/ejs/smbcalls_reg.c
+++ b/source4/scripting/ejs/smbcalls_reg.c
@@ -70,7 +70,7 @@ static int ejs_reg_open(MprVarHandle eid, int argc, struct MprVar **argv)
 	struct registry_context *rctx;
 	WERROR error;
 
-	error = reg_open_samba(mprMemCtx(), &rctx, global_loadparm, NULL, NULL);
+	error = reg_open_samba(mprMemCtx(), &rctx, mprLpCtx(), NULL, NULL);
 	SMB_ASSERT(W_ERROR_IS_OK(error));
 
 	mprSetPtrChild(reg, "registry", rctx);
diff --git a/source4/scripting/ejs/smbcalls_rpc.c b/source4/scripting/ejs/smbcalls_rpc.c
index 44cfa16d7e..d1e49b4348 100644
--- a/source4/scripting/ejs/smbcalls_rpc.c
+++ b/source4/scripting/ejs/smbcalls_rpc.c
@@ -79,9 +79,9 @@ static int ejs_irpc_connect(MprVarHandle eid, int argc, char **argv)
 	   allocate temporary server ids automatically */
 	for (i=0;i<10000;i++) {
 		p->msg_ctx = messaging_init(p, 
-					    lp_messaging_path(p, global_loadparm),
+					    lp_messaging_path(p, mprLpCtx()),
 					    cluster_id(EJS_ID_BASE, i), 
-				            lp_iconv_convenience(global_loadparm),
+				            lp_iconv_convenience(mprLpCtx()),
 					    ev);
 		if (p->msg_ctx) break;
 	}
@@ -161,7 +161,7 @@ static int ejs_rpc_connect(MprVarHandle eid, int argc, char **argv)
 	ev = event_context_find(mprMemCtx());
 
 	status = dcerpc_pipe_connect(this, &p, binding, iface, creds, ev,
-				     global_loadparm);
+				     mprLpCtx());
 	if (!NT_STATUS_IS_OK(status)) goto done;
 
 	/* callers don't allocate ref vars in the ejs interface */
diff --git a/source4/scripting/ejs/smbcalls_sys.c b/source4/scripting/ejs/smbcalls_sys.c
index 72ddf90231..00599a55bc 100644
--- a/source4/scripting/ejs/smbcalls_sys.c
+++ b/source4/scripting/ejs/smbcalls_sys.c
@@ -36,7 +36,7 @@ static int ejs_sys_interfaces(MprVarHandle eid, int argc, struct MprVar **argv)
 	struct MprVar ret = mprArray("interfaces");
 	struct interface *ifaces;
 
-	load_interfaces(NULL, lp_interfaces(global_loadparm), &ifaces);
+	load_interfaces(NULL, lp_interfaces(mprLpCtx()), &ifaces);
 
 	count = iface_count(ifaces);
 	for (i=0;i<count;i++) {
diff --git a/source4/scripting/python/config.mk b/source4/scripting/python/config.mk
index b15e1fcda7..a16d737344 100644
--- a/source4/scripting/python/config.mk
+++ b/source4/scripting/python/config.mk
@@ -25,7 +25,6 @@ swig:: pythonmods
 
 realdistclean::
 	@echo "Removing SWIG output files"
-	@-rm -f bin/python/*
 	# FIXME: Remove _wrap.c files
 
 pythonmods:: $(PYTHON_DSOS) $(PYTHON_PYS)
@@ -35,6 +34,10 @@ PYDOCTOR_MODULES=bin/python/ldb.py bin/python/auth.py bin/python/credentials.py
 pydoctor:: pythonmods
 	LD_LIBRARY_PATH=bin/shared PYTHONPATH=bin/python pydoctor --project-name=Samba --make-html --docformat=restructuredtext --add-package scripting/python/samba/ $(addprefix --add-module , $(PYDOCTOR_MODULES))
 
+bin/python/%.py: 
+	mkdir -p $(@D)
+	cp $< $@
+
 installpython:: pythonmods
 	@$(SHELL) $(srcdir)/script/installpython.sh \
 		$(INSTALLPERMS) \
@@ -43,4 +46,4 @@ installpython:: pythonmods
 
 clean::
 	@echo "Removing python modules"
-	@rm -f bin/python/*
+	@rm -rf bin/python/*
diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py
index e3c47ff4a2..55935b0037 100644
--- a/source4/scripting/python/samba/provision.py
+++ b/source4/scripting/python/samba/provision.py
@@ -313,9 +313,9 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
                     "server_sort",
                     "extended_dn",
                     "asq",
-                    "samldb",
                     "rdn_name",
                     "objectclass",
+                    "samldb",
                     "kludge_acl",
                     "operational"]
     tdb_modules_list = [
diff --git a/source4/selftest/samba4_tests.sh b/source4/selftest/samba4_tests.sh
index 32386e5b9e..bea4173555 100755
--- a/source4/selftest/samba4_tests.sh
+++ b/source4/selftest/samba4_tests.sh
@@ -81,6 +81,7 @@ if grep ENABLE_GNUTLS.1 include/config.h > /dev/null; then
 	plantest "ldb.ldaps with options $options" dc $samba4srcdir/../testprogs/blackbox/test_ldb.sh ldaps \$SERVER_IP $options
     done
 fi
+plantest "ldb.ldapi with options $options" dc $samba4srcdir/../testprogs/blackbox/test_ldb.sh ldapi \$PREFIX_ABS/dc/private/ldapi $options
 for t in LDAP-CLDAP LDAP-BASIC LDAP-SCHEMA LDAP-UPTODATEVECTOR
 do
 	plansmbtorturetest "$t" dc "-U\$USERNAME%\$PASSWORD" //\$SERVER_IP/_none_
diff --git a/source4/setup/provision.reg b/source4/setup/provision.reg
index 892b5ec50c..b80db09c09 100644
--- a/source4/setup/provision.reg
+++ b/source4/setup/provision.reg
@@ -2,37 +2,46 @@ REGEDIT4
 
 [HKEY_LOCAL_MACHINE]
 
-[HKEY_LOCAL_MACHINE\System]
+[HKEY_LOCAL_MACHINE\SOFTWARE]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet]
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control]
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ProductOptions]
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
+CurrentVersion=5.2
+
+[HKEY_LOCAL_MACHINE\SYSTEM]
+
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet]
+
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
+
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions]
 ProductType=LanmanNT
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]
 
-[HKEY_LOCAL_MACHINE\System]
+[HKEY_LOCAL_MACHINE\SYSTEM]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]
 RefusePasswordChange=REG_DWORD:0
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\REPLICATOR]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\REPLICATOR]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\REPLICATOR\Parameters]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\REPLICATOR\Parameters]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Alerter]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter]
 
-[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Alerter\Parameters]
+[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter\Parameters]
 
 [HKEY_USERS]
 
diff --git a/source4/setup/provision_self_join.ldif b/source4/setup/provision_self_join.ldif
index 58669660f4..503656a9bf 100644
--- a/source4/setup/provision_self_join.ldif
+++ b/source4/setup/provision_self_join.ldif
@@ -8,7 +8,6 @@ localPolicyFlags: 0
 primaryGroupID: 516
 accountExpires: 9223372036854775807
 sAMAccountName: ${NETBIOSNAME}$
-sAMAccountType: 805306369
 operatingSystem: Samba
 operatingSystemVersion: 4.0
 dNSHostName: ${DNSNAME}
@@ -33,7 +32,6 @@ description: DNS Service Account
 userAccountControl: 514
 accountExpires: 9223372036854775807
 sAMAccountName: dns
-sAMAccountType: 805306368
 servicePrincipalName: DNS/${DNSDOMAIN}
 isCriticalSystemObject: TRUE
 sambaPassword:: ${DNSPASS_B64}
diff --git a/source4/setup/provision_templates.ldif b/source4/setup/provision_templates.ldif
index fafedc6966..cc0ab212cd 100644
--- a/source4/setup/provision_templates.ldif
+++ b/source4/setup/provision_templates.ldif
@@ -18,7 +18,7 @@ objectClass: container
 description: Container for SAM account templates
 
 dn: CN=TemplateUser,CN=Templates
-userAccountControl: 514
+userAccountControl: 546
 badPwdCount: 0
 codePage: 0
 countryCode: 0
@@ -29,21 +29,6 @@ pwdLastSet: 0
 primaryGroupID: 513
 accountExpires: -1
 logonCount: 0
-sAMAccountType: 805306368
-
-dn: CN=TemplateComputer,CN=Templates
-userAccountControl: 4098
-badPwdCount: 0
-codePage: 0
-countryCode: 0
-badPasswordTime: 0
-lastLogoff: 0
-lastLogon: 0
-pwdLastSet: 0
-primaryGroupID: 513
-accountExpires: -1
-logonCount: 0
-sAMAccountType: 805306369
 
 dn: CN=TemplateTrustingDomain,CN=Templates
 userAccountControl: 2080
@@ -56,18 +41,9 @@ lastLogon: 0
 primaryGroupID: 513
 accountExpires: -1
 logonCount: 0
-sAMAccountType: 805306370
 
 dn: CN=TemplateGroup,CN=Templates
 groupType: -2147483646
-sAMAccountType: 268435456
-
-# Currently this isn't used, we don't have a way to detect it different from an incoming alias
-#
-# dn: CN=TemplateAlias,CN=Templates
-# cn: TemplateAlias
-# groupType: -2147483644
-# sAMAccountType: 268435456
 
 dn: CN=TemplateForeignSecurityPrincipal,CN=Templates
 
diff --git a/source4/setup/provision_users.ldif b/source4/setup/provision_users.ldif
index 05fde15974..4b053d9166 100644
--- a/source4/setup/provision_users.ldif
+++ b/source4/setup/provision_users.ldif
@@ -44,7 +44,6 @@ objectSid: ${DOMAINSID}-502
 adminCount: 1
 accountExpires: 9223372036854775807
 sAMAccountName: krbtgt
-sAMAccountType: 805306368
 servicePrincipalName: kadmin/changepw
 isCriticalSystemObject: TRUE
 sambaPassword:: ${KRBTGTPASS_B64}
@@ -85,7 +84,6 @@ objectClass: group
 cn: Cert Publishers
 description: Members of this group are permitted to publish certificates to the Active Directory
 groupType: 2147483652
-sAMAccountType: 536870912
 objectSid: ${DOMAINSID}-517
 sAMAccountName: Cert Publishers
 isCriticalSystemObject: TRUE
@@ -136,7 +134,6 @@ cn: RAS and IAS Servers
 description: Servers in this group can access remote access properties of users
 objectSid: ${DOMAINSID}-553
 sAMAccountName: RAS and IAS Servers
-sAMAccountType: 536870912
 groupType: 2147483652
 isCriticalSystemObject: TRUE
 
@@ -151,7 +148,6 @@ member: CN=Administrator,CN=Users,${DOMAINDN}
 objectSid: S-1-5-32-544
 adminCount: 1
 sAMAccountName: Administrators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -188,7 +184,6 @@ description: Users are prevented from making accidental or intentional system-wi
 member: CN=Domain Users,CN=Users,${DOMAINDN}
 objectSid: S-1-5-32-545
 sAMAccountName: Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -202,7 +197,6 @@ member: CN=Domain Guests,CN=Users,${DOMAINDN}
 member: CN=Guest,CN=Users,${DOMAINDN}
 objectSid: S-1-5-32-546
 sAMAccountName: Guests
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -215,7 +209,6 @@ description: Members can administer domain printers
 objectSid: S-1-5-32-550
 adminCount: 1
 sAMAccountName: Print Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -231,7 +224,6 @@ description: Backup Operators can override security restrictions for the sole pu
 objectSid: S-1-5-32-551
 adminCount: 1
 sAMAccountName: Backup Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -248,7 +240,6 @@ description: Supports file replication in a domain
 objectSid: S-1-5-32-552
 adminCount: 1
 sAMAccountName: Replicator
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -260,7 +251,6 @@ cn: Remote Desktop Users
 description: Members in this group are granted the right to logon remotely
 objectSid: S-1-5-32-555
 sAMAccountName: Remote Desktop Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -272,7 +262,6 @@ cn: Network Configuration Operators
 description: Members in this group can have some administrative privileges to manage configuration of networking features
 objectSid: S-1-5-32-556
 sAMAccountName: Network Configuration Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -284,7 +273,6 @@ cn: Performance Monitor Users
 description: Members of this group have remote access to monitor this computer
 objectSid: S-1-5-32-558
 sAMAccountName: Performance Monitor Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -296,7 +284,6 @@ cn: Performance Log Users
 description: Members of this group have remote access to schedule logging of performance counters on this computer
 objectSid: S-1-5-32-559
 sAMAccountName: Performance Log Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -309,7 +296,6 @@ description: Members can administer domain servers
 objectSid: S-1-5-32-549
 adminCount: 1
 sAMAccountName: Server Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -328,7 +314,6 @@ description: Members can administer domain user and group accounts
 objectSid: S-1-5-32-548
 adminCount: 1
 sAMAccountName: Account Operators
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -341,7 +326,6 @@ cn: Pre-Windows 2000 Compatible Access
 description: A backward compatibility group which allows read access on all users and groups in the domain
 objectSid: S-1-5-32-554
 sAMAccountName: Pre-Windows 2000 Compatible Access
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -355,7 +339,6 @@ cn: Incoming Forest Trust Builders
 description: Members of this group can create incoming, one-way trusts to this forest
 objectSid: S-1-5-32-557
 sAMAccountName: Incoming Forest Trust Builders
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -367,7 +350,6 @@ cn: Windows Authorization Access Group
 description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
 objectSid: S-1-5-32-560
 sAMAccountName: Windows Authorization Access Group
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -379,7 +361,6 @@ cn: Terminal Server License Servers
 description: Terminal Server License Servers
 objectSid: S-1-5-32-561
 sAMAccountName: Terminal Server License Servers
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
@@ -391,7 +372,6 @@ cn: Distributed COM Users
 description: Members are allowed to launch, activate and use Distributed COM objects on this machine.
 objectSid: S-1-5-32-562
 sAMAccountName: Distributed COM Users
-sAMAccountType: 536870912
 systemFlags: 2348810240
 groupType: 2147483653
 isCriticalSystemObject: TRUE
diff --git a/source4/smb_server/smb/request.c b/source4/smb_server/smb/request.c
index d7f3793f23..87073517dd 100644
--- a/source4/smb_server/smb/request.c
+++ b/source4/smb_server/smb/request.c
@@ -423,7 +423,7 @@ size_t req_push_str(struct smbsrv_request *req, uint8_t *dest, const char *str,
 		dest = req->out.buffer + PTR_DIFF(dest, buf0);
 	}
 
-	len = push_string(lp_iconv_convenience(global_loadparm), dest, str, len, flags);
+	len = push_string(lp_iconv_convenience(req->smb_conn->lp_ctx), dest, str, len, flags);
 
 	grow_size = len + PTR_DIFF(dest, req->out.data);
 
diff --git a/source4/smb_server/smb_server.c b/source4/smb_server/smb_server.c
index 9a8a8cf5c4..4f8e628f74 100644
--- a/source4/smb_server/smb_server.c
+++ b/source4/smb_server/smb_server.c
@@ -146,7 +146,7 @@ static void smbsrv_accept(struct stream_connection *conn)
 	packet_set_fde(smb_conn->packet, conn->event.fde);
 	packet_set_serialise(smb_conn->packet);
 
-	smb_conn->lp_ctx = global_loadparm;
+	smb_conn->lp_ctx = conn->lp_ctx;
 	smb_conn->connection = conn;
 	conn->private = smb_conn;
 
@@ -253,5 +253,6 @@ failed:
 /* called at smbd startup - register ourselves as a server service */
 NTSTATUS server_service_smb_init(void)
 {
+	share_init();
 	return register_server_service("smb", smbsrv_task_init);
 }
diff --git a/source4/smbd/config.mk b/source4/smbd/config.mk
index c4d1070992..2482780756 100644
--- a/source4/smbd/config.mk
+++ b/source4/smbd/config.mk
@@ -27,7 +27,6 @@ PRIVATE_PROTO_HEADER = pidfile.h
 # Start BINARY smbd
 [BINARY::smbd]
 INSTALLDIR = SBINDIR
-MANPAGE = smbd.8
 OBJ_FILES = \
 		server.o
 PRIVATE_DEPENDENCIES = \
@@ -44,5 +43,7 @@ PRIVATE_DEPENDENCIES = \
 		ntvfs \
 		share \
 		CLUSTER
+
+MANPAGES += smbd/smbd.8
 # End BINARY smbd
 #################################
diff --git a/source4/smbd/server.c b/source4/smbd/server.c
index fdeb541576..fe38a4e5ab 100644
--- a/source4/smbd/server.c
+++ b/source4/smbd/server.c
@@ -282,8 +282,6 @@ static int binary_smbd_main(const char *binary_name, int argc, const char *argv[
 		exit(1);
 	}
 
-	share_init();
-
 	gensec_init(cmdline_lp_ctx); /* FIXME: */
 
 	ntptr_init(cmdline_lp_ctx);	/* FIXME: maybe run this in the initialization function 
diff --git a/source4/smbd/service_stream.c b/source4/smbd/service_stream.c
index 7e1f6493ee..9f744efa81 100644
--- a/source4/smbd/service_stream.c
+++ b/source4/smbd/service_stream.c
@@ -174,10 +174,11 @@ static void stream_new_connection(struct event_context *ev,
 	srv_conn->server_id	= server_id;
 	srv_conn->ops           = stream_socket->ops;
 	srv_conn->event.ctx	= ev;
+	srv_conn->lp_ctx	= lp_ctx;
 	srv_conn->event.fde	= event_add_fd(ev, srv_conn, socket_get_fd(sock),
 					       0, stream_io_handler_fde, srv_conn);
 
-	if (!socket_check_access(sock, "smbd", lp_hostsallow(NULL), lp_hostsdeny(NULL))) {
+	if (!socket_check_access(sock, "smbd", lp_hostsallow(NULL, lp_default_service(lp_ctx)), lp_hostsdeny(NULL, lp_default_service(lp_ctx)))) {
 		stream_terminate_connection(srv_conn, "denied by access rules");
 		return;
 	}
diff --git a/source4/torture/config.mk b/source4/torture/config.mk
index 626349a45d..e35a26e49f 100644
--- a/source4/torture/config.mk
+++ b/source4/torture/config.mk
@@ -3,8 +3,7 @@
 SO_VERSION = 0
 VERSION = 0.0.1
 PC_FILE = torture.pc
-PUBLIC_HEADERS = torture.h ui.h
-PUBLIC_PROTO_HEADER = proto.h
+PRIVATE_PROTO_HEADER = proto.h
 OBJ_FILES = \
 		torture.o \
 		ui.o
@@ -14,6 +13,8 @@ PUBLIC_DEPENDENCIES = \
 		LIBTALLOC \
 		LIBPOPT
 
+PUBLIC_HEADERS += torture/torture.h torture/ui.h
+
 [SUBSYSTEM::TORTURE_UTIL]
 OBJ_FILES = util_smb.o util_provision.o
 PRIVATE_DEPENDENCIES = LIBCLI_RAW LIBPYTHON smbcalls
@@ -314,10 +315,11 @@ PRIVATE_DEPENDENCIES = \
 		dcerpc \
 		LIBCLI_SMB \
 		SMBREADLINE
-MANPAGE = man/smbtorture.1
 # End BINARY smbtorture
 #################################
 
+MANPAGES += torture/man/smbtorture.1
+
 #################################
 # Start BINARY gentest
 [BINARY::gentest]
@@ -332,10 +334,11 @@ PRIVATE_DEPENDENCIES = \
 		POPT_CREDENTIALS \
 		LIBCLI_SMB \
 		LIBCLI_RAW
-MANPAGE = man/gentest.1
 # End BINARY gentest
 #################################
 
+MANPAGES += torture/man/gentest.1
+
 #################################
 # Start BINARY masktest
 [BINARY::masktest]
@@ -349,10 +352,11 @@ PRIVATE_DEPENDENCIES = \
 		POPT_SAMBA \
 		POPT_CREDENTIALS \
 		LIBCLI_SMB
-MANPAGE = man/masktest.1
 # End BINARY masktest
 #################################
 
+MANPAGES += torture/man/masktest.1
+
 #################################
 # Start BINARY locktest
 [BINARY::locktest]
@@ -366,10 +370,11 @@ PRIVATE_DEPENDENCIES = \
 		LIBSAMBA-UTIL \
 		LIBCLI_SMB \
 		LIBSAMBA-CONFIG
-MANPAGE = man/locktest.1
 # End BINARY locktest
 #################################
 
+MANPAGES += torture/man/locktest.1
+
 COV_TARGET = test
 
 COV_VARS = \
diff --git a/source4/torture/ldap/cldap.c b/source4/torture/ldap/cldap.c
index 4e58059770..dbe9d2f9a4 100644
--- a/source4/torture/ldap/cldap.c
+++ b/source4/torture/ldap/cldap.c
@@ -38,7 +38,7 @@
 */
 static bool test_cldap_netlogon(struct torture_context *tctx, const char *dest)
 {
-	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL);
+	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	NTSTATUS status;
 	struct cldap_netlogon search, empty_search;
 	union nbt_cldap_netlogon n1;
@@ -244,7 +244,7 @@ static void cldap_dump_results(struct cldap_search *search)
 */
 static bool test_cldap_generic(struct torture_context *tctx, const char *dest)
 {
-	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL);
+	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	NTSTATUS status;
 	struct cldap_search search;
 	const char *attrs1[] = { "currentTime", "highestCommittedUSN", NULL };
diff --git a/source4/torture/ldap/cldapbench.c b/source4/torture/ldap/cldapbench.c
index c57ed6d48a..83e505e164 100644
--- a/source4/torture/ldap/cldapbench.c
+++ b/source4/torture/ldap/cldapbench.c
@@ -51,7 +51,7 @@ static void request_handler(struct cldap_request *req)
 */
 static bool bench_cldap(struct torture_context *tctx, const char *address)
 {
-	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL);
+	struct cldap_socket *cldap = cldap_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	int num_sent=0;
 	struct timeval tv = timeval_current();
 	bool ret = true;
diff --git a/source4/torture/libnet/groupinfo.c b/source4/torture/libnet/groupinfo.c
index 55edb9d40d..4ddb1cefbe 100644
--- a/source4/torture/libnet/groupinfo.c
+++ b/source4/torture/libnet/groupinfo.c
@@ -96,7 +96,7 @@ bool torture_groupinfo(struct torture_context *torture)
 	/*
 	 * Testing synchronous version
 	 */
-	if (!test_opendomain(p, mem_ctx, &h, &name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &name, &sid)) {
 		ret = false;
 		goto done;
 	}
diff --git a/source4/torture/libnet/groupman.c b/source4/torture/libnet/groupman.c
index adb055c750..51b1c65b30 100644
--- a/source4/torture/libnet/groupman.c
+++ b/source4/torture/libnet/groupman.c
@@ -67,12 +67,10 @@ bool torture_groupadd(struct torture_context *torture)
 					&p,
 					&ndr_table_samr);
 	
-	if (!NT_STATUS_IS_OK(status)) {
-		return false;
-	}
+	torture_assert_ntstatus_ok(torture, status, "RPC connection");
 
 	domain_name.string = lp_workgroup(torture->lp_ctx);
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
diff --git a/source4/torture/libnet/libnet_user.c b/source4/torture/libnet/libnet_user.c
index 6ea670629e..31300a7937 100644
--- a/source4/torture/libnet/libnet_user.c
+++ b/source4/torture/libnet/libnet_user.c
@@ -339,12 +339,13 @@ static void set_test_changes(TALLOC_CTX *mem_ctx, struct libnet_ModifyUser *r,
 	const char* logon_scripts[] = { "start_login.cmd", "login.bat", "start.cmd" };
 	const char* home_dirs[] = { "\\\\srv\\home", "\\\\homesrv\\home\\user", "\\\\pdcsrv\\domain" };
 	const char* home_drives[] = { "H:", "z:", "I:", "J:", "n:" };
+	const uint32_t flags[] = { (ACB_DISABLED | ACB_NORMAL),
+				   (ACB_NORMAL | ACB_PWNOEXP),
+				   (ACB_NORMAL) };
 	const char *homedir, *homedrive, *logonscript;
 	struct timeval now;
 	int i, testfld;
 
-	srandom((unsigned)time(NULL));
-
 	printf("Fields to change: [");
 
 	for (i = 0; i < num_changes && i < FIELDS_NUM; i++) {
@@ -382,14 +383,14 @@ static void set_test_changes(TALLOC_CTX *mem_ctx, struct libnet_ModifyUser *r,
 
 		case home_directory:
 			continue_if_field_set(r->in.home_directory);
-			homedir = home_dirs[random() % (sizeof(home_dirs)/sizeof(char*))];
+			homedir = home_dirs[random() % ARRAY_SIZE(home_dirs)];
 			r->in.home_directory = talloc_strdup(mem_ctx, homedir);
 			fldname = "home_dir";
 			break;
 
 		case home_drive:
 			continue_if_field_set(r->in.home_drive);
-			homedrive = home_drives[random() % (sizeof(home_drives)/sizeof(char*))];
+			homedrive = home_drives[random() % ARRAY_SIZE(home_drives)];
 			r->in.home_drive = talloc_strdup(mem_ctx, homedrive);
 			fldname = "home_drive";
 			break;
@@ -403,7 +404,7 @@ static void set_test_changes(TALLOC_CTX *mem_ctx, struct libnet_ModifyUser *r,
 
 		case logon_script:
 			continue_if_field_set(r->in.logon_script);
-			logonscript = logon_scripts[random() % (sizeof(logon_scripts)/sizeof(char*))];
+			logonscript = logon_scripts[random() % ARRAY_SIZE(logon_scripts)];
 			r->in.logon_script = talloc_strdup(mem_ctx, logonscript);
 			fldname = "logon_script";
 			break;
@@ -422,6 +423,12 @@ static void set_test_changes(TALLOC_CTX *mem_ctx, struct libnet_ModifyUser *r,
 			fldname = "acct_expiry";
 			break;
 
+		case acct_flags:
+			continue_if_field_set(r->in.acct_flags);
+			r->in.acct_flags = flags[random() % ARRAY_SIZE(flags)];
+			fldname = "acct_flags";
+			break;
+
 		default:
 			fldname = "unknown_field";
 		}
diff --git a/source4/torture/libnet/userinfo.c b/source4/torture/libnet/userinfo.c
index e862435d20..11e57f852d 100644
--- a/source4/torture/libnet/userinfo.c
+++ b/source4/torture/libnet/userinfo.c
@@ -152,12 +152,12 @@ bool torture_userinfo(struct torture_context *torture)
 	/*
 	 * Testing synchronous version
 	 */
-	if (!test_opendomain(p, mem_ctx, &h, &name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &name, &sid)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_user_create(p, mem_ctx, &h, TEST_USERNAME, &rid)) {
+	if (!test_user_create(torture, p, mem_ctx, &h, TEST_USERNAME, &rid)) {
 		ret = false;
 		goto done;
 	}
@@ -167,7 +167,7 @@ bool torture_userinfo(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!test_user_cleanup(p, mem_ctx, &h, TEST_USERNAME)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, TEST_USERNAME)) {
 		ret = false;
 		goto done;
 	}
@@ -175,12 +175,12 @@ bool torture_userinfo(struct torture_context *torture)
 	/*
 	 * Testing asynchronous version and monitor messages
 	 */
-	if (!test_opendomain(p, mem_ctx, &h, &name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &name, &sid)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_user_create(p, mem_ctx, &h, TEST_USERNAME, &rid)) {
+	if (!test_user_create(torture, p, mem_ctx, &h, TEST_USERNAME, &rid)) {
 		ret = false;
 		goto done;
 	}
@@ -190,7 +190,7 @@ bool torture_userinfo(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!test_user_cleanup(p, mem_ctx, &h, TEST_USERNAME)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, TEST_USERNAME)) {
 		ret = false;
 		goto done;
 	}
diff --git a/source4/torture/libnet/userman.c b/source4/torture/libnet/userman.c
index 0d08284a9f..5ce0a64022 100644
--- a/source4/torture/libnet/userman.c
+++ b/source4/torture/libnet/userman.c
@@ -79,7 +79,8 @@ static bool test_useradd_async(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 }
 
-static bool test_usermod(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+static bool test_usermod(struct torture_context *tctx, struct dcerpc_pipe *p, 
+			 TALLOC_CTX *mem_ctx,
 			 struct policy_handle *handle, int num_changes,
 			 struct libnet_rpc_usermod *mod, char **username)
 {
@@ -102,9 +103,10 @@ static bool test_usermod(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	mod->in.username = talloc_strdup(mem_ctx, *username);
 	mod->in.domain_handle = *handle;
 
-	printf("modifying user (%d simultaneous change(s))\n", num_changes);
+	torture_comment(tctx, "modifying user (%d simultaneous change(s))\n", 
+			num_changes);
 
-	printf("fields to change: [");
+	torture_comment(tctx, "fields to change: [");
 
 	for (i = 0; i < num_changes && i < FIELDS_NUM - 1; i++) {
 		const char *fldname;
@@ -189,7 +191,7 @@ static bool test_usermod(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 		case acct_flags:
 			continue_if_field_set(mod->in.change.acct_flags);
-			mod->in.change.acct_flags = flags[random() % (sizeof(flags)/sizeof(uint32_t))];
+			mod->in.change.acct_flags = flags[random() % ARRAY_SIZE(flags)];
 			mod->in.change.fields |= USERMOD_FIELD_ACCT_FLAGS;
 			fldname = "acct_flags";
 			break;
@@ -201,13 +203,10 @@ static bool test_usermod(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
 		printf(((i < num_changes - 1) ? "%s," : "%s"), fldname);
 	}
-	printf("]\n");
+	torture_comment(tctx, "]\n");
 
 	status = libnet_rpc_usermod(p, mem_ctx, mod);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("Failed to call sync libnet_rpc_usermod - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "Failed to call sync libnet_rpc_usermod");
 
 	return true;
 }
@@ -266,7 +265,8 @@ static bool test_userdel(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	}
 
 
-static bool test_compare(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+static bool test_compare(struct torture_context *tctx, 
+			 struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			 struct policy_handle *handle, struct libnet_rpc_usermod *mod,
 			 const char *username)
 {
@@ -282,10 +282,7 @@ static bool test_compare(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	info.in.level = 21;             /* the most rich infolevel available */
 
 	status = libnet_rpc_userinfo(p, mem_ctx, &info);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("Failed to call sync libnet_rpc_userinfo - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "Failed to call sync libnet_rpc_userinfo");
 
 	i = &info.out.info.info21;
 
@@ -321,12 +318,10 @@ bool torture_useradd(struct torture_context *torture)
 					&p,
 					&ndr_table_samr);
 	
-	if (!NT_STATUS_IS_OK(status)) {
-		return false;
-	}
+	torture_assert_ntstatus_ok(torture, status, "RPC connect failed");
 
 	domain_name.string = lp_workgroup(torture->lp_ctx);
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
@@ -336,12 +331,12 @@ bool torture_useradd(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!test_user_cleanup(p, mem_ctx, &h, name)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, name)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
@@ -351,7 +346,7 @@ bool torture_useradd(struct torture_context *torture)
 		goto done;
 	}
 
-	if (!test_user_cleanup(p, mem_ctx, &h, name)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, name)) {
 		ret = false;
 		goto done;
 	}
@@ -385,12 +380,12 @@ bool torture_userdel(struct torture_context *torture)
 	}
 
 	domain_name.string = lp_workgroup(torture->lp_ctx);
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_user_create(p, mem_ctx, &h, name, &rid)) {
+	if (!test_user_create(torture, p, mem_ctx, &h, name, &rid)) {
 		ret = false;
 		goto done;
 	}
@@ -425,20 +420,17 @@ bool torture_usermod(struct torture_context *torture)
 					&p,
 					&ndr_table_samr);
 	
-	if (!NT_STATUS_IS_OK(status)) {
-		ret = false;
-		goto done;
-	}
+	torture_assert_ntstatus_ok(torture, status, "RPC connect");
 
 	domain_name.string = lp_workgroup(torture->lp_ctx);
 	name = talloc_strdup(mem_ctx, TEST_USERNAME);
 
-	if (!test_opendomain(p, mem_ctx, &h, &domain_name, &sid)) {
+	if (!test_opendomain(torture, p, mem_ctx, &h, &domain_name, &sid)) {
 		ret = false;
 		goto done;
 	}
 
-	if (!test_user_create(p, mem_ctx, &h, name, &rid)) {
+	if (!test_user_create(torture, p, mem_ctx, &h, name, &rid)) {
 		ret = false;
 		goto done;
 	}
@@ -446,19 +438,19 @@ bool torture_usermod(struct torture_context *torture)
 	for (i = 1; i < FIELDS_NUM; i++) {
 		struct libnet_rpc_usermod m;
 
-		if (!test_usermod(p, mem_ctx, &h, i, &m, &name)) {
+		if (!test_usermod(torture, p, mem_ctx, &h, i, &m, &name)) {
 			ret = false;
 			goto cleanup;
 		}
 
-		if (!test_compare(p, mem_ctx, &h, &m, name)) {
+		if (!test_compare(torture, p, mem_ctx, &h, &m, name)) {
 			ret = false;
 			goto cleanup;
 		}
 	}
 	
 cleanup:	
-	if (!test_user_cleanup(p, mem_ctx, &h, name)) {
+	if (!test_user_cleanup(torture, p, mem_ctx, &h, name)) {
 		ret = false;
 		goto done;
 	}
diff --git a/source4/torture/libnet/utils.c b/source4/torture/libnet/utils.c
index 47bb9315c7..d4124cc823 100644
--- a/source4/torture/libnet/utils.c
+++ b/source4/torture/libnet/utils.c
@@ -29,7 +29,8 @@
 #include "param/param.h"
 
 
-bool test_opendomain(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_opendomain(struct torture_context *tctx, 
+		     struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		     struct policy_handle *handle, struct lsa_String *domname,
 		     struct dom_sid2 *sid)
 {
@@ -39,51 +40,41 @@ bool test_opendomain(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	struct samr_LookupDomain r2;
 	struct samr_OpenDomain r3;
 	
-	printf("connecting\n");
+	torture_comment(tctx, "connecting\n");
 	
 	r1.in.system_name = 0;
 	r1.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 	r1.out.connect_handle = &h;
 	
 	status = dcerpc_samr_Connect(p, mem_ctx, &r1);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("Connect failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "Connect failed");
 	
 	r2.in.connect_handle = &h;
 	r2.in.domain_name = domname;
 
-	printf("domain lookup on %s\n", domname->string);
+	torture_comment(tctx, "domain lookup on %s\n", domname->string);
 
 	status = dcerpc_samr_LookupDomain(p, mem_ctx, &r2);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("LookupDomain failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "LookupDomain failed");
 
 	r3.in.connect_handle = &h;
 	r3.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 	r3.in.sid = r2.out.sid;
 	r3.out.domain_handle = &domain_handle;
 
-	printf("opening domain\n");
+	torture_comment(tctx, "opening domain\n");
 
 	status = dcerpc_samr_OpenDomain(p, mem_ctx, &r3);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("OpenDomain failed - %s\n", nt_errstr(status));
-		return false;
-	} else {
-		*handle = domain_handle;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "OpenDomain failed");
+	*handle = domain_handle;
 
 	*sid = *r2.out.sid;
 	return true;
 }
 
 
-bool test_user_cleanup(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
-		       struct policy_handle *domain_handle,
+bool test_user_cleanup(struct torture_context *tctx, struct dcerpc_pipe *p, 
+		       TALLOC_CTX *mem_ctx, struct policy_handle *domain_handle,
 		       const char *name)
 {
 	NTSTATUS status;
@@ -100,13 +91,10 @@ bool test_user_cleanup(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	r1.in.num_names      = 1;
 	r1.in.names          = names;
 	
-	printf("user account lookup '%s'\n", name);
+	torture_comment(tctx, "user account lookup '%s'\n", name);
 
 	status = dcerpc_samr_LookupNames(p, mem_ctx, &r1);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("LookupNames failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "LookupNames failed");
 
 	rid = r1.out.rids.ids[0];
 	
@@ -115,30 +103,25 @@ bool test_user_cleanup(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	r2.in.rid            = rid;
 	r2.out.user_handle   = &user_handle;
 
-	printf("opening user account\n");
+	torture_comment(tctx, "opening user account\n");
 
 	status = dcerpc_samr_OpenUser(p, mem_ctx, &r2);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("OpenUser failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "OpenUser failed");
 
 	r3.in.user_handle  = &user_handle;
 	r3.out.user_handle = &user_handle;
 
-	printf("deleting user account\n");
+	torture_comment(tctx, "deleting user account\n");
 	
 	status = dcerpc_samr_DeleteUser(p, mem_ctx, &r3);
-	if (!NT_STATUS_IS_OK(status)) {
-		printf("DeleteUser failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_ok(tctx, status, "DeleteUser failed");
 	
 	return true;
 }
 
 
-bool test_user_create(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_user_create(struct torture_context *tctx, 
+		      struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		      struct policy_handle *handle, const char *name,
 		      uint32_t *rid)
 {
@@ -155,25 +138,22 @@ bool test_user_create(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	r.out.user_handle  = &user_handle;
 	r.out.rid          = rid;
 
-	printf("creating user account %s\n", name);
+	torture_comment(tctx, "creating user account %s\n", name);
 
 	status = dcerpc_samr_CreateUser(p, mem_ctx, &r);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("CreateUser failed - %s\n", nt_errstr(status));
 
 		if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
-			printf("User (%s) already exists - attempting to delete and recreate account again\n", name);
-			if (!test_user_cleanup(p, mem_ctx, handle, name)) {
+			torture_comment(tctx, "User (%s) already exists - attempting to delete and recreate account again\n", name);
+			if (!test_user_cleanup(tctx, p, mem_ctx, handle, name)) {
 				return false;
 			}
 
-			printf("creating user account\n");
+			torture_comment(tctx, "creating user account\n");
 			
 			status = dcerpc_samr_CreateUser(p, mem_ctx, &r);
-			if (!NT_STATUS_IS_OK(status)) {
-				printf("CreateUser failed - %s\n", nt_errstr(status));
-				return false;
-			}
+			torture_assert_ntstatus_ok(tctx, status, "CreateUser failed");
 			return true;
 		}
 		return false;
diff --git a/source4/torture/libnet/utils.h b/source4/torture/libnet/utils.h
index ff94ec49e9..b513b1a29e 100644
--- a/source4/torture/libnet/utils.h
+++ b/source4/torture/libnet/utils.h
@@ -19,15 +19,18 @@
 */
 
 
-bool test_opendomain(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_opendomain(struct torture_context *tctx, 
+		     struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		     struct policy_handle *handle, struct lsa_String *domname,
 		     struct dom_sid2 *sid);
 
-bool test_user_create(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_user_create(struct torture_context *tctx, 
+		      struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		      struct policy_handle *handle, const char *name,
 		      uint32_t *rid);
 
-bool test_user_cleanup(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
+bool test_user_cleanup(struct torture_context *tctx, 
+		       struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		       struct policy_handle *domain_handle,
 		       const char *name);
 
diff --git a/source4/torture/local/config.mk b/source4/torture/local/config.mk
index d0ba1f2782..4143d415cf 100644
--- a/source4/torture/local/config.mk
+++ b/source4/torture/local/config.mk
@@ -8,6 +8,7 @@ PRIVATE_PROTO_HEADER = \
 OBJ_FILES = \
 		../../lib/charset/tests/iconv.o \
 		../../lib/talloc/testsuite.o \
+		../../lib/replace/test/getifaddrs.o \
 		../../lib/replace/test/os2_delete.o \
 		../../lib/replace/test/strptime.o \
 		../../lib/replace/test/testsuite.o \
diff --git a/source4/torture/nbt/dgram.c b/source4/torture/nbt/dgram.c
index 0315989d66..e1680877e8 100644
--- a/source4/torture/nbt/dgram.c
+++ b/source4/torture/nbt/dgram.c
@@ -64,7 +64,8 @@ static void netlogon_handler(struct dgram_mailslot_handler *dgmslot,
 static bool nbt_test_netlogon(struct torture_context *tctx)
 {
 	struct dgram_mailslot_handler *dgmslot;
-	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL);
+	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL, 
+								 lp_iconv_convenience(tctx->lp_ctx));
 	struct socket_address *dest;
 	const char *myaddress;
 	struct nbt_netlogon_packet logon;
@@ -146,7 +147,8 @@ static bool nbt_test_netlogon(struct torture_context *tctx)
 static bool nbt_test_netlogon2(struct torture_context *tctx)
 {
 	struct dgram_mailslot_handler *dgmslot;
-	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL);
+	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL,
+								 lp_iconv_convenience(tctx->lp_ctx));
 	struct socket_address *dest;
 	const char *myaddress;
 	struct nbt_netlogon_packet logon;
@@ -255,7 +257,8 @@ static void ntlogon_handler(struct dgram_mailslot_handler *dgmslot,
 static bool nbt_test_ntlogon(struct torture_context *tctx)
 {
 	struct dgram_mailslot_handler *dgmslot;
-	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL);
+	struct nbt_dgram_socket *dgmsock = nbt_dgram_socket_init(tctx, NULL,
+								 lp_iconv_convenience(tctx->lp_ctx));
 	struct socket_address *dest;
 	struct test_join *join_ctx;
 	struct cli_credentials *machine_credentials;
diff --git a/source4/torture/nbt/query.c b/source4/torture/nbt/query.c
index 78210a2a07..1ba6172e5c 100644
--- a/source4/torture/nbt/query.c
+++ b/source4/torture/nbt/query.c
@@ -47,7 +47,8 @@ static void increment_handler(struct nbt_name_request *req)
 */
 static bool bench_namequery(struct torture_context *tctx)
 {
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL,
+							       lp_iconv_convenience(tctx->lp_ctx));
 	int num_sent=0;
 	struct result_struct *result;
 	struct nbt_name_query io;
diff --git a/source4/torture/nbt/register.c b/source4/torture/nbt/register.c
index 508c6b4840..b9f06c479d 100644
--- a/source4/torture/nbt/register.c
+++ b/source4/torture/nbt/register.c
@@ -44,7 +44,8 @@ static bool nbt_register_own(struct torture_context *tctx)
 {
 	struct nbt_name_register io;
 	NTSTATUS status;
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL,
+							       lp_iconv_convenience(tctx->lp_ctx));
 	struct socket_address *socket_address;
 	struct nbt_name name;
 	const char *address;
@@ -113,7 +114,8 @@ static bool nbt_refresh_own(struct torture_context *tctx)
 {
 	struct nbt_name_refresh io;
 	NTSTATUS status;
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL,
+							       lp_iconv_convenience(tctx->lp_ctx));
 	const char *myaddress;
 	struct socket_address *socket_address;
 	struct nbt_name name;
diff --git a/source4/torture/nbt/wins.c b/source4/torture/nbt/wins.c
index cf115fcd75..059b2dc919 100644
--- a/source4/torture/nbt/wins.c
+++ b/source4/torture/nbt/wins.c
@@ -53,7 +53,7 @@ static bool nbt_test_wins_name(struct torture_context *tctx, const char *address
 	struct nbt_name_refresh_wins refresh;
 	struct nbt_name_release release;
 	NTSTATUS status;
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	const char *myaddress;
 	struct socket_address *socket_address;
 	struct interface *ifaces;
diff --git a/source4/torture/nbt/winsbench.c b/source4/torture/nbt/winsbench.c
index 1488c17757..ea4abaf21b 100644
--- a/source4/torture/nbt/winsbench.c
+++ b/source4/torture/nbt/winsbench.c
@@ -225,7 +225,7 @@ static void generate_request(struct nbt_name_socket *nbtsock, struct wins_state
 */
 static bool bench_wins(struct torture_context *tctx)
 {
-	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL);
+	struct nbt_name_socket *nbtsock = nbt_name_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	int num_sent=0;
 	struct timeval tv = timeval_current();
 	bool ret = true;
diff --git a/source4/torture/nbt/winsreplication.c b/source4/torture/nbt/winsreplication.c
index d96ed3e931..470eee8310 100644
--- a/source4/torture/nbt/winsreplication.c
+++ b/source4/torture/nbt/winsreplication.c
@@ -103,14 +103,14 @@ static bool test_assoc_ctx1(struct torture_context *tctx)
 
 	torture_comment(tctx, "Test if assoc_ctx is only valid on the conection it was created on\n");
 
-	wrepl_socket1 = wrepl_socket_init(tctx, NULL);
-	wrepl_socket2 = wrepl_socket_init(tctx, NULL);
+	wrepl_socket1 = wrepl_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
+	wrepl_socket2 = wrepl_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 
 	torture_comment(tctx, "Setup 2 wrepl connections\n");
-	status = wrepl_connect(wrepl_socket1, lp_resolve_context(tctx->lp_ctx), NULL, address);
+	status = wrepl_connect(wrepl_socket1, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, address), address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
-	status = wrepl_connect(wrepl_socket2, lp_resolve_context(tctx->lp_ctx), NULL, address);
+	status = wrepl_connect(wrepl_socket2, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, address), address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
 	torture_comment(tctx, "Send a start association request (conn1)\n");
@@ -186,10 +186,10 @@ static bool test_assoc_ctx2(struct torture_context *tctx)
 
 	torture_comment(tctx, "Test if we always get back the same assoc_ctx\n");
 
-	wrepl_socket = wrepl_socket_init(tctx, NULL);
+	wrepl_socket = wrepl_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	
 	torture_comment(tctx, "Setup wrepl connections\n");
-	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), NULL, address);
+	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, address), address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
 	torture_comment(tctx, "Send 1st start association request\n");
@@ -255,10 +255,10 @@ static bool test_wins_replication(struct torture_context *tctx)
 
 	torture_comment(tctx, "Test one pull replication cycle\n");
 
-	wrepl_socket = wrepl_socket_init(tctx, NULL);
+	wrepl_socket = wrepl_socket_init(tctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	
 	torture_comment(tctx, "Setup wrepl connections\n");
-	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), NULL, address);
+	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, address), address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
 	torture_comment(tctx, "Send a start association request\n");
@@ -553,11 +553,11 @@ static struct test_wrepl_conflict_conn *test_create_conflict_ctx(
 	if (!ctx) return NULL;
 
 	ctx->address	= address;
-	ctx->pull	= wrepl_socket_init(ctx, NULL);
+	ctx->pull	= wrepl_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	if (!ctx->pull) return NULL;
 
 	torture_comment(tctx, "Setup wrepl conflict pull connection\n");
-	status = wrepl_connect(ctx->pull, lp_resolve_context(tctx->lp_ctx), NULL, ctx->address);
+	status = wrepl_connect(ctx->pull, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, ctx->address), ctx->address);
 	if (!NT_STATUS_IS_OK(status)) return NULL;
 
 	status = wrepl_associate(ctx->pull, &associate);
@@ -610,7 +610,7 @@ static struct test_wrepl_conflict_conn *test_create_conflict_ctx(
 
 	talloc_free(pull_table.out.partners);
 
-	ctx->nbtsock = nbt_name_socket_init(ctx, NULL);
+	ctx->nbtsock = nbt_name_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	if (!ctx->nbtsock) return NULL;
 
 	load_interfaces(tctx, lp_interfaces(tctx->lp_ctx), &ifaces);
@@ -628,7 +628,7 @@ static struct test_wrepl_conflict_conn *test_create_conflict_ctx(
 	status = socket_listen(ctx->nbtsock->sock, ctx->myaddr, 0, 0);
 	if (!NT_STATUS_IS_OK(status)) return NULL;
 
-	ctx->nbtsock_srv = nbt_name_socket_init(ctx, NULL);
+	ctx->nbtsock_srv = nbt_name_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	if (!ctx->nbtsock_srv) return NULL;
 
 	/* Make a port 137 version of ctx->myaddr */
@@ -645,13 +645,13 @@ static struct test_wrepl_conflict_conn *test_create_conflict_ctx(
 	}
 
 	if (ctx->myaddr2 && ctx->nbtsock_srv) {
-		ctx->nbtsock2 = nbt_name_socket_init(ctx, NULL);
+		ctx->nbtsock2 = nbt_name_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 		if (!ctx->nbtsock2) return NULL;
 
 		status = socket_listen(ctx->nbtsock2->sock, ctx->myaddr2, 0, 0);
 		if (!NT_STATUS_IS_OK(status)) return NULL;
 
-		ctx->nbtsock_srv2 = nbt_name_socket_init(ctx, ctx->nbtsock_srv->event_ctx);
+		ctx->nbtsock_srv2 = nbt_name_socket_init(ctx, ctx->nbtsock_srv->event_ctx, lp_iconv_convenience(tctx->lp_ctx));
 		if (!ctx->nbtsock_srv2) return NULL;
 
 		/* Make a port 137 version of ctx->myaddr2 */
@@ -722,9 +722,9 @@ static bool test_wrepl_update_one(struct torture_context *tctx,
 	uint32_t assoc_ctx;
 	NTSTATUS status;
 
-	wrepl_socket = wrepl_socket_init(ctx, NULL);
+	wrepl_socket = wrepl_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 
-	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), NULL, ctx->address);
+	status = wrepl_connect(wrepl_socket, lp_resolve_context(tctx->lp_ctx), wrepl_best_ip(tctx->lp_ctx, ctx->address), ctx->address);
 	CHECK_STATUS(tctx, status, NT_STATUS_OK);
 
 	status = wrepl_associate(wrepl_socket, &associate);
diff --git a/source4/torture/raw/chkpath.c b/source4/torture/raw/chkpath.c
index 42a3c3cebe..fa69c92caa 100644
--- a/source4/torture/raw/chkpath.c
+++ b/source4/torture/raw/chkpath.c
@@ -54,24 +54,68 @@ static NTSTATUS single_search(struct smbcli_state *cli,
 	return status;
 }
 
-static bool test_path(struct smbcli_state *cli, const char *path, NTSTATUS expected, NTSTATUS dos_expected)
+static bool test_path_ex(struct smbcli_state *cli, struct torture_context *tctx,
+			 const char *path, const char *path_expected,
+			 NTSTATUS expected, NTSTATUS dos_expected)
 {
 	union smb_chkpath io;
+	union smb_fileinfo finfo;
 	NTSTATUS status;
+
 	io.chkpath.in.path = path;
 	status = smb_raw_chkpath(cli->tree, &io);
 	if (!NT_STATUS_EQUAL(status, expected) && !NT_STATUS_EQUAL(status, dos_expected)) {
-		printf("%-40s FAILED %s should be %s or %s\n", 
+		printf("FAILED %-30s chkpath %s should be %s or %s\n",
 		       path, nt_errstr(status), nt_errstr(expected), nt_errstr(dos_expected));
 		return false;
 	} else {
-		printf("%-40s correct (%s)\n", path, nt_errstr(status));
+		printf("%-30s chkpath correct (%s)\n", path, nt_errstr(status));
+	}
+
+	if (NT_STATUS_EQUAL(expected, NT_STATUS_NOT_A_DIRECTORY)) {
+		expected = NT_STATUS_OK;
+	}
+
+	ZERO_STRUCT(finfo);
+	finfo.generic.level = RAW_FILEINFO_NAME_INFO;
+	finfo.generic.in.file.path = path;
+	status = smb_raw_pathinfo(cli->tree, cli, &finfo);
+	if (!NT_STATUS_EQUAL(status, expected) && !NT_STATUS_EQUAL(status, dos_expected)) {
+		printf("FAILED: %-30s pathinfo %s should be %s or %s\n",
+		       path, nt_errstr(status), nt_errstr(expected), nt_errstr(dos_expected));
+		return false;
+	}
+
+	if (!NT_STATUS_IS_OK(status)) {
+		printf("%-30s chkpath correct (%s)\n", path, nt_errstr(status));
+		return true;
+	}
 
+	if (path_expected &&
+	    (!finfo.name_info.out.fname.s ||
+	     strcmp(finfo.name_info.out.fname.s, path_expected) != 0)) {
+		if (tctx && torture_setting_bool(tctx, "samba4", false)) {
+			printf("IGNORE: %-30s => %-20s should be %s\n",
+				path, finfo.name_info.out.fname.s, path_expected);
+			return true;
+		}
+		printf("FAILED: %-30s => %-20s should be %s\n",
+			path, finfo.name_info.out.fname.s, path_expected);
+		return false;
 	}
+	printf("%-30s => %-20s correct\n",
+		path, finfo.name_info.out.fname.s);
+
 	return true;
 }
 
-static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
+static bool test_path(struct smbcli_state *cli, const char *path,
+		      NTSTATUS expected, NTSTATUS dos_expected)
+{
+	return test_path_ex(cli, NULL, path, path, expected, dos_expected);
+}
+
+static bool test_chkpath(struct smbcli_state *cli, struct torture_context *tctx)
 {
 	union smb_chkpath io;
 	NTSTATUS status;
@@ -86,7 +130,7 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 
 	ret &= test_path(cli, BASEDIR "\\nodir", NT_STATUS_OBJECT_NAME_NOT_FOUND, NT_STATUS_DOS(ERRDOS,ERRbadpath));
 
-	fnum = create_complex_file(cli, mem_ctx, BASEDIR "\\test.txt..");
+	fnum = create_complex_file(cli, tctx, BASEDIR "\\test.txt..");
 	if (fnum == -1) {
 		printf("failed to open test.txt - %s\n", smbcli_errstr(cli->tree));
 		ret = false;
@@ -101,9 +145,20 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 		goto done;
 	}
 
-	ret &= test_path(cli, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
-	ret &= test_path(cli, BASEDIR "\\foo\\..\\test.txt..", NT_STATUS_NOT_A_DIRECTORY, NT_STATUS_DOS(ERRDOS,ERRbadpath));
-	ret &= test_path(cli, "", NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR) + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR"\\\\") + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR"\\foo\\..") + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR"\\f\\o\\o\\..\\..\\..") + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, ((char *)BASEDIR"\\foo\\\\\..\\\\") + 1, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR"\\", BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR"\\\\..\\"BASEDIR, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR"\\\\\\", BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, "\\\\\\\\"BASEDIR"\\\\\\\\", BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, "\\\\\\\\"BASEDIR, BASEDIR, NT_STATUS_OK, NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR "\\foo\\..\\test.txt..", BASEDIR "\\test.txt..",
+			    NT_STATUS_NOT_A_DIRECTORY, NT_STATUS_DOS(ERRDOS,ERRbadpath));
+	ret &= test_path_ex(cli, tctx, "", "\\", NT_STATUS_OK, NT_STATUS_OK);
 	ret &= test_path(cli, ".", NT_STATUS_OBJECT_NAME_INVALID, NT_STATUS_DOS(ERRDOS,ERRbadpath));
 	ret &= test_path(cli, ".\\", NT_STATUS_OBJECT_NAME_INVALID, NT_STATUS_DOS(ERRDOS,ERRbadpath));
 	ret &= test_path(cli, "\\\\\\.\\", NT_STATUS_OBJECT_NAME_INVALID, NT_STATUS_DOS(ERRDOS,ERRbadpath));
@@ -122,7 +177,7 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	  give different NT status returns for chkpth and findfirst. */
 
 	printf("testing findfirst on %s\n", "\\.\\\\\\\\\\\\.");
-	status = single_search(cli, mem_ctx, "\\.\\\\\\\\\\\\.");
+	status = single_search(cli, tctx, "\\.\\\\\\\\\\\\.");
 	CHECK_STATUS(status, NT_STATUS_OBJECT_NAME_INVALID,NT_STATUS_DOS(ERRDOS,ERRinvalidname));
 
 	ret &= test_path(cli, "\\.\\\\\\\\\\\\.", NT_STATUS_OBJECT_PATH_NOT_FOUND,NT_STATUS_DOS(ERRDOS,ERRbadpath));
@@ -164,7 +219,7 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	ret &= test_path(cli, "\\..\\", NT_STATUS_OBJECT_PATH_SYNTAX_BAD,NT_STATUS_DOS(ERRDOS,ERRinvalidpath));
 	ret &= test_path(cli, "\\..", NT_STATUS_OBJECT_PATH_SYNTAX_BAD,NT_STATUS_DOS(ERRDOS,ERRinvalidpath));
 	ret &= test_path(cli, BASEDIR "\\.", NT_STATUS_OBJECT_NAME_INVALID,NT_STATUS_DOS(ERRDOS,ERRbadpath));
-	ret &= test_path(cli, BASEDIR "\\..", NT_STATUS_OK,NT_STATUS_OK);
+	ret &= test_path_ex(cli, tctx, BASEDIR "\\..", "\\", NT_STATUS_OK,NT_STATUS_OK);
 	ret &= test_path(cli, BASEDIR "\\nt\\V S\\VB98\\vb600", NT_STATUS_OBJECT_NAME_NOT_FOUND,NT_STATUS_DOS(ERRDOS,ERRbadpath));
 	ret &= test_path(cli, BASEDIR "\\nt\\V S\\VB98\\vb6.exe", NT_STATUS_NOT_A_DIRECTORY,NT_STATUS_DOS(ERRDOS,ERRbadpath));
 
@@ -183,7 +238,7 @@ static bool test_chkpath(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 	CHECK_STATUS(status, NT_STATUS_OBJECT_PATH_NOT_FOUND,NT_STATUS_DOS(ERRDOS,ERRbadpath));
 
 	printf("testing findfirst on %s\n", BASEDIR".\\.\\.\\.\\foo\\..\\.\\");
-	status = single_search(cli, mem_ctx, BASEDIR".\\.\\.\\.\\foo\\..\\.\\");
+	status = single_search(cli, tctx, BASEDIR".\\.\\.\\.\\foo\\..\\.\\");
 	CHECK_STATUS(status, NT_STATUS_OBJECT_PATH_NOT_FOUND,NT_STATUS_DOS(ERRDOS,ERRbadpath));
 
 	/* We expect this open to fail with the same error code as the chkpath below. */
diff --git a/source4/torture/raw/composite.c b/source4/torture/raw/composite.c
index 7238a2fd46..1f31fbc515 100644
--- a/source4/torture/raw/composite.c
+++ b/source4/torture/raw/composite.c
@@ -31,6 +31,7 @@
 #include "lib/cmdline/popt_common.h"
 #include "torture/util.h"
 #include "param/param.h"
+#include "libcli/resolve/resolve.h"
 
 #define BASEDIR "\\composite"
 
@@ -161,6 +162,7 @@ static bool test_fetchfile(struct smbcli_state *cli, struct torture_context *tct
 	io2.in.credentials = cmdline_credentials;
 	io2.in.workgroup  = lp_workgroup(tctx->lp_ctx);
 	io2.in.filename = fname;
+	io2.in.resolve_ctx = lp_resolve_context(tctx->lp_ctx);
 	lp_smbcli_options(tctx->lp_ctx, &io2.in.options);
 
 	printf("testing parallel fetchfile with %d ops\n", torture_numops);
diff --git a/source4/torture/raw/oplock.c b/source4/torture/raw/oplock.c
index e81b634161..7ac88c0996 100644
--- a/source4/torture/raw/oplock.c
+++ b/source4/torture/raw/oplock.c
@@ -27,11 +27,19 @@
 
 #define CHECK_VAL(v, correct) do { \
 	if ((v) != (correct)) { \
-		torture_comment(tctx, "(%s): wrong value for %s got 0x%x - should be 0x%x\n", \
+		torture_result(tctx, TORTURE_FAIL, "(%s): wrong value for %s got 0x%x - should be 0x%x\n", \
 				__location__, #v, (int)v, (int)correct); \
 		ret = false; \
 	}} while (0)
 
+#define CHECK_STRMATCH(v, correct) do { \
+	if (!v || strstr((v),(correct)) == NULL) { \
+		torture_result(tctx, TORTURE_FAIL,  "(%s): wrong value for %s got '%s' - should be '%s'\n", \
+				__location__, #v, v?v:"NULL", correct); \
+		ret = false; \
+	} \
+} while (0)
+
 #define CHECK_STATUS(tctx, status, correct) do { \
 	if (!NT_STATUS_EQUAL(status, correct)) { \
 		torture_result(tctx, TORTURE_FAIL, __location__": Incorrect status %s - should be %s", \
@@ -123,9 +131,9 @@ static bool oplock_handler_close(struct smbcli_transport *transport, uint16_t ti
 	return true;
 }
 
-static bool test_raw_oplock_normal(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+static bool test_raw_oplock_exclusive1(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
 {
-	const char *fname = BASEDIR "\\test_normal.dat";
+	const char *fname = BASEDIR "\\test_exclusive1.dat";
 	NTSTATUS status;
 	bool ret = true;
 	union smb_open io;
@@ -156,7 +164,7 @@ static bool test_raw_oplock_normal(struct torture_context *tctx, struct smbcli_s
 	io.ntcreatex.in.security_flags = 0;
 	io.ntcreatex.in.fname = fname;
 
-	torture_comment(tctx, "open a file with a normal oplock\n");
+	torture_comment(tctx, "open a file with an exclusive oplock (share mode: none)\n");
 	ZERO_STRUCT(break_info);
 	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
 
@@ -188,6 +196,381 @@ done:
 	return ret;
 }
 
+static bool test_raw_oplock_exclusive2(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_exclusive2.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_unlink unl;
+	uint16_t fnum=0, fnum2=0;
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open a file with an exclusive oplock (share mode: all)\n");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	torture_comment(tctx, "a 2nd open should cause a break to level 2\n");
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, LEVEL_II_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.fnum, fnum);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+	CHECK_VAL(break_info.failures, 0);
+	ZERO_STRUCT(break_info);
+
+	/* now we have 2 level II oplocks... */
+	torture_comment(tctx, "try to unlink it - should not cause a break, but a sharing violation\n");
+	unl.unlink.in.pattern = fname;
+	unl.unlink.in.attrib = 0;
+	status = smb_raw_unlink(cli2->tree, &unl);
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+	torture_comment(tctx, "close 1st handle\n");
+	smbcli_close(cli1->tree, fnum);
+
+	torture_comment(tctx, "try to unlink it - should not cause a break, but a sharing violation\n");
+	unl.unlink.in.pattern = fname;
+	unl.unlink.in.attrib = 0;
+	status = smb_raw_unlink(cli2->tree, &unl);
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+	torture_comment(tctx, "close 1st handle\n");
+	smbcli_close(cli2->tree, fnum2);
+
+	torture_comment(tctx, "unlink it\n");
+	unl.unlink.in.pattern = fname;
+	unl.unlink.in.attrib = 0;
+	status = smb_raw_unlink(cli2->tree, &unl);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_exclusive3(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_exclusive3.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_setfileinfo sfi;
+	uint16_t fnum=0;
+	bool s3 = torture_setting_bool(tctx, "samba3", false);
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open a file with an exclusive oplock (share mode: %s)\n",
+			s3?"all":"none");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	if (s3) {
+		io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+			NTCREATEX_SHARE_ACCESS_WRITE|
+			NTCREATEX_SHARE_ACCESS_DELETE;
+	}
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	torture_comment(tctx, "setpathinfo EOF should trigger a break to none\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_END_OF_FILE_INFORMATION;
+	sfi.generic.in.file.path = fname;
+	sfi.end_of_file_info.in.size = 100;
+
+	status = smb_raw_setpathinfo(cli2->tree, &sfi);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_NONE);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_exclusive4(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_exclusive4.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	uint16_t fnum=0, fnum2=0;
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open with exclusive oplock\n");
+	ZERO_STRUCT(break_info);
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	ZERO_STRUCT(break_info);
+	torture_comment(tctx, "second open with attributes only shouldn't cause oplock break\n");
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE|SEC_FILE_WRITE_ATTRIBUTE|SEC_STD_SYNCHRONIZE;
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, NO_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+	smbcli_close(cli1->tree, fnum);
+	smbcli_close(cli2->tree, fnum2);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_exclusive5(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_exclusive5.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	uint16_t fnum=0, fnum2=0;
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+	smbcli_oplock_handler(cli2->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open with exclusive oplock\n");
+	ZERO_STRUCT(break_info);
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	ZERO_STRUCT(break_info);
+
+	torture_comment(tctx, "second open with attributes only and NTCREATEX_DISP_OVERWRITE_IF dispostion causes oplock break\n");
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE|SEC_FILE_WRITE_ATTRIBUTE|SEC_STD_SYNCHRONIZE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OVERWRITE_IF;
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, LEVEL_II_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+
+	smbcli_close(cli1->tree, fnum);
+	smbcli_close(cli2->tree, fnum2);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_exclusive6(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_exclusive6_1.dat";
+	const char *fname2 = BASEDIR "\\test_exclusive6_2.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_rename rn;
+	uint16_t fnum=0;
+	bool s3 = torture_setting_bool(tctx, "samba3", false);
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	/* we should use no share mode, when samba3 passes this */
+	torture_comment(tctx, "open a file with an exclusive oplock (share mode: %s)\n",
+			s3?"all":"none");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED | NTCREATEX_FLAGS_REQUEST_OPLOCK;
+	if (s3) {
+		io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+			NTCREATEX_SHARE_ACCESS_WRITE|
+			NTCREATEX_SHARE_ACCESS_DELETE;
+	}
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, EXCLUSIVE_OPLOCK_RETURN);
+
+	torture_comment(tctx, "rename should not generate a break but get a sharing violation\n");
+	ZERO_STRUCT(rn);
+	rn.generic.level = RAW_RENAME_RENAME;
+	rn.rename.in.pattern1 = fname1;
+	rn.rename.in.pattern2 = fname2;
+	rn.rename.in.attrib = 0;
+
+	printf("trying rename while first file open\n");
+	status = smb_raw_rename(cli2->tree, &rn);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 0);
+	CHECK_VAL(break_info.failures, 0);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
 static bool test_raw_oplock_batch1(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
 {
 	const char *fname = BASEDIR "\\test_batch1.dat";
@@ -1352,6 +1735,475 @@ done:
 	return ret;
 }
 
+static bool test_raw_oplock_batch16(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname = BASEDIR "\\test_batch16.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	uint16_t fnum=0, fnum2=0;
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+	smbcli_oplock_handler(cli2->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname;
+
+	torture_comment(tctx, "open with batch oplock\n");
+	ZERO_STRUCT(break_info);
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	ZERO_STRUCT(break_info);
+
+	torture_comment(tctx, "second open with attributes only and NTCREATEX_DISP_OVERWRITE_IF dispostion causes oplock break\n");
+
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE|SEC_FILE_WRITE_ATTRIBUTE|SEC_STD_SYNCHRONIZE;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OVERWRITE_IF;
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, LEVEL_II_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+
+	smbcli_close(cli1->tree, fnum);
+	smbcli_close(cli2->tree, fnum2);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_batch17(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_batch17_1.dat";
+	const char *fname2 = BASEDIR "\\test_batch17_2.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_rename rn;
+	uint16_t fnum=0;
+	bool s3 = torture_setting_bool(tctx, "samba3", false);
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	/* we should use no share mode, when samba3 passes this */
+	torture_comment(tctx, "open a file with an batch oplock (share mode: %s)\n",
+			s3?"all":"none");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	if (s3) {
+		io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+			NTCREATEX_SHARE_ACCESS_WRITE|
+			NTCREATEX_SHARE_ACCESS_DELETE;
+	}
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	torture_comment(tctx, "rename should trigger a break\n");
+	ZERO_STRUCT(rn);
+	rn.generic.level = RAW_RENAME_RENAME;
+	rn.rename.in.pattern1 = fname1;
+	rn.rename.in.pattern2 = fname2;
+	rn.rename.in.attrib = 0;
+
+	printf("trying rename while first file open\n");
+	status = smb_raw_rename(cli2->tree, &rn);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_batch18(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_batch18_1.dat";
+	const char *fname2 = BASEDIR "\\test_batch18_2.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_rename rn;
+	uint16_t fnum=0;
+	bool s3 = torture_setting_bool(tctx, "samba3", false);
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	/* we should use no share mode, when samba3 passes this */
+	torture_comment(tctx, "open a file with an batch oplock (share mode: %s)\n",
+			s3?"all":"none");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	if (s3) {
+		io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+			NTCREATEX_SHARE_ACCESS_WRITE|
+			NTCREATEX_SHARE_ACCESS_DELETE;
+	}
+
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	torture_comment(tctx, "ntrename should trigger a break\n");
+	ZERO_STRUCT(rn);
+	rn.generic.level = RAW_RENAME_NTRENAME;
+	rn.ntrename.in.attrib	= 0;
+	rn.ntrename.in.flags	= RENAME_FLAG_RENAME;
+	rn.ntrename.in.old_name = fname1;
+	rn.ntrename.in.new_name = fname2;
+	printf("trying rename while first file open\n");
+	status = smb_raw_rename(cli2->tree, &rn);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_SHARING_VIOLATION);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_batch19(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_batch19_1.dat";
+	const char *fname2 = BASEDIR "\\test_batch19_2.dat";
+	const char *fname3 = BASEDIR "\\test_batch19_3.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_fileinfo qfi;
+	union smb_setfileinfo sfi;
+	uint16_t fnum=0;
+
+	if (torture_setting_bool(tctx, "samba3", false)) {
+		torture_skip(tctx, "BACHT19 disabled against samba3\n");
+	}
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+	smbcli_unlink(cli1->tree, fname3);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	torture_comment(tctx, "open a file with an batch oplock (share mode: none)\n");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	torture_comment(tctx, "setpathinfo rename info should not trigger a break nor a violation\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_RENAME_INFORMATION;
+	sfi.generic.in.file.path = fname1;
+	sfi.rename_information.in.overwrite	= 0;
+	sfi.rename_information.in.root_fid	= 0;
+	sfi.rename_information.in.new_name	= fname2+strlen(BASEDIR)+1;
+
+        status = smb_raw_setpathinfo(cli2->tree, &sfi);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 0);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum;
+
+	status = smb_raw_fileinfo(cli1->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname2);
+
+	torture_comment(tctx, "setfileinfo rename info should not trigger a break nor a violation\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_RENAME_INFORMATION;
+	sfi.generic.in.file.fnum = fnum;
+	sfi.rename_information.in.overwrite	= 0;
+	sfi.rename_information.in.root_fid	= 0;
+	sfi.rename_information.in.new_name	= fname3+strlen(BASEDIR)+1;
+
+	status = smb_raw_setfileinfo(cli1->tree, &sfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 0);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum;
+
+	status = smb_raw_fileinfo(cli1->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname3);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
+static bool test_raw_oplock_batch20(struct torture_context *tctx, struct smbcli_state *cli1, struct smbcli_state *cli2)
+{
+	const char *fname1 = BASEDIR "\\test_batch20_1.dat";
+	const char *fname2 = BASEDIR "\\test_batch20_2.dat";
+	const char *fname3 = BASEDIR "\\test_batch20_3.dat";
+	NTSTATUS status;
+	bool ret = true;
+	union smb_open io;
+	union smb_fileinfo qfi;
+	union smb_setfileinfo sfi;
+	uint16_t fnum=0,fnum2=0;
+
+	if (torture_setting_bool(tctx, "samba3", false)) {
+		torture_skip(tctx, "BACHT20 disabled against samba3\n");
+	}
+
+	if (!torture_setup_dir(cli1, BASEDIR)) {
+		return false;
+	}
+
+	/* cleanup */
+	smbcli_unlink(cli1->tree, fname1);
+	smbcli_unlink(cli1->tree, fname2);
+	smbcli_unlink(cli1->tree, fname3);
+
+	smbcli_oplock_handler(cli1->transport, oplock_handler_ack_to_levelII, cli1->tree);
+
+	/*
+	  base ntcreatex parms
+	*/
+	io.generic.level = RAW_OPEN_NTCREATEX;
+	io.ntcreatex.in.root_fid = 0;
+	io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
+	io.ntcreatex.in.alloc_size = 0;
+	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
+	io.ntcreatex.in.create_options = 0;
+	io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
+	io.ntcreatex.in.security_flags = 0;
+	io.ntcreatex.in.fname = fname1;
+
+	torture_comment(tctx, "open a file with an batch oplock (share mode: all)\n");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	status = smb_raw_open(cli1->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, BATCH_OPLOCK_RETURN);
+
+	torture_comment(tctx, "setpathinfo rename info should not trigger a break nor a violation\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_RENAME_INFORMATION;
+	sfi.generic.in.file.path = fname1;
+	sfi.rename_information.in.overwrite	= 0;
+	sfi.rename_information.in.root_fid	= 0;
+	sfi.rename_information.in.new_name	= fname2+strlen(BASEDIR)+1;
+
+	status = smb_raw_setpathinfo(cli2->tree, &sfi);
+
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 0);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum;
+
+	status = smb_raw_fileinfo(cli1->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname2);
+
+	/* we should use no share mode, when samba3 passes this */
+	torture_comment(tctx, "open a file with the new name an batch oplock (share mode: all)\n");
+	ZERO_STRUCT(break_info);
+	io.ntcreatex.in.flags = NTCREATEX_FLAGS_EXTENDED |
+		NTCREATEX_FLAGS_REQUEST_OPLOCK |
+		NTCREATEX_FLAGS_REQUEST_BATCH_OPLOCK;
+	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ|
+		NTCREATEX_SHARE_ACCESS_WRITE|
+		NTCREATEX_SHARE_ACCESS_DELETE;
+	io.ntcreatex.in.fname = fname2;
+	status = smb_raw_open(cli2->tree, tctx, &io);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	fnum2 = io.ntcreatex.out.file.fnum;
+	CHECK_VAL(io.ntcreatex.out.oplock_level, LEVEL_II_OPLOCK_RETURN);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+
+	torture_comment(tctx, "setfileinfo rename info should not trigger a break nor a violation\n");
+	ZERO_STRUCT(sfi);
+	sfi.generic.level = RAW_SFILEINFO_RENAME_INFORMATION;
+	sfi.generic.in.file.fnum = fnum;
+	sfi.rename_information.in.overwrite	= 0;
+	sfi.rename_information.in.root_fid	= 0;
+	sfi.rename_information.in.new_name	= fname3+strlen(BASEDIR)+1;
+
+	status = smb_raw_setfileinfo(cli1->tree, &sfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_VAL(break_info.count, 1);
+	CHECK_VAL(break_info.failures, 0);
+	CHECK_VAL(break_info.level, OPLOCK_BREAK_TO_LEVEL_II);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum;
+
+	status = smb_raw_fileinfo(cli1->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname3);
+
+	ZERO_STRUCT(qfi);
+	qfi.generic.level = RAW_FILEINFO_ALL_INFORMATION;
+	qfi.generic.in.file.fnum = fnum2;
+
+	status = smb_raw_fileinfo(cli2->tree, tctx, &qfi);
+	CHECK_STATUS(tctx, status, NT_STATUS_OK);
+	CHECK_STRMATCH(qfi.all_info.out.fname.s, fname3);
+
+	smbcli_close(cli1->tree, fnum);
+
+done:
+	smb_raw_exit(cli1->session);
+	smb_raw_exit(cli2->session);
+	smbcli_deltree(cli1->tree, BASEDIR);
+	return ret;
+}
+
 /* 
    basic testing of oplocks
 */
@@ -1359,7 +2211,12 @@ struct torture_suite *torture_raw_oplock(TALLOC_CTX *mem_ctx)
 {
 	struct torture_suite *suite = torture_suite_create(mem_ctx, "OPLOCK");
 
-	torture_suite_add_2smb_test(suite, "NORMAL", test_raw_oplock_normal);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE1", test_raw_oplock_exclusive1);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE2", test_raw_oplock_exclusive2);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE3", test_raw_oplock_exclusive3);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE4", test_raw_oplock_exclusive4);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE5", test_raw_oplock_exclusive5);
+	torture_suite_add_2smb_test(suite, "EXCLUSIVE6", test_raw_oplock_exclusive6);
 	torture_suite_add_2smb_test(suite, "BATCH1", test_raw_oplock_batch1);
 	torture_suite_add_2smb_test(suite, "BATCH2", test_raw_oplock_batch2);
 	torture_suite_add_2smb_test(suite, "BATCH3", test_raw_oplock_batch3);
@@ -1375,6 +2232,11 @@ struct torture_suite *torture_raw_oplock(TALLOC_CTX *mem_ctx)
 	torture_suite_add_2smb_test(suite, "BATCH13", test_raw_oplock_batch13);
 	torture_suite_add_2smb_test(suite, "BATCH14", test_raw_oplock_batch14);
 	torture_suite_add_2smb_test(suite, "BATCH15", test_raw_oplock_batch15);
+	torture_suite_add_2smb_test(suite, "BATCH16", test_raw_oplock_batch16);
+	torture_suite_add_2smb_test(suite, "BATCH17", test_raw_oplock_batch17);
+	torture_suite_add_2smb_test(suite, "BATCH18", test_raw_oplock_batch18);
+	torture_suite_add_2smb_test(suite, "BATCH19", test_raw_oplock_batch19);
+	torture_suite_add_2smb_test(suite, "BATCH20", test_raw_oplock_batch20);
 
 	return suite;
 }
diff --git a/source4/torture/raw/qfsinfo.c b/source4/torture/raw/qfsinfo.c
index 3207558624..c1c77edba9 100644
--- a/source4/torture/raw/qfsinfo.c
+++ b/source4/torture/raw/qfsinfo.c
@@ -38,7 +38,7 @@ static struct {
 	{"SIZE_INFO",             RAW_QFS_SIZE_INFO, },
 	{"DEVICE_INFO",           RAW_QFS_DEVICE_INFO, },
 	{"ATTRIBUTE_INFO",        RAW_QFS_ATTRIBUTE_INFO, },
-	{"UNIX_INFO",             RAW_QFS_UNIX_INFO,            CAP_UNIX},
+	{"UNIX_INFO",             RAW_QFS_UNIX_INFO, CAP_UNIX},
 	{"VOLUME_INFORMATION",    RAW_QFS_VOLUME_INFORMATION, },
 	{"SIZE_INFORMATION",      RAW_QFS_SIZE_INFORMATION, },
 	{"DEVICE_INFORMATION",    RAW_QFS_DEVICE_INFORMATION, },
@@ -130,7 +130,7 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 
 	/* scan all the levels, pulling the results */
 	for (i=0; levels[i].name; i++) {
-		printf("Running level %s\n", levels[i].name);
+		torture_comment(torture, "Running level %s\n", levels[i].name);
 		levels[i].fsinfo.generic.level = levels[i].level;
 		levels[i].status = smb_raw_fsinfo(cli->tree, torture, &levels[i].fsinfo);
 	}
@@ -151,14 +151,11 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 	}
 
 	if (count != 0) {
-		printf("%d levels failed\n", count);
-		if (count > 13) {
-			printf("too many level failures - giving up\n");
-			return false;
-		}
+		torture_comment(torture, "%d levels failed\n", count);
+		torture_assert(torture, count > 13, "too many level failures - giving up");
 	}
 
-	printf("check for correct aliases\n");
+	torture_comment(torture, "check for correct aliases\n");
 	s1 = find("SIZE_INFO");
 	s2 = find("SIZE_INFORMATION");
 	if (s1 && s2) {
@@ -181,7 +178,7 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 		STRUCT_EQUAL(volume_info, create_time,    volume_info, create_time);
 		VAL_EQUAL   (volume_info, serial_number,  volume_info, serial_number);
 		STR_EQUAL   (volume_info, volume_name.s,    volume_info, volume_name.s);
-		printf("volume_info.volume_name = '%s'\n", s1->volume_info.out.volume_name.s);
+		torture_comment(torture, "volume_info.volume_name = '%s'\n", s1->volume_info.out.volume_name.s);
 	}	
 
 	s1 = find("ATTRIBUTE_INFO");
@@ -192,10 +189,10 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 		VAL_EQUAL(attribute_info, max_file_component_length, 
 			  attribute_info, max_file_component_length);
 		STR_EQUAL(attribute_info, fs_type.s, attribute_info, fs_type.s);
-		printf("attribute_info.fs_type = '%s'\n", s1->attribute_info.out.fs_type.s);
+		torture_comment(torture, "attribute_info.fs_type = '%s'\n", s1->attribute_info.out.fs_type.s);
 	}	
 
-	printf("check for consistent disk sizes\n");
+	torture_comment(torture, "check for consistent disk sizes\n");
 	s1 = find("DSKATTR");
 	s2 = find("ALLOCATION");
 	if (s1 && s2) {
@@ -214,10 +211,10 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 			       size1, size2);
 			ret = false;
 		}
-		printf("total disk = %.0f MB\n", size1*scale/1.0e6);
+		torture_comment(torture, "total disk = %.0f MB\n", size1*scale/1.0e6);
 	}
 
-	printf("check consistent free disk space\n");
+	torture_comment(torture, "check consistent free disk space\n");
 	s1 = find("DSKATTR");
 	s2 = find("ALLOCATION");
 	if (s1 && s2) {
@@ -236,10 +233,10 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 			       size1, size2);
 			ret = false;
 		}
-		printf("free disk = %.0f MB\n", size1*scale/1.0e6);
+		torture_comment(torture, "free disk = %.0f MB\n", size1*scale/1.0e6);
 	}
 	
-	printf("volume info consistency\n");
+	torture_comment(torture, "volume info consistency\n");
 	s1 = find("VOLUME");
 	s2 = find("VOLUME_INFO");
 	if (s1 && s2) {
@@ -287,7 +284,7 @@ bool torture_raw_qfsinfo(struct torture_context *torture,
 		} \
 	}} while (0)
 
-	printf("check for correct termination\n");
+	torture_comment(torture, "check for correct termination\n");
 	
 	STR_CHECK("VOLUME",                volume,         volume_name, 0);
 	STR_CHECK("VOLUME_INFO",           volume_info,    volume_name, STR_UNICODE);
diff --git a/source4/torture/raw/setfileinfo.c b/source4/torture/raw/setfileinfo.c
index e58b3fd760..90ccde7213 100644
--- a/source4/torture/raw/setfileinfo.c
+++ b/source4/torture/raw/setfileinfo.c
@@ -453,6 +453,10 @@ bool torture_raw_sfileinfo_rename(struct torture_context *torture,
 	char *fnum_fname_new;
 	char *path_fname;
 	char *path_fname_new;
+	char *path_dname;
+	char *path_dname_new;
+	char *saved_name;
+	char *saved_name_new;
 	union smb_fileinfo finfo1, finfo2;
 	union smb_setfileinfo sfinfo;
 	NTSTATUS status, status2;
@@ -464,6 +468,8 @@ bool torture_raw_sfileinfo_rename(struct torture_context *torture,
 	asprintf(&path_fname_new, BASEDIR "\\fname_test_new_%d.txt", n);
 	asprintf(&fnum_fname, BASEDIR "\\fnum_test_%d.txt", n);
 	asprintf(&fnum_fname_new, BASEDIR "\\fnum_test_new_%d.txt", n);
+	asprintf(&path_dname, BASEDIR "\\dname_test_%d", n);
+	asprintf(&path_dname_new, BASEDIR "\\dname_test_new_%d", n);
 
 	if (!torture_setup_dir(cli, BASEDIR)) {
 		return false;
@@ -553,17 +559,112 @@ bool torture_raw_sfileinfo_rename(struct torture_context *torture,
 	sfinfo.rename_information.in.root_fid = d_fnum;
 	CHECK_CALL_FNUM(RENAME_INFORMATION, NT_STATUS_INVALID_PARAMETER);
 	CHECK_STR(NAME_INFO, name_info, fname.s, fnum_fname);
+	smbcli_close(cli->tree, d_fnum);
 
-done:
-	smb_raw_exit(cli->session);
-	smbcli_close(cli->tree, fnum);
-	if (NT_STATUS_IS_ERR(smbcli_unlink(cli->tree, fnum_fname))) {
-		printf("Failed to delete %s - %s\n", fnum_fname, smbcli_errstr(cli->tree));
+	printf("Trying rename directory\n");
+	if (!torture_setup_dir(cli, path_dname)) {
+		ret = false;
+		goto done;
 	}
-	if (NT_STATUS_IS_ERR(smbcli_unlink(cli->tree, path_fname))) {
-		printf("Failed to delete %s - %s\n", path_fname, smbcli_errstr(cli->tree));
+	saved_name = path_fname;
+	saved_name_new = path_fname_new;
+	path_fname = path_dname;
+	path_fname_new = path_dname_new;
+	sfinfo.rename_information.in.new_name  = path_dname_new+strlen(BASEDIR)+1;
+	sfinfo.rename_information.in.overwrite = 0;
+	sfinfo.rename_information.in.root_fid  = 0;
+	CHECK_CALL_PATH(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname_new);
+	path_fname = saved_name;
+	path_fname_new = saved_name_new;
+
+	if (torture_setting_bool(torture, "samba3", false)) {
+		printf("SKIP: Trying rename directory with a handle\n");
+		printf("SKIP: Trying rename by path while a handle is open\n");
+		printf("SKIP: Trying rename directory by path while a handle is open\n");
+		goto done;
 	}
 
+	printf("Trying rename directory with a handle\n");
+	status = create_directory_handle(cli->tree, path_dname_new, &d_fnum);
+	fnum_saved = fnum;
+	fnum = d_fnum;
+	saved_name = fnum_fname;
+	saved_name_new = fnum_fname_new;
+	fnum_fname = path_dname;
+	fnum_fname_new = path_dname_new;
+	sfinfo.rename_information.in.new_name  = path_dname+strlen(BASEDIR)+1;
+	sfinfo.rename_information.in.overwrite = 0;
+	sfinfo.rename_information.in.root_fid  = 0;
+	CHECK_CALL_FNUM(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname);
+	smbcli_close(cli->tree, d_fnum);
+	fnum = fnum_saved;
+	fnum_fname = saved_name;
+	fnum_fname_new = saved_name_new;
+
+	printf("Trying rename by path while a handle is open\n");
+	fnum_saved = fnum;
+	fnum = create_complex_file(cli, torture, path_fname);
+	sfinfo.rename_information.in.new_name  = path_fname_new+strlen(BASEDIR)+1;
+	sfinfo.rename_information.in.overwrite = 0;
+	sfinfo.rename_information.in.root_fid  = 0;
+	CHECK_CALL_PATH(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_fname_new);
+	/* check that the handle returns the same name */
+	check_fnum = true;
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_fname_new);
+	/* rename it back on the handle */
+	sfinfo.rename_information.in.new_name  = path_fname+strlen(BASEDIR)+1;
+	CHECK_CALL_FNUM(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_fname);
+	check_fnum = false;
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_fname);
+	smbcli_close(cli->tree, fnum);
+	fnum = fnum_saved;
+
+	printf("Trying rename directory by path while a handle is open\n");
+	status = create_directory_handle(cli->tree, path_dname, &d_fnum);
+	fnum_saved = fnum;
+	fnum = d_fnum;
+	saved_name = path_fname;
+	saved_name_new = path_fname_new;
+	path_fname = path_dname;
+	path_fname_new = path_dname_new;
+	sfinfo.rename_information.in.new_name  = path_dname_new+strlen(BASEDIR)+1;
+	sfinfo.rename_information.in.overwrite = 0;
+	sfinfo.rename_information.in.root_fid  = 0;
+	CHECK_CALL_PATH(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname_new);
+	path_fname = saved_name;
+	path_fname_new = saved_name_new;
+	saved_name = fnum_fname;
+	saved_name_new = fnum_fname_new;
+	fnum_fname = path_dname;
+	fnum_fname_new = path_dname_new;
+	/* check that the handle returns the same name */
+	check_fnum = true;
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname_new);
+	/* rename it back on the handle */
+	sfinfo.rename_information.in.new_name  = path_dname+strlen(BASEDIR)+1;
+	CHECK_CALL_FNUM(RENAME_INFORMATION, NT_STATUS_OK);
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname);
+	fnum_fname = saved_name;
+	fnum_fname_new = saved_name_new;
+	saved_name = path_fname;
+	saved_name_new = path_fname_new;
+	path_fname = path_dname;
+	path_fname_new = path_dname_new;
+	check_fnum = false;
+	CHECK_STR(NAME_INFO, name_info, fname.s, path_dname);
+	smbcli_close(cli->tree, d_fnum);
+	fnum = fnum_saved;
+	path_fname = saved_name;
+	path_fname_new = saved_name_new;
+
+done:
+	smb_raw_exit(cli->session);
+	smbcli_deltree(cli->tree, BASEDIR);
 	return ret;
 }
 
diff --git a/source4/torture/rpc/dssync.c b/source4/torture/rpc/dssync.c
index 4417285e04..b28e429a75 100644
--- a/source4/torture/rpc/dssync.c
+++ b/source4/torture/rpc/dssync.c
@@ -255,7 +255,7 @@ static bool test_GetInfo(struct torture_context *tctx, struct DsSyncTest *ctx)
 	struct drsuapi_DsNameString names[1];
 	bool ret = true;
 
-	struct cldap_socket *cldap = cldap_socket_init(ctx, NULL);
+	struct cldap_socket *cldap = cldap_socket_init(ctx, NULL, lp_iconv_convenience(tctx->lp_ctx));
 	struct cldap_netlogon search;
 	
 	r.in.bind_handle		= &ctx->admin.drsuapi.bind_handle;
diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
index 9d6c73891b..1d6ec43399 100644
--- a/source4/torture/rpc/samr.c
+++ b/source4/torture/rpc/samr.c
@@ -416,11 +416,6 @@ static bool test_SetUserInfo(struct dcerpc_pipe *p, struct torture_context *tctx
 	TEST_USERINFO_INT(21, logon_hours.bits[3], 21, logon_hours.bits[3], 4, 
 			  SAMR_FIELD_LOGON_HOURS);
 
-	if (torture_setting_bool(tctx, "samba4", false)) {
-		printf("skipping Set Account Flag tests against Samba4\n");
-		return ret;
-	}
-
 	TEST_USERINFO_INT_EXP(16, acct_flags, 5, acct_flags, 
 			      (base_acct_flags  | ACB_DISABLED | ACB_HOMDIRREQ), 
 			      (base_acct_flags  | ACB_DISABLED | ACB_HOMDIRREQ | user_extra_flags), 
@@ -1989,9 +1984,12 @@ static bool test_user_ops(struct dcerpc_pipe *p,
 			  const char *base_acct_name, enum torture_samr_choice which_ops)
 {
 	char *password = NULL;
+	struct samr_QueryUserInfo q;
+	NTSTATUS status;
 
 	bool ret = true;
 	int i;
+	uint32_t rid;
 	const uint32_t password_fields[] = {
 		SAMR_FIELD_PASSWORD,
 		SAMR_FIELD_PASSWORD2,
@@ -1999,6 +1997,11 @@ static bool test_user_ops(struct dcerpc_pipe *p,
 		0
 	};
 	
+	status = test_LookupName(p, tctx, domain_handle, base_acct_name, &rid);
+	if (!NT_STATUS_IS_OK(status)) {
+		ret = false;
+	}
+
 	switch (which_ops) {
 	case TORTURE_SAMR_USER_ATTRIBUTES:
 		if (!test_QuerySecurity(p, tctx, user_handle)) {
@@ -2091,6 +2094,29 @@ static bool test_user_ops(struct dcerpc_pipe *p,
 			ret = false;
 		}	
 
+		q.in.user_handle = user_handle;
+		q.in.level = 5;
+		
+		status = dcerpc_samr_QueryUserInfo(p, tctx, &q);
+		if (!NT_STATUS_IS_OK(status)) {
+			printf("QueryUserInfo level %u failed - %s\n", 
+			       q.in.level, nt_errstr(status));
+			ret = false;
+		} else {
+			uint32_t expected_flags = (base_acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
+			if ((q.out.info->info5.acct_flags) != expected_flags) {
+				printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
+				       q.out.info->info5.acct_flags, 
+				       expected_flags);
+				ret = false;
+			}
+			if (q.out.info->info5.rid != rid) {
+				printf("QuerUserInfo level 5 failed, it returned %u when we expected rid of %u\n",
+				       q.out.info->info5.rid, rid);
+
+			}
+		}
+
 		break;
 	case TORTURE_SAMR_OTHER:
 		/* We just need the account to exist */
@@ -2667,10 +2693,14 @@ static bool test_CreateUser2(struct dcerpc_pipe *p, struct torture_context *tctx
 				       q.in.level, nt_errstr(status));
 				ret = false;
 			} else {
-				if ((q.out.info->info5.acct_flags & acct_flags) != acct_flags) {
+				uint32_t expected_flags = (acct_flags | ACB_PWNOTREQ | ACB_DISABLED);
+				if (acct_flags == ACB_NORMAL) {
+					expected_flags |= ACB_PW_EXPIRED;
+				}
+				if ((q.out.info->info5.acct_flags) != expected_flags) {
 					printf("QuerUserInfo level 5 failed, it returned 0x%08x when we expected flags of 0x%08x\n",
 					       q.out.info->info5.acct_flags, 
-					       acct_flags);
+					       expected_flags);
 					ret = false;
 				} 
 				switch (acct_flags) {
@@ -3887,7 +3917,6 @@ static bool test_GroupList(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			for (j=0; j<num_names; j++) {
 				if (names[j] == NULL)
 					continue;
-				/* Hmm. No strequal in samba4 */
 				if (strequal(names[j], name)) {
 					names[j] = NULL;
 					found = true;
diff --git a/source4/torture/t_strcmp.c b/source4/torture/t_strcmp.c
deleted file mode 100644
index 15d000c98f..0000000000
--- a/source4/torture/t_strcmp.c
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) 2003 by Martin Pool
- *
- * Test harness for strcasecmp_m
- */
-
-#include "includes.h"
-
-int main(int argc, char *argv[])
-{
-	if (argc != 3) {
-		fprintf(stderr, "usage: %s STRING1 STRING2\nCompares two strings\n",
-			argv[0]);
-		return 2;
-	}
-	
-	printf("%d\n", strcasecmp_m(argv[1], argv[2]));
-	
-	return 0;
-}
diff --git a/source4/utils/config.mk b/source4/utils/config.mk
index 6ef7e40471..9ebfbbb7e3 100644
--- a/source4/utils/config.mk
+++ b/source4/utils/config.mk
@@ -17,14 +17,14 @@ PRIVATE_DEPENDENCIES = \
 		auth \
 		MESSAGING \
 		LIBEVENTS
-MANPAGE = man/ntlm_auth.1
 # End BINARY ntlm_auth
 #################################
 
+MANPAGES += utils/man/ntlm_auth.1
+
 #################################
 # Start BINARY getntacl
 [BINARY::getntacl]
-MANPAGE = man/getntacl.1
 INSTALLDIR = BINDIR
 OBJ_FILES = \
 		getntacl.o
@@ -38,6 +38,8 @@ PRIVATE_DEPENDENCIES = \
 # End BINARY getntacl
 #################################
 
+MANPAGES += utils/man/getntacl.1
+
 #################################
 # Start BINARY setntacl
 [BINARY::setntacl]
diff --git a/source4/utils/nmblookup.c b/source4/utils/nmblookup.c
index 7eae9c7765..fe03e0dbbe 100644
--- a/source4/utils/nmblookup.c
+++ b/source4/utils/nmblookup.c
@@ -211,7 +211,7 @@ static bool process_one(struct loadparm_context *lp_ctx,
 		node_name = talloc_strdup(tmp_ctx, name);
 	}
 
-	nbtsock = nbt_name_socket_init(tmp_ctx, NULL);
+	nbtsock = nbt_name_socket_init(tmp_ctx, NULL, lp_iconv_convenience(lp_ctx));
 	
 	if (options.root_port) {
 		all_zero_addr = socket_address_from_strings(tmp_ctx, nbtsock->sock->backend_name, 
diff --git a/source4/utils/testparm.c b/source4/utils/testparm.c
index a4ff522186..286a4a61fb 100644
--- a/source4/utils/testparm.c
+++ b/source4/utils/testparm.c
@@ -93,8 +93,8 @@ static int do_share_checks(struct loadparm_context *lp_ctx, const char *cname, c
 	for (s=0;s<lp_numservices(lp_ctx);s++) {
 		struct loadparm_service *service = lp_servicebynum(lp_ctx, s);
 		if (service != NULL) {
-			const char **deny_list = lp_hostsdeny(service);
-			const char **allow_list = lp_hostsallow(service);
+			const char **deny_list = lp_hostsdeny(service, lp_default_service(lp_ctx));
+			const char **allow_list = lp_hostsallow(service, lp_default_service(lp_ctx));
 			int i;
 			if(deny_list) {
 				for (i=0; deny_list[i]; i++) {
@@ -139,7 +139,7 @@ static int do_share_checks(struct loadparm_context *lp_ctx, const char *cname, c
 					return(1);
 			}
 			if (!parameter_name) {
-				lp_dump_one(stdout, show_defaults, service);
+				lp_dump_one(stdout, show_defaults, service, lp_default_service(lp_ctx));
 			} else {
 				ret = !lp_dump_a_parameter(lp_ctx, service, parameter_name, stdout);
 			}
@@ -154,8 +154,8 @@ static int do_share_checks(struct loadparm_context *lp_ctx, const char *cname, c
 		for (s=0;s<lp_numservices(lp_ctx);s++) {
 			struct loadparm_service *service = lp_servicebynum(lp_ctx, s);
 			if (service != NULL) {
-				if (allow_access(NULL, lp_hostsdeny(NULL), lp_hostsallow(NULL), cname, caddr)
-				    && allow_access(NULL, lp_hostsdeny(service), lp_hostsallow(service), cname, caddr)) {
+				if (allow_access(NULL, lp_hostsdeny(NULL, lp_default_service(lp_ctx)), lp_hostsallow(NULL, lp_default_service(lp_ctx)), cname, caddr)
+				    && allow_access(NULL, lp_hostsdeny(service, lp_default_service(lp_ctx)), lp_hostsallow(service, lp_default_service(lp_ctx)), cname, caddr)) {
 					fprintf(stderr,"Allow connection from %s (%s) to %s\n",
 						   cname,caddr,lp_servicename(service));
 				} else {
diff --git a/source4/winbind/wb_dom_info.c b/source4/winbind/wb_dom_info.c
index 7558fc9d62..4fcbf3a6e5 100644
--- a/source4/winbind/wb_dom_info.c
+++ b/source4/winbind/wb_dom_info.c
@@ -71,6 +71,7 @@ struct composite_context *wb_get_dom_info_send(TALLOC_CTX *mem_ctx,
 			   lp_nbt_port(service->task->lp_ctx),
 			   domain_name, NBT_NAME_LOGON, 
 			   dom_sid, 
+			   lp_iconv_convenience(service->task->lp_ctx),
 			   lp_resolve_context(service->task->lp_ctx), 
 			   service->task->event_ctx, 
 			   service->task->msg_ctx);
diff --git a/source4/winbind/wb_pam_auth.c b/source4/winbind/wb_pam_auth.c
index 0073e3fdf8..62744297c6 100644
--- a/source4/winbind/wb_pam_auth.c
+++ b/source4/winbind/wb_pam_auth.c
@@ -143,7 +143,7 @@ static void pam_auth_crap_recv_logon(struct composite_context *ctx)
 	if (!composite_is_ok(state->ctx)) return;
 
 	ndr_err = ndr_push_struct_blob(
-		&tmp_blob, state, lp_iconv_convenience(global_loadparm), 
+		&tmp_blob, state, lp_iconv_convenience(state->lp_ctx), 
 		state->req->out.validation.sam3,
 		(ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
diff --git a/source4/wrepl_server/wrepl_out_helpers.c b/source4/wrepl_server/wrepl_out_helpers.c
index f809095f22..12605196ab 100644
--- a/source4/wrepl_server/wrepl_out_helpers.c
+++ b/source4/wrepl_server/wrepl_out_helpers.c
@@ -30,6 +30,7 @@
 #include "libcli/composite/composite.h"
 #include "libcli/wrepl/winsrepl.h"
 #include "libcli/resolve/resolve.h"
+#include "param/param.h"
 
 enum wreplsrv_out_connect_stage {
 	WREPLSRV_OUT_CONNECT_STAGE_WAIT_SOCKET,
@@ -186,14 +187,14 @@ static struct composite_context *wreplsrv_out_connect_send(struct wreplsrv_partn
 
 	wreplconn->service	= service;
 	wreplconn->partner	= partner;
-	wreplconn->sock		= wrepl_socket_init(wreplconn, service->task->event_ctx);
+	wreplconn->sock		= wrepl_socket_init(wreplconn, service->task->event_ctx, lp_iconv_convenience(service->task->lp_ctx));
 	if (!wreplconn->sock) goto failed;
 
 	state->stage	= WREPLSRV_OUT_CONNECT_STAGE_WAIT_SOCKET;
 	state->wreplconn= wreplconn;
 	state->c_req	= wrepl_connect_send(wreplconn->sock,
 					     lp_resolve_context(service->task->lp_ctx),
-					     partner->our_address,
+					     partner->our_address?partner->our_address:wrepl_best_ip(service->task->lp_ctx, partner->address),
 					     partner->address);
 	if (!state->c_req) goto failed;
 
diff --git a/testprogs/ejs/ldap.js b/testprogs/ejs/ldap.js
index 090f93b6ca..c30f29e249 100755
--- a/testprogs/ejs/ldap.js
+++ b/testprogs/ejs/ldap.js
@@ -29,14 +29,19 @@ function basic_tests(ldb, gc_ldb, base_dn, configuration_dn, schema_dn)
 {
 	println("Running basic tests");
 
+	ldb.del("cn=ldaptestcomputer,cn=computers," + base_dn);
+	ldb.del("cn=ldaptestcomputer3,cn=computers," + base_dn);
+	ldb.del("cn=ldaptest2computer,cn=computers," + base_dn);
 	ldb.del("cn=ldaptestuser,cn=users," + base_dn);
 	ldb.del("cn=ldaptestuser2,cn=users," + base_dn);
 	ldb.del("cn=ldaptestuser3,cn=users," + base_dn);
 	ldb.del("cn=ldaptestuser4,cn=users," + base_dn);
 	ldb.del("cn=ldaptestuser5,cn=users," + base_dn);
 	ldb.del("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn);
+	ldb.del("cn=ldaptestuser7,cn=users," + base_dn);
 	ldb.del("CN=ldaptestcontainer2," + base_dn);
 	ldb.del("cn=ldaptestgroup,cn=users," + base_dn);
+	ldb.del("cn=ldaptestgroup2,cn=users," + base_dn);
 
 	println("Testing group add with invalid member");
 	var ok = ldb.add("
@@ -127,7 +132,7 @@ displayname: ldap testy
 		ok = ldb.del("cn=ldaptest2computer,cn=computers," + base_dn);
 		if (ok.error != 0) {
 			println(ok.errstr);
-			assert(ok.error == 0);
+		//	assert(ok.error == 0);
 		}
 		ok = ldb.add("
 dn: cn=ldaptest2computer,cn=computers," + base_dn + "
@@ -142,6 +147,113 @@ displayname: ldap testy
 		}
 	}
 
+	var ok = ldb.add("
+dn: cn=ldaptestcomputer3,cn=computers," + base_dn + "
+objectClass: computer
+cn: LDAPtest2COMPUTER
+");
+	if (ok.error != 34) {
+		println("Did not reject invalid RDN compared with DN: " + ok.errstr);
+		assert(ok.error == 34);
+	}
+
+	var ok = ldb.add("
+dn: cn=ldaptestcomputer3,cn=computers," + base_dn + "
+objectClass: computer
+cn: LDAPtestCOMPUTER3
+sAMAccountType: 805306368
+");
+
+	if (ok.error != 53) {
+		println("Did not reject invalid 'sAMAccountType: 805306368': " + ok.errstr);
+		assert(ok.error == 53);
+	}
+
+	var ok = ldb.add("
+dn: cn=ldaptestcomputer3,cn=computers," + base_dn + "
+objectClass: computer
+cn: LDAPtestCOMPUTER3
+userAccountControl: 0
+");
+
+	if (ok.error != 53) {
+		println("Did not reject invalid 'userAccountControl: 0': " + ok.errstr);
+		assert(ok.error == 53);
+	}
+
+	var ok = ldb.add("
+dn: cn=ldaptestuser7,cn=users," + base_dn + "
+objectClass: user
+cn: LDAPtestuser7
+userAccountControl: 0
+");
+
+	if (ok.error != 53) {
+		println("Did not reject invalid 'userAccountControl: 0': " + ok.errstr);
+		assert(ok.error == 53);
+	}
+
+	var ok = ldb.add("
+dn: cn=ldaptestuser7,cn=users," + base_dn + "
+objectClass: user
+cn: LDAPtestuser7
+userAccountControl: 2
+");
+
+	if (ok.error != 0) {
+		println("Did not accept 'userAccountControl: 2': " + ok.errstr);
+		assert(ok.error == 0);
+	}
+
+	    ldb.del("cn=ldaptestuser7,cn=users," + base_dn);
+
+	var ok = ldb.add("
+dn: cn=ldaptestcomputer3,cn=computers," + base_dn + "
+objectclass: computer
+cN: LDAPtestCOMPUTER3
+");
+	if (ok.error != 0) {
+		ok = ldb.del("cn=ldaptestcomputer3,cn=computers," + base_dn);
+		if (ok.error != 0) {
+			println(ok.errstr);
+			assert(ok.error == 0);
+		}
+		ok = ldb.add("
+dn: cn=ldaptestcomputer3,cn=computers," + base_dn + "
+objectClass: computer
+cn: LDAPtestCOMPUTER3
+");
+		if (ok.error != 0) {
+			println(ok.errstr);
+			assert(ok.error == 0);
+		}
+	}
+
+	println("Testing ldb.search for (&(cn=ldaptestcomputer3)(objectClass=user))");
+	var res = ldb.search("(&(cn=ldaptestcomputer3)(objectClass=user))");
+	if (res.error != 0 || res.msgs.length != 1) {
+		println("Could not find (&(cn=ldaptestcomputer3)(objectClass=user))");
+		assert(res.error == 0);
+		assert(res.msgs.length == 1);
+	}
+
+	assert(res.msgs[0].dn == ("CN=ldaptestcomputer3,CN=Computers," + base_dn));
+	assert(res.msgs[0].cn == "ldaptestcomputer3");
+	assert(res.msgs[0].name == "ldaptestcomputer3");
+	assert(res.msgs[0].objectClass[0] == "top");
+	assert(res.msgs[0].objectClass[1] == "person");
+	assert(res.msgs[0].objectClass[2] == "organizationalPerson");
+	assert(res.msgs[0].objectClass[3] == "user");
+	assert(res.msgs[0].objectClass[4] == "computer");
+	assert(res.msgs[0].objectGUID != undefined);
+	assert(res.msgs[0].whenCreated != undefined);
+	assert(res.msgs[0].objectCategory == ("CN=Computer,CN=Schema,CN=Configuration," + base_dn));
+	assert(res.msgs[0].primaryGroupID == 513);
+	assert(res.msgs[0].sAMAccountType == 805306368);
+	assert(res.msgs[0].userAccountControl == 546);
+
+	    ldb.del(res.msgs[0].dn);
+
 	    println("Testing attribute or value exists behaviour");
 	    ok = ldb.modify("
 dn: cn=ldaptest2computer,cn=computers," + base_dn + "
@@ -374,6 +486,13 @@ sn: ldap user2
 		assert(res.msgs.length == 2);
 	}
 
+	var res = ldb.search("(&(anr=testy ldap)(objectClass=user))");
+	if (res.error != 0 || res.msgs.length != 2) {
+		println("Found only " + res.msgs.length + " for (&(anr=\"testy ldap\")(objectClass=user))");
+		assert(res.error == 0);
+		assert(res.msgs.length == 2);
+	}
+
 // Testing ldb.search for (&(anr=ldap)(objectClass=user))
 	var res = ldb.search("(&(anr=ldap)(objectClass=user))");
 	if (res.error != 0 || res.msgs.length != 4) {
@@ -547,6 +666,38 @@ member: cn=ldaptestuser3,cn=users," + base_dn + "
 	assert(res.msgs[0].cn == "ldaptestUSER3");
 	assert(res.msgs[0].name == "ldaptestUSER3");
 
+	println("Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))");
+	var res = ldb.search("(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))");
+	if (res.error != 0 || res.msgs.length != 1) {
+		println("Could not find (&(cn=ldaptestuser3)(objectClass=user))");
+		assert(res.error == 0);
+		assert(res.msgs.length == 1);
+	}
+
+	assert(res.msgs[0].dn == ("CN=ldaptestUSER3,CN=Users," + base_dn));
+	assert(res.msgs[0].cn == "ldaptestUSER3");
+	assert(res.msgs[0].name == "ldaptestUSER3");
+
+	println("Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))");
+	var res = ldb.search("(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))");
+	if (res.error != 0 || res.msgs.length != 1) {
+		println("Could not find (&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))");
+		assert(res.error == 0);
+		assert(res.msgs.length == 1);
+	}
+
+	assert(res.msgs[0].dn == ("CN=ldaptestUSER3,CN=Users," + base_dn));
+	assert(res.msgs[0].cn == "ldaptestUSER3");
+	assert(res.msgs[0].name == "ldaptestUSER3");
+
+	println("Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))");
+	var res = ldb.search("(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))");
+	if (res.error != 0 || res.msgs.length != 0) {
+		println("Should not find (&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))");
+		assert(res.error == 0);
+		assert(res.msgs.length == 0);
+	}
+
 // This is a Samba special, and does not exist in real AD
 //	println("Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")");
 //	var res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")");
@@ -840,7 +991,7 @@ objectClass: user
 	assert(res.msgs[0].whenCreated != undefined);
 	assert(res.msgs[0].objectCategory == ("CN=Person,CN=Schema,CN=Configuration," + base_dn));
 	assert(res.msgs[0].sAMAccountType == 805306368);
-//	assert(res[0].userAccountControl == 546);
+	assert(res.msgs[0].userAccountControl == 546);
 	assert(res.msgs[0].memberOf[0] == ("CN=ldaptestgroup2,CN=Users," + base_dn));
 	assert(res.msgs[0].memberOf.length == 1);
  
@@ -901,7 +1052,7 @@ objectClass: user
 	println("Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))");
 	var res = ldb.search("(&(cn=ldaptestcomputer)(objectClass=user))");
 	if (res.error != 0 || res.msgs.length != 1) {
-		println("Could not find (&(cn=ldaptestuser)(objectClass=user))");
+		println("Could not find (&(cn=ldaptestcomputer)(objectClass=user))");
 		assert(res.error == 0);
 		assert(res.msgs.length == 1);
 	}
@@ -916,12 +1067,9 @@ objectClass: user
 	assert(res.msgs[0].objectClass[4] == "computer");
 	assert(res.msgs[0].objectGUID != undefined);
 	assert(res.msgs[0].whenCreated != undefined);
-	assert(res.msgs[0].objectCategory == ("CN=Computer,CN=Schema,CN=Configuration," + base_dn));
-	assert(res.msgs[0].primaryGroupID == 513);
-//	assert(res.msgs[0].sAMAccountType == 805306368);
-//	assert(res.msgs[0].userAccountControl == 546);
-	assert(res.msgs[0].memberOf[0] == ("CN=ldaptestgroup2,CN=Users," + base_dn));
-	assert(res.msgs[0].memberOf.length == 1);
+	assert(res.msgs[0].objectCategory == "cn=Computer,cn=Schema,cn=Configuration," + base_dn);
+	assert(res.msgs[0].sAMAccountType == 805306368);
+	assert(res.msgs[0].userAccountControl == 546);
 
 	println("Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))");
 	var res2 = ldb.search("(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))");
@@ -1023,7 +1171,7 @@ objectClass: user
 	assert(res.msgs[0].whenCreated != undefined);
 	assert(res.msgs[0].objectCategory == "cn=Computer,cn=Schema,cn=Configuration," + base_dn);
 	assert(res.msgs[0].sAMAccountType == 805306369);
-//	assert(res.msgs[0].userAccountControl == 4098);
+	assert(res.msgs[0].userAccountControl == 4096);
 
 
    	ok = ldb.del(res.msgs[0].dn);