Merge branch 'master' of ssh://git.samba.org/data/git/samba into master-devel

38 files changed, 1245 insertions, 749 deletions

diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl
index 04d8eedcb2..3eb686fe15 100644
--- a/librpc/idl/svcctl.idl
+++ b/librpc/idl/svcctl.idl
@@ -266,11 +266,24 @@ import "misc.idl";
 
 	/*****************/
 	/* Function 0x11 */
+
+	typedef [public,gensize] struct {
+		uint32 service_type;
+		uint32 start_type;
+		uint32 error_control;
+		[string,charset(UTF16)] [range(0,8192)] uint16 *executablepath;
+		[string,charset(UTF16)] [range(0,8192)] uint16 *loadordergroup;
+		uint32 tag_id;
+		[string,charset(UTF16)] [range(0,8192)] uint16 *dependencies;
+		[string,charset(UTF16)] [range(0,8192)] uint16 *startname;
+		[string,charset(UTF16)] [range(0,8192)] uint16 *displayname;
+	} QUERY_SERVICE_CONFIG;
+
 	WERROR svcctl_QueryServiceConfigW(
 		[in,ref] policy_handle *handle,
-		[out] uint8 query[buf_size], /*QUERY_SERVICE_CONFIG */
-		[in] uint32 buf_size,
-		[out,ref] uint32 *bytes_needed
+		[out] QUERY_SERVICE_CONFIG *query,
+		[in] [range(0,8192)] uint32 buf_size,
+		[out,ref] [range(0,8192)] uint32 *bytes_needed
 	);
 
 	/*****************/
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 3c196dbd5a..dd9f022e46 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -7172,8 +7172,6 @@ WERROR rpccli_spoolss_rffpcnex(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 WERROR rpccli_svcctl_enumerate_services( struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
                                       POLICY_HND *hSCM, uint32 type, uint32 state, 
 				      uint32 *returned, ENUM_SERVICES_STATUS **service_array  );
-WERROR rpccli_svcctl_query_config(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
-                                POLICY_HND *hService, SERVICE_CONFIG *config );
 
 /* The following definitions come from rpc_client/init_lsa.c  */
 
@@ -8166,11 +8164,8 @@ bool convert_port_data_1( NT_PORT_DATA_1 *port1, RPC_BUFFER *buf ) ;
 bool svcctl_io_enum_services_status( const char *desc, ENUM_SERVICES_STATUS *enum_status, RPC_BUFFER *buffer, int depth );
 bool svcctl_io_service_status_process( const char *desc, SERVICE_STATUS_PROCESS *status, RPC_BUFFER *buffer, int depth );
 uint32 svcctl_sizeof_enum_services_status( ENUM_SERVICES_STATUS *status );
-uint32 svcctl_sizeof_service_config( SERVICE_CONFIG *config );
 bool svcctl_io_q_enum_services_status(const char *desc, SVCCTL_Q_ENUM_SERVICES_STATUS *q_u, prs_struct *ps, int depth);
 bool svcctl_io_r_enum_services_status(const char *desc, SVCCTL_R_ENUM_SERVICES_STATUS *r_u, prs_struct *ps, int depth);
-bool svcctl_io_q_query_service_config(const char *desc, SVCCTL_Q_QUERY_SERVICE_CONFIG *q_u, prs_struct *ps, int depth);
-bool svcctl_io_r_query_service_config(const char *desc, SVCCTL_R_QUERY_SERVICE_CONFIG *r_u, prs_struct *ps, int depth);
 bool svcctl_io_q_query_service_config2(const char *desc, SVCCTL_Q_QUERY_SERVICE_CONFIG2 *q_u, prs_struct *ps, int depth);
 void init_service_description_buffer(SERVICE_DESCRIPTION *desc, const char *service_desc );
 bool svcctl_io_service_description( const char *desc, SERVICE_DESCRIPTION *description, RPC_BUFFER *buffer, int depth );
@@ -9096,7 +9091,6 @@ WERROR _svcctl_ControlService(pipes_struct *p,
 WERROR _svcctl_EnumDependentServicesW(pipes_struct *p,
 				      struct svcctl_EnumDependentServicesW *r);
 WERROR _svcctl_query_service_status_ex( pipes_struct *p, SVCCTL_Q_QUERY_SERVICE_STATUSEX *q_u, SVCCTL_R_QUERY_SERVICE_STATUSEX *r_u );
-WERROR _svcctl_query_service_config( pipes_struct *p, SVCCTL_Q_QUERY_SERVICE_CONFIG *q_u, SVCCTL_R_QUERY_SERVICE_CONFIG *r_u );
 WERROR _svcctl_query_service_config2( pipes_struct *p, SVCCTL_Q_QUERY_SERVICE_CONFIG2 *q_u, SVCCTL_R_QUERY_SERVICE_CONFIG2 *r_u );
 WERROR _svcctl_LockServiceDatabase(pipes_struct *p,
 				   struct svcctl_LockServiceDatabase *r);
diff --git a/source3/include/rpc_svcctl.h b/source3/include/rpc_svcctl.h
index aa1d1662c8..0e31a53e32 100644
--- a/source3/include/rpc_svcctl.h
+++ b/source3/include/rpc_svcctl.h
@@ -142,18 +142,6 @@ typedef struct {
 } ENUM_SERVICES_STATUS;
 
 typedef struct {
-	uint32 service_type;
-	uint32 start_type;
-	uint32 error_control;
-	UNISTR2 *executablepath;
-	UNISTR2 *loadordergroup;
-	uint32 tag_id;
-	UNISTR2 *dependencies;
-	UNISTR2 *startname;
-	UNISTR2 *displayname;
-} SERVICE_CONFIG;
-
-typedef struct {
 	uint32 unknown;	
         UNISTR description;
 } SERVICE_DESCRIPTION;
@@ -216,20 +204,6 @@ typedef struct {
 
 typedef struct {
 	POLICY_HND handle;
-	uint32 buffer_size;
-} SVCCTL_Q_QUERY_SERVICE_CONFIG;
-
-typedef struct {
-	SERVICE_CONFIG config;
-	uint32 needed;
-	WERROR status;
-} SVCCTL_R_QUERY_SERVICE_CONFIG;
-
-
-/**************************/
-
-typedef struct {
-	POLICY_HND handle;
 	uint32 level;
 	uint32 buffer_size;
 } SVCCTL_Q_QUERY_SERVICE_CONFIG2;
diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c
index 485212b100..3ec3220900 100644
--- a/source3/lib/charcnv.c
+++ b/source3/lib/charcnv.c
@@ -1166,7 +1166,7 @@ static size_t pull_ascii_base_talloc(TALLOC_CTX *ctx,
 					int flags)
 {
 	char *dest = NULL;
-	size_t converted_size;
+	size_t dest_len;
 
 #ifdef DEVELOPER
 	/* Ensure we never use the braindead "malloc" varient. */
@@ -1177,6 +1177,10 @@ static size_t pull_ascii_base_talloc(TALLOC_CTX *ctx,
 
 	*ppdest = NULL;
 
+	if (!src_len) {
+		return 0;
+	}
+
 	if (flags & STR_TERMINATE) {
 		if (src_len == (size_t)-1) {
 			src_len = strlen((const char *)src) + 1;
@@ -1194,18 +1198,41 @@ static size_t pull_ascii_base_talloc(TALLOC_CTX *ctx,
 					(unsigned int)src_len);
 			smb_panic(msg);
 		}
+	} else {
+		/* Can't have an unlimited length
+ 		 * non STR_TERMINATE'd.
+ 		 */
+		if (src_len == (size_t)-1) {
+			errno = EINVAL;
+			return 0;
+		}
 	}
 
+	/* src_len != -1 here. */
+
 	if (!convert_string_allocate(ctx, CH_DOS, CH_UNIX, src, src_len, &dest,
-				     &converted_size, True))
-	{
-		converted_size = 0;
+				     &dest_len, True)) {
+		dest_len = 0;
 	}
 
-	if (converted_size && dest) {
+	if (dest_len && dest) {
 		/* Did we already process the terminating zero ? */
-		if (dest[converted_size - 1] != 0) {
-			dest[converted_size - 1] = 0;
+		if (dest[dest_len-1] != 0) {
+			size_t size = talloc_get_size(dest);
+			/* Have we got space to append the '\0' ? */
+			if (size <= dest_len) {
+				/* No, realloc. */
+				dest = TALLOC_REALLOC_ARRAY(ctx, dest, char,
+						dest_len+1);
+				if (!dest) {
+					/* talloc fail. */
+					dest_len = (size_t)-1;
+					return 0;
+				}
+			}
+			/* Yay - space ! */
+			dest[dest_len] = '\0';
+			dest_len++;
 		}
 	} else if (dest) {
 		dest[0] = 0;
@@ -1562,21 +1589,26 @@ size_t pull_ucs2_base_talloc(TALLOC_CTX *ctx,
 		if (src_len >= 1024*1024) {
 			smb_panic("Bad src length in pull_ucs2_base_talloc\n");
 		}
+	} else {
+		/* Can't have an unlimited length
+		 * non STR_TERMINATE'd.
+		 */
+		if (src_len == (size_t)-1) {
+			errno = EINVAL;
+			return 0;
+		}
 	}
 
+	/* src_len != -1 here. */
+
 	/* ucs2 is always a multiple of 2 bytes */
-	if (src_len != (size_t)-1) {
-		src_len &= ~1;
-	}
+	src_len &= ~1;
 
 	if (!convert_string_talloc(ctx, CH_UTF16LE, CH_UNIX, src, src_len,
 				   (void *)&dest, &dest_len, True)) {
 		dest_len = 0;
 	}
 
-	if (src_len == (size_t)-1)
-		src_len = dest_len*2;
-
 	if (dest_len) {
 		/* Did we already process the terminating zero ? */
 		if (dest[dest_len-1] != 0) {
diff --git a/source3/libnet/libnet_dssync.c b/source3/libnet/libnet_dssync.c
index bae03effed..d388615b01 100644
--- a/source3/libnet/libnet_dssync.c
+++ b/source3/libnet/libnet_dssync.c
@@ -539,17 +539,24 @@ static NTSTATUS libnet_dssync_getncchanges(TALLOC_CTX *mem_ctx,
 		if (level_out == 1) {
 			out_level = 1;
 			ctr1 = &ctr.ctr1;
-		} else if (level_out == 2) {
+		} else if (level_out == 2 && ctr.ctr2.mszip1.ts) {
 			out_level = 1;
-			ctr1 = ctr.ctr2.ctr.mszip1.ctr1;
+			ctr1 = &ctr.ctr2.mszip1.ts->ctr1;
 		} else if (level_out == 6) {
 			out_level = 6;
 			ctr6 = &ctr.ctr6;
 		} else if (level_out == 7
 			   && ctr.ctr7.level == 6
-			   && ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP) {
+			   && ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP
+			   && ctr.ctr7.ctr.mszip6.ts) {
 			out_level = 6;
-			ctr6 = ctr.ctr7.ctr.mszip6.ctr6;
+			ctr6 = &ctr.ctr7.ctr.mszip6.ts->ctr6;
+		} else if (level_out == 7
+			   && ctr.ctr7.level == 6
+			   && ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS
+			   && ctr.ctr7.ctr.xpress6.ts) {
+			out_level = 6;
+			ctr6 = &ctr.ctr7.ctr.xpress6.ts->ctr6;
 		}
 
 		if (out_level == 1) {
diff --git a/source3/librpc/gen_ndr/cli_svcctl.c b/source3/librpc/gen_ndr/cli_svcctl.c
index c996c761d5..e5fd4dac87 100644
--- a/source3/librpc/gen_ndr/cli_svcctl.c
+++ b/source3/librpc/gen_ndr/cli_svcctl.c
@@ -858,9 +858,9 @@ NTSTATUS rpccli_svcctl_OpenServiceW(struct rpc_pipe_client *cli,
 NTSTATUS rpccli_svcctl_QueryServiceConfigW(struct rpc_pipe_client *cli,
 					   TALLOC_CTX *mem_ctx,
 					   struct policy_handle *handle /* [in] [ref] */,
-					   uint8_t *query /* [out]  */,
-					   uint32_t buf_size /* [in]  */,
-					   uint32_t *bytes_needed /* [out] [ref] */,
+					   struct QUERY_SERVICE_CONFIG *query /* [out] [ref] */,
+					   uint32_t buf_size /* [in] [range(0,8192)] */,
+					   uint32_t *bytes_needed /* [out] [ref,range(0,8192)] */,
 					   WERROR *werror)
 {
 	struct svcctl_QueryServiceConfigW r;
@@ -893,7 +893,7 @@ NTSTATUS rpccli_svcctl_QueryServiceConfigW(struct rpc_pipe_client *cli,
 	}
 
 	/* Return variables */
-	memcpy(query, r.out.query, r.in.buf_size * sizeof(*query));
+	*query = *r.out.query;
 	*bytes_needed = *r.out.bytes_needed;
 
 	/* Return result */
diff --git a/source3/librpc/gen_ndr/cli_svcctl.h b/source3/librpc/gen_ndr/cli_svcctl.h
index 56f0a2b0e7..02abbadf1e 100644
--- a/source3/librpc/gen_ndr/cli_svcctl.h
+++ b/source3/librpc/gen_ndr/cli_svcctl.h
@@ -127,9 +127,9 @@ NTSTATUS rpccli_svcctl_OpenServiceW(struct rpc_pipe_client *cli,
 NTSTATUS rpccli_svcctl_QueryServiceConfigW(struct rpc_pipe_client *cli,
 					   TALLOC_CTX *mem_ctx,
 					   struct policy_handle *handle /* [in] [ref] */,
-					   uint8_t *query /* [out]  */,
-					   uint32_t buf_size /* [in]  */,
-					   uint32_t *bytes_needed /* [out] [ref] */,
+					   struct QUERY_SERVICE_CONFIG *query /* [out] [ref] */,
+					   uint32_t buf_size /* [in] [range(0,8192)] */,
+					   uint32_t *bytes_needed /* [out] [ref,range(0,8192)] */,
 					   WERROR *werror);
 NTSTATUS rpccli_svcctl_QueryServiceLockStatusW(struct rpc_pipe_client *cli,
 					       TALLOC_CTX *mem_ctx,
diff --git a/source3/librpc/gen_ndr/drsuapi.h b/source3/librpc/gen_ndr/drsuapi.h
index 049c2bf4b1..77ecd9fd79 100644
--- a/source3/librpc/gen_ndr/drsuapi.h
+++ b/source3/librpc/gen_ndr/drsuapi.h
@@ -575,29 +575,37 @@ struct drsuapi_DsGetNCChangesCtr6 {
 	WERROR drs_error;
 }/* [gensize,public] */;
 
+struct drsuapi_DsGetNCChangesCtr1TS {
+	struct drsuapi_DsGetNCChangesCtr1 ctr1;/* [subcontext(0xFFFFFC01)] */
+}/* [public] */;
+
+struct drsuapi_DsGetNCChangesCtr6TS {
+	struct drsuapi_DsGetNCChangesCtr6 ctr6;/* [subcontext(0xFFFFFC01)] */
+}/* [public] */;
+
 struct drsuapi_DsGetNCChangesMSZIPCtr1 {
 	uint32_t decompressed_length;
 	uint32_t compressed_length;
-	struct drsuapi_DsGetNCChangesCtr1 *ctr1;/* [unique,compression(NDR_COMPRESSION_MSZIP,compressed_length,decompressed_length),subcontext_size(compressed_length),subcontext(4)] */
-};
+	struct drsuapi_DsGetNCChangesCtr1TS *ts;/* [unique,compression(NDR_COMPRESSION_MSZIP,compressed_length,decompressed_length),subcontext_size(compressed_length),subcontext(4)] */
+}/* [nopush] */;
 
 struct drsuapi_DsGetNCChangesMSZIPCtr6 {
 	uint32_t decompressed_length;
 	uint32_t compressed_length;
-	struct drsuapi_DsGetNCChangesCtr6 *ctr6;/* [unique,compression(NDR_COMPRESSION_MSZIP,compressed_length,decompressed_length),subcontext_size(compressed_length),subcontext(4)] */
-};
+	struct drsuapi_DsGetNCChangesCtr6TS *ts;/* [unique,compression(NDR_COMPRESSION_MSZIP,compressed_length,decompressed_length),subcontext_size(compressed_length),subcontext(4)] */
+}/* [nopush] */;
 
 struct drsuapi_DsGetNCChangesXPRESSCtr1 {
 	uint32_t decompressed_length;
 	uint32_t compressed_length;
-	struct drsuapi_DsGetNCChangesCtr1 *ctr1;/* [unique,compression(NDR_COMPRESSION_XPRESS,compressed_length,decompressed_length),subcontext_size(compressed_length),subcontext(4)] */
-};
+	struct drsuapi_DsGetNCChangesCtr1TS *ts;/* [unique,compression(NDR_COMPRESSION_XPRESS,compressed_length,decompressed_length),subcontext_size(compressed_length),subcontext(4)] */
+}/* [nopush] */;
 
 struct drsuapi_DsGetNCChangesXPRESSCtr6 {
 	uint32_t decompressed_length;
 	uint32_t compressed_length;
-	struct drsuapi_DsGetNCChangesCtr6 *ctr6;/* [unique,compression(NDR_COMPRESSION_XPRESS,compressed_length,decompressed_length),subcontext_size(compressed_length),subcontext(4)] */
-};
+	struct drsuapi_DsGetNCChangesCtr6TS *ts;/* [unique,compression(NDR_COMPRESSION_XPRESS,compressed_length,decompressed_length),subcontext_size(compressed_length),subcontext(4)] */
+}/* [nopush] */;
 
 enum drsuapi_DsGetNCChangesCompressionType
 #ifndef USE_UINT_ENUMS
@@ -620,7 +628,7 @@ union drsuapi_DsGetNCChangesCompressedCtr {
 }/* [nodiscriminant,flag(LIBNDR_PRINT_ARRAY_HEX)] */;
 
 struct drsuapi_DsGetNCChangesCtr2 {
-	union drsuapi_DsGetNCChangesCompressedCtr ctr;/* [switch_is(1|(DRSUAPI_COMPRESSION_TYPE_MSZIP<<16))] */
+	struct drsuapi_DsGetNCChangesMSZIPCtr1 mszip1;
 };
 
 struct drsuapi_DsGetNCChangesCtr7 {
@@ -889,7 +897,7 @@ union drsuapi_DsWriteAccountSpnResult {
 struct drsuapi_DsRemoveDSServerRequest1 {
 	const char *server_dn;/* [unique,charset(UTF16)] */
 	const char *domain_dn;/* [unique,charset(UTF16)] */
-	uint32_t unknown;
+	uint32_t commit;
 };
 
 union drsuapi_DsRemoveDSServerRequest {
@@ -897,7 +905,7 @@ union drsuapi_DsRemoveDSServerRequest {
 }/* [switch_type(int32)] */;
 
 struct drsuapi_DsRemoveDSServerResult1 {
-	WERROR status;
+	uint32_t last_dc_in_domain;
 };
 
 union drsuapi_DsRemoveDSServerResult {
diff --git a/source3/librpc/gen_ndr/ndr_drsuapi.c b/source3/librpc/gen_ndr/ndr_drsuapi.c
index 38b88f643c..4651d50e95 100644
--- a/source3/librpc/gen_ndr/ndr_drsuapi.c
+++ b/source3/librpc/gen_ndr/ndr_drsuapi.c
@@ -2823,217 +2823,219 @@ _PUBLIC_ size_t ndr_size_drsuapi_DsGetNCChangesCtr6(const struct drsuapi_DsGetNC
 	return ndr_size_struct(r, flags, (ndr_push_flags_fn_t)ndr_push_drsuapi_DsGetNCChangesCtr6);
 }
 
-static enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesMSZIPCtr1(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesMSZIPCtr1 *r)
+_PUBLIC_ enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesCtr1TS(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesCtr1TS *r)
 {
 	if (ndr_flags & NDR_SCALARS) {
-		NDR_CHECK(ndr_push_align(ndr, 4));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->decompressed_length));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->compressed_length));
-		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ctr1));
+		NDR_CHECK(ndr_push_align(ndr, 1));
+		{
+			struct ndr_push *_ndr_ctr1;
+			NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ctr1, 0xFFFFFC01, -1));
+			NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1(_ndr_ctr1, NDR_SCALARS|NDR_BUFFERS, &r->ctr1));
+			NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ctr1, 0xFFFFFC01, -1));
+		}
 	}
 	if (ndr_flags & NDR_BUFFERS) {
-		if (r->ctr1) {
-			{
-				struct ndr_push *_ndr_ctr1;
-				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ctr1, 4, r->compressed_length));
-				{
-					struct ndr_push *_ndr_ctr1_compressed;
-					NDR_CHECK(ndr_push_compression_start(_ndr_ctr1, &_ndr_ctr1_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
-					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1(_ndr_ctr1_compressed, NDR_SCALARS|NDR_BUFFERS, r->ctr1));
-					NDR_CHECK(ndr_push_compression_end(_ndr_ctr1, _ndr_ctr1_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
-				}
-				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ctr1, 4, r->compressed_length));
-			}
-		}
 	}
 	return NDR_ERR_SUCCESS;
 }
 
-static enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesMSZIPCtr1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesMSZIPCtr1 *r)
+_PUBLIC_ enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesCtr1TS(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesCtr1TS *r)
 {
-	uint32_t _ptr_ctr1;
-	TALLOC_CTX *_mem_save_ctr1_0;
 	if (ndr_flags & NDR_SCALARS) {
-		NDR_CHECK(ndr_pull_align(ndr, 4));
-		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->decompressed_length));
-		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->compressed_length));
-		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
-		if (_ptr_ctr1) {
-			NDR_PULL_ALLOC(ndr, r->ctr1);
-		} else {
-			r->ctr1 = NULL;
+		NDR_CHECK(ndr_pull_align(ndr, 1));
+		{
+			struct ndr_pull *_ndr_ctr1;
+			NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ctr1, 0xFFFFFC01, -1));
+			NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr1(_ndr_ctr1, NDR_SCALARS|NDR_BUFFERS, &r->ctr1));
+			NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ctr1, 0xFFFFFC01, -1));
 		}
 	}
 	if (ndr_flags & NDR_BUFFERS) {
-		if (r->ctr1) {
-			_mem_save_ctr1_0 = NDR_PULL_GET_MEM_CTX(ndr);
-			NDR_PULL_SET_MEM_CTX(ndr, r->ctr1, 0);
-			{
-				struct ndr_pull *_ndr_ctr1;
-				NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ctr1, 4, r->compressed_length));
-				{
-					struct ndr_pull *_ndr_ctr1_compressed;
-					NDR_CHECK(ndr_pull_compression_start(_ndr_ctr1, &_ndr_ctr1_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
-					NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr1(_ndr_ctr1_compressed, NDR_SCALARS|NDR_BUFFERS, r->ctr1));
-					NDR_CHECK(ndr_pull_compression_end(_ndr_ctr1, _ndr_ctr1_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
-				}
-				NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ctr1, 4, r->compressed_length));
-			}
-			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ctr1_0, 0);
-		}
 	}
 	return NDR_ERR_SUCCESS;
 }
 
-_PUBLIC_ void ndr_print_drsuapi_DsGetNCChangesMSZIPCtr1(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesMSZIPCtr1 *r)
+_PUBLIC_ void ndr_print_drsuapi_DsGetNCChangesCtr1TS(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesCtr1TS *r)
 {
-	ndr_print_struct(ndr, name, "drsuapi_DsGetNCChangesMSZIPCtr1");
-	ndr->depth++;
-	ndr_print_uint32(ndr, "decompressed_length", r->decompressed_length);
-	ndr_print_uint32(ndr, "compressed_length", r->compressed_length);
-	ndr_print_ptr(ndr, "ctr1", r->ctr1);
+	ndr_print_struct(ndr, name, "drsuapi_DsGetNCChangesCtr1TS");
 	ndr->depth++;
-	if (r->ctr1) {
-		ndr_print_drsuapi_DsGetNCChangesCtr1(ndr, "ctr1", r->ctr1);
-	}
-	ndr->depth--;
+	ndr_print_drsuapi_DsGetNCChangesCtr1(ndr, "ctr1", &r->ctr1);
 	ndr->depth--;
 }
 
-static enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesMSZIPCtr6(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesMSZIPCtr6 *r)
+_PUBLIC_ enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesCtr6TS(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesCtr6TS *r)
 {
 	if (ndr_flags & NDR_SCALARS) {
-		NDR_CHECK(ndr_push_align(ndr, 4));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->decompressed_length));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->compressed_length));
-		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ctr6));
+		NDR_CHECK(ndr_push_align(ndr, 1));
+		{
+			struct ndr_push *_ndr_ctr6;
+			NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ctr6, 0xFFFFFC01, -1));
+			NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6(_ndr_ctr6, NDR_SCALARS|NDR_BUFFERS, &r->ctr6));
+			NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ctr6, 0xFFFFFC01, -1));
+		}
 	}
 	if (ndr_flags & NDR_BUFFERS) {
-		if (r->ctr6) {
-			{
-				struct ndr_push *_ndr_ctr6;
-				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ctr6, 4, r->compressed_length));
-				{
-					struct ndr_push *_ndr_ctr6_compressed;
-					NDR_CHECK(ndr_push_compression_start(_ndr_ctr6, &_ndr_ctr6_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
-					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6(_ndr_ctr6_compressed, NDR_SCALARS|NDR_BUFFERS, r->ctr6));
-					NDR_CHECK(ndr_push_compression_end(_ndr_ctr6, _ndr_ctr6_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
-				}
-				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ctr6, 4, r->compressed_length));
-			}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+_PUBLIC_ enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesCtr6TS(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesCtr6TS *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_pull_align(ndr, 1));
+		{
+			struct ndr_pull *_ndr_ctr6;
+			NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ctr6, 0xFFFFFC01, -1));
+			NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr6(_ndr_ctr6, NDR_SCALARS|NDR_BUFFERS, &r->ctr6));
+			NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ctr6, 0xFFFFFC01, -1));
 		}
 	}
+	if (ndr_flags & NDR_BUFFERS) {
+	}
 	return NDR_ERR_SUCCESS;
 }
 
-static enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesMSZIPCtr6(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesMSZIPCtr6 *r)
+_PUBLIC_ void ndr_print_drsuapi_DsGetNCChangesCtr6TS(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesCtr6TS *r)
+{
+	ndr_print_struct(ndr, name, "drsuapi_DsGetNCChangesCtr6TS");
+	ndr->depth++;
+	ndr_print_drsuapi_DsGetNCChangesCtr6(ndr, "ctr6", &r->ctr6);
+	ndr->depth--;
+}
+
+static enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesMSZIPCtr1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesMSZIPCtr1 *r)
 {
-	uint32_t _ptr_ctr6;
-	TALLOC_CTX *_mem_save_ctr6_0;
+	uint32_t _ptr_ts;
+	TALLOC_CTX *_mem_save_ts_0;
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_pull_align(ndr, 4));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->decompressed_length));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->compressed_length));
-		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr6));
-		if (_ptr_ctr6) {
-			NDR_PULL_ALLOC(ndr, r->ctr6);
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ts));
+		if (_ptr_ts) {
+			NDR_PULL_ALLOC(ndr, r->ts);
 		} else {
-			r->ctr6 = NULL;
+			r->ts = NULL;
 		}
 	}
 	if (ndr_flags & NDR_BUFFERS) {
-		if (r->ctr6) {
-			_mem_save_ctr6_0 = NDR_PULL_GET_MEM_CTX(ndr);
-			NDR_PULL_SET_MEM_CTX(ndr, r->ctr6, 0);
+		if (r->ts) {
+			_mem_save_ts_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->ts, 0);
 			{
-				struct ndr_pull *_ndr_ctr6;
-				NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ctr6, 4, r->compressed_length));
+				struct ndr_pull *_ndr_ts;
+				NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ts, 4, r->compressed_length));
 				{
-					struct ndr_pull *_ndr_ctr6_compressed;
-					NDR_CHECK(ndr_pull_compression_start(_ndr_ctr6, &_ndr_ctr6_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
-					NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr6(_ndr_ctr6_compressed, NDR_SCALARS|NDR_BUFFERS, r->ctr6));
-					NDR_CHECK(ndr_pull_compression_end(_ndr_ctr6, _ndr_ctr6_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
+					struct ndr_pull *_ndr_ts_compressed;
+					NDR_CHECK(ndr_pull_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
+					NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_pull_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
 				}
-				NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ctr6, 4, r->compressed_length));
+				NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ts, 4, r->compressed_length));
 			}
-			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ctr6_0, 0);
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ts_0, 0);
 		}
 	}
 	return NDR_ERR_SUCCESS;
 }
 
-_PUBLIC_ void ndr_print_drsuapi_DsGetNCChangesMSZIPCtr6(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesMSZIPCtr6 *r)
+_PUBLIC_ void ndr_print_drsuapi_DsGetNCChangesMSZIPCtr1(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesMSZIPCtr1 *r)
 {
-	ndr_print_struct(ndr, name, "drsuapi_DsGetNCChangesMSZIPCtr6");
+	ndr_print_struct(ndr, name, "drsuapi_DsGetNCChangesMSZIPCtr1");
 	ndr->depth++;
 	ndr_print_uint32(ndr, "decompressed_length", r->decompressed_length);
 	ndr_print_uint32(ndr, "compressed_length", r->compressed_length);
-	ndr_print_ptr(ndr, "ctr6", r->ctr6);
+	ndr_print_ptr(ndr, "ts", r->ts);
 	ndr->depth++;
-	if (r->ctr6) {
-		ndr_print_drsuapi_DsGetNCChangesCtr6(ndr, "ctr6", r->ctr6);
+	if (r->ts) {
+		ndr_print_drsuapi_DsGetNCChangesCtr1TS(ndr, "ts", r->ts);
 	}
 	ndr->depth--;
 	ndr->depth--;
 }
 
-static enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesXPRESSCtr1(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesXPRESSCtr1 *r)
+static enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesMSZIPCtr6(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesMSZIPCtr6 *r)
 {
+	uint32_t _ptr_ts;
+	TALLOC_CTX *_mem_save_ts_0;
 	if (ndr_flags & NDR_SCALARS) {
-		NDR_CHECK(ndr_push_align(ndr, 4));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->decompressed_length));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->compressed_length));
-		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ctr1));
+		NDR_CHECK(ndr_pull_align(ndr, 4));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->decompressed_length));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->compressed_length));
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ts));
+		if (_ptr_ts) {
+			NDR_PULL_ALLOC(ndr, r->ts);
+		} else {
+			r->ts = NULL;
+		}
 	}
 	if (ndr_flags & NDR_BUFFERS) {
-		if (r->ctr1) {
+		if (r->ts) {
+			_mem_save_ts_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->ts, 0);
 			{
-				struct ndr_push *_ndr_ctr1;
-				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ctr1, 4, r->compressed_length));
+				struct ndr_pull *_ndr_ts;
+				NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ts, 4, r->compressed_length));
 				{
-					struct ndr_push *_ndr_ctr1_compressed;
-					NDR_CHECK(ndr_push_compression_start(_ndr_ctr1, &_ndr_ctr1_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
-					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1(_ndr_ctr1_compressed, NDR_SCALARS|NDR_BUFFERS, r->ctr1));
-					NDR_CHECK(ndr_push_compression_end(_ndr_ctr1, _ndr_ctr1_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
+					struct ndr_pull *_ndr_ts_compressed;
+					NDR_CHECK(ndr_pull_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
+					NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_pull_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, r->decompressed_length));
 				}
-				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ctr1, 4, r->compressed_length));
+				NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ts, 4, r->compressed_length));
 			}
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ts_0, 0);
 		}
 	}
 	return NDR_ERR_SUCCESS;
 }
 
+_PUBLIC_ void ndr_print_drsuapi_DsGetNCChangesMSZIPCtr6(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesMSZIPCtr6 *r)
+{
+	ndr_print_struct(ndr, name, "drsuapi_DsGetNCChangesMSZIPCtr6");
+	ndr->depth++;
+	ndr_print_uint32(ndr, "decompressed_length", r->decompressed_length);
+	ndr_print_uint32(ndr, "compressed_length", r->compressed_length);
+	ndr_print_ptr(ndr, "ts", r->ts);
+	ndr->depth++;
+	if (r->ts) {
+		ndr_print_drsuapi_DsGetNCChangesCtr6TS(ndr, "ts", r->ts);
+	}
+	ndr->depth--;
+	ndr->depth--;
+}
+
 static enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesXPRESSCtr1(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesXPRESSCtr1 *r)
 {
-	uint32_t _ptr_ctr1;
-	TALLOC_CTX *_mem_save_ctr1_0;
+	uint32_t _ptr_ts;
+	TALLOC_CTX *_mem_save_ts_0;
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_pull_align(ndr, 4));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->decompressed_length));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->compressed_length));
-		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr1));
-		if (_ptr_ctr1) {
-			NDR_PULL_ALLOC(ndr, r->ctr1);
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ts));
+		if (_ptr_ts) {
+			NDR_PULL_ALLOC(ndr, r->ts);
 		} else {
-			r->ctr1 = NULL;
+			r->ts = NULL;
 		}
 	}
 	if (ndr_flags & NDR_BUFFERS) {
-		if (r->ctr1) {
-			_mem_save_ctr1_0 = NDR_PULL_GET_MEM_CTX(ndr);
-			NDR_PULL_SET_MEM_CTX(ndr, r->ctr1, 0);
+		if (r->ts) {
+			_mem_save_ts_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->ts, 0);
 			{
-				struct ndr_pull *_ndr_ctr1;
-				NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ctr1, 4, r->compressed_length));
+				struct ndr_pull *_ndr_ts;
+				NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ts, 4, r->compressed_length));
 				{
-					struct ndr_pull *_ndr_ctr1_compressed;
-					NDR_CHECK(ndr_pull_compression_start(_ndr_ctr1, &_ndr_ctr1_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
-					NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr1(_ndr_ctr1_compressed, NDR_SCALARS|NDR_BUFFERS, r->ctr1));
-					NDR_CHECK(ndr_pull_compression_end(_ndr_ctr1, _ndr_ctr1_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
+					struct ndr_pull *_ndr_ts_compressed;
+					NDR_CHECK(ndr_pull_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
+					NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_pull_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
 				}
-				NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ctr1, 4, r->compressed_length));
+				NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ts, 4, r->compressed_length));
 			}
-			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ctr1_0, 0);
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ts_0, 0);
 		}
 	}
 	return NDR_ERR_SUCCESS;
@@ -3045,72 +3047,46 @@ _PUBLIC_ void ndr_print_drsuapi_DsGetNCChangesXPRESSCtr1(struct ndr_print *ndr,
 	ndr->depth++;
 	ndr_print_uint32(ndr, "decompressed_length", r->decompressed_length);
 	ndr_print_uint32(ndr, "compressed_length", r->compressed_length);
-	ndr_print_ptr(ndr, "ctr1", r->ctr1);
+	ndr_print_ptr(ndr, "ts", r->ts);
 	ndr->depth++;
-	if (r->ctr1) {
-		ndr_print_drsuapi_DsGetNCChangesCtr1(ndr, "ctr1", r->ctr1);
+	if (r->ts) {
+		ndr_print_drsuapi_DsGetNCChangesCtr1TS(ndr, "ts", r->ts);
 	}
 	ndr->depth--;
 	ndr->depth--;
 }
 
-static enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesXPRESSCtr6(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesXPRESSCtr6 *r)
-{
-	if (ndr_flags & NDR_SCALARS) {
-		NDR_CHECK(ndr_push_align(ndr, 4));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->decompressed_length));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->compressed_length));
-		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ctr6));
-	}
-	if (ndr_flags & NDR_BUFFERS) {
-		if (r->ctr6) {
-			{
-				struct ndr_push *_ndr_ctr6;
-				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ctr6, 4, r->compressed_length));
-				{
-					struct ndr_push *_ndr_ctr6_compressed;
-					NDR_CHECK(ndr_push_compression_start(_ndr_ctr6, &_ndr_ctr6_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
-					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6(_ndr_ctr6_compressed, NDR_SCALARS|NDR_BUFFERS, r->ctr6));
-					NDR_CHECK(ndr_push_compression_end(_ndr_ctr6, _ndr_ctr6_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
-				}
-				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ctr6, 4, r->compressed_length));
-			}
-		}
-	}
-	return NDR_ERR_SUCCESS;
-}
-
 static enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesXPRESSCtr6(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesXPRESSCtr6 *r)
 {
-	uint32_t _ptr_ctr6;
-	TALLOC_CTX *_mem_save_ctr6_0;
+	uint32_t _ptr_ts;
+	TALLOC_CTX *_mem_save_ts_0;
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_pull_align(ndr, 4));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->decompressed_length));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->compressed_length));
-		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ctr6));
-		if (_ptr_ctr6) {
-			NDR_PULL_ALLOC(ndr, r->ctr6);
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_ts));
+		if (_ptr_ts) {
+			NDR_PULL_ALLOC(ndr, r->ts);
 		} else {
-			r->ctr6 = NULL;
+			r->ts = NULL;
 		}
 	}
 	if (ndr_flags & NDR_BUFFERS) {
-		if (r->ctr6) {
-			_mem_save_ctr6_0 = NDR_PULL_GET_MEM_CTX(ndr);
-			NDR_PULL_SET_MEM_CTX(ndr, r->ctr6, 0);
+		if (r->ts) {
+			_mem_save_ts_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->ts, 0);
 			{
-				struct ndr_pull *_ndr_ctr6;
-				NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ctr6, 4, r->compressed_length));
+				struct ndr_pull *_ndr_ts;
+				NDR_CHECK(ndr_pull_subcontext_start(ndr, &_ndr_ts, 4, r->compressed_length));
 				{
-					struct ndr_pull *_ndr_ctr6_compressed;
-					NDR_CHECK(ndr_pull_compression_start(_ndr_ctr6, &_ndr_ctr6_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
-					NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr6(_ndr_ctr6_compressed, NDR_SCALARS|NDR_BUFFERS, r->ctr6));
-					NDR_CHECK(ndr_pull_compression_end(_ndr_ctr6, _ndr_ctr6_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
+					struct ndr_pull *_ndr_ts_compressed;
+					NDR_CHECK(ndr_pull_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
+					NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_pull_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, r->decompressed_length));
 				}
-				NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ctr6, 4, r->compressed_length));
+				NDR_CHECK(ndr_pull_subcontext_end(ndr, _ndr_ts, 4, r->compressed_length));
 			}
-			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ctr6_0, 0);
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_ts_0, 0);
 		}
 	}
 	return NDR_ERR_SUCCESS;
@@ -3122,10 +3098,10 @@ _PUBLIC_ void ndr_print_drsuapi_DsGetNCChangesXPRESSCtr6(struct ndr_print *ndr,
 	ndr->depth++;
 	ndr_print_uint32(ndr, "decompressed_length", r->decompressed_length);
 	ndr_print_uint32(ndr, "compressed_length", r->compressed_length);
-	ndr_print_ptr(ndr, "ctr6", r->ctr6);
+	ndr_print_ptr(ndr, "ts", r->ts);
 	ndr->depth++;
-	if (r->ctr6) {
-		ndr_print_drsuapi_DsGetNCChangesCtr6(ndr, "ctr6", r->ctr6);
+	if (r->ts) {
+		ndr_print_drsuapi_DsGetNCChangesCtr6TS(ndr, "ts", r->ts);
 	}
 	ndr->depth--;
 	ndr->depth--;
@@ -3304,11 +3280,10 @@ static enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesCtr2(struct ndr_push *nd
 {
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_push_align(ndr, 4));
-		NDR_CHECK(ndr_push_set_switch_value(ndr, &r->ctr, 1 | (DRSUAPI_COMPRESSION_TYPE_MSZIP << 16)));
-		NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCompressedCtr(ndr, NDR_SCALARS, &r->ctr));
+		NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesMSZIPCtr1(ndr, NDR_SCALARS, &r->mszip1));
 	}
 	if (ndr_flags & NDR_BUFFERS) {
-		NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCompressedCtr(ndr, NDR_BUFFERS, &r->ctr));
+		NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesMSZIPCtr1(ndr, NDR_BUFFERS, &r->mszip1));
 	}
 	return NDR_ERR_SUCCESS;
 }
@@ -3317,11 +3292,10 @@ static enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesCtr2(struct ndr_pull *nd
 {
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_pull_align(ndr, 4));
-		NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->ctr, 1 | (DRSUAPI_COMPRESSION_TYPE_MSZIP << 16)));
-		NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCompressedCtr(ndr, NDR_SCALARS, &r->ctr));
+		NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesMSZIPCtr1(ndr, NDR_SCALARS, &r->mszip1));
 	}
 	if (ndr_flags & NDR_BUFFERS) {
-		NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesCompressedCtr(ndr, NDR_BUFFERS, &r->ctr));
+		NDR_CHECK(ndr_pull_drsuapi_DsGetNCChangesMSZIPCtr1(ndr, NDR_BUFFERS, &r->mszip1));
 	}
 	return NDR_ERR_SUCCESS;
 }
@@ -3330,8 +3304,7 @@ _PUBLIC_ void ndr_print_drsuapi_DsGetNCChangesCtr2(struct ndr_print *ndr, const
 {
 	ndr_print_struct(ndr, name, "drsuapi_DsGetNCChangesCtr2");
 	ndr->depth++;
-	ndr_print_set_switch_value(ndr, &r->ctr, 1 | (DRSUAPI_COMPRESSION_TYPE_MSZIP << 16));
-	ndr_print_drsuapi_DsGetNCChangesCompressedCtr(ndr, "ctr", &r->ctr);
+	ndr_print_drsuapi_DsGetNCChangesMSZIPCtr1(ndr, "mszip1", &r->mszip1);
 	ndr->depth--;
 }
 
@@ -5609,7 +5582,7 @@ static enum ndr_err_code ndr_push_drsuapi_DsRemoveDSServerRequest1(struct ndr_pu
 		NDR_CHECK(ndr_push_align(ndr, 4));
 		NDR_CHECK(ndr_push_unique_ptr(ndr, r->server_dn));
 		NDR_CHECK(ndr_push_unique_ptr(ndr, r->domain_dn));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->unknown));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->commit));
 	}
 	if (ndr_flags & NDR_BUFFERS) {
 		if (r->server_dn) {
@@ -5648,7 +5621,7 @@ static enum ndr_err_code ndr_pull_drsuapi_DsRemoveDSServerRequest1(struct ndr_pu
 		} else {
 			r->domain_dn = NULL;
 		}
-		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->unknown));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->commit));
 	}
 	if (ndr_flags & NDR_BUFFERS) {
 		if (r->server_dn) {
@@ -5695,7 +5668,7 @@ _PUBLIC_ void ndr_print_drsuapi_DsRemoveDSServerRequest1(struct ndr_print *ndr,
 		ndr_print_string(ndr, "domain_dn", r->domain_dn);
 	}
 	ndr->depth--;
-	ndr_print_uint32(ndr, "unknown", r->unknown);
+	ndr_print_uint32(ndr, "commit", r->commit);
 	ndr->depth--;
 }
 
@@ -5778,7 +5751,7 @@ static enum ndr_err_code ndr_push_drsuapi_DsRemoveDSServerResult1(struct ndr_pus
 {
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_push_align(ndr, 4));
-		NDR_CHECK(ndr_push_WERROR(ndr, NDR_SCALARS, r->status));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->last_dc_in_domain));
 	}
 	if (ndr_flags & NDR_BUFFERS) {
 	}
@@ -5789,7 +5762,7 @@ static enum ndr_err_code ndr_pull_drsuapi_DsRemoveDSServerResult1(struct ndr_pul
 {
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_pull_align(ndr, 4));
-		NDR_CHECK(ndr_pull_WERROR(ndr, NDR_SCALARS, &r->status));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->last_dc_in_domain));
 	}
 	if (ndr_flags & NDR_BUFFERS) {
 	}
@@ -5800,7 +5773,7 @@ _PUBLIC_ void ndr_print_drsuapi_DsRemoveDSServerResult1(struct ndr_print *ndr, c
 {
 	ndr_print_struct(ndr, name, "drsuapi_DsRemoveDSServerResult1");
 	ndr->depth++;
-	ndr_print_WERROR(ndr, "status", r->status);
+	ndr_print_uint32(ndr, "last_dc_in_domain", r->last_dc_in_domain);
 	ndr->depth--;
 }
 
diff --git a/source3/librpc/gen_ndr/ndr_drsuapi.h b/source3/librpc/gen_ndr/ndr_drsuapi.h
index 6b6a0b5670..e65bc62301 100644
--- a/source3/librpc/gen_ndr/ndr_drsuapi.h
+++ b/source3/librpc/gen_ndr/ndr_drsuapi.h
@@ -151,9 +151,19 @@ enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesCtr6(struct ndr_push *ndr, int
 enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesCtr6(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesCtr6 *r);
 void ndr_print_drsuapi_DsGetNCChangesCtr6(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesCtr6 *r);
 size_t ndr_size_drsuapi_DsGetNCChangesCtr6(const struct drsuapi_DsGetNCChangesCtr6 *r, int flags);
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesCtr1TS(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesCtr1TS *r);
+enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesCtr1TS(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesCtr1TS *r);
+void ndr_print_drsuapi_DsGetNCChangesCtr1TS(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesCtr1TS *r);
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesCtr6TS(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesCtr6TS *r);
+enum ndr_err_code ndr_pull_drsuapi_DsGetNCChangesCtr6TS(struct ndr_pull *ndr, int ndr_flags, struct drsuapi_DsGetNCChangesCtr6TS *r);
+void ndr_print_drsuapi_DsGetNCChangesCtr6TS(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesCtr6TS *r);
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesMSZIPCtr1(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesMSZIPCtr1 *r);
 void ndr_print_drsuapi_DsGetNCChangesMSZIPCtr1(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesMSZIPCtr1 *r);
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesMSZIPCtr6(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesMSZIPCtr6 *r);
 void ndr_print_drsuapi_DsGetNCChangesMSZIPCtr6(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesMSZIPCtr6 *r);
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesXPRESSCtr1(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesXPRESSCtr1 *r);
 void ndr_print_drsuapi_DsGetNCChangesXPRESSCtr1(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesXPRESSCtr1 *r);
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesXPRESSCtr6(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesXPRESSCtr6 *r);
 void ndr_print_drsuapi_DsGetNCChangesXPRESSCtr6(struct ndr_print *ndr, const char *name, const struct drsuapi_DsGetNCChangesXPRESSCtr6 *r);
 void ndr_print_drsuapi_DsGetNCChangesCompressionType(struct ndr_print *ndr, const char *name, enum drsuapi_DsGetNCChangesCompressionType r);
 void ndr_print_drsuapi_DsGetNCChangesCompressedCtr(struct ndr_print *ndr, const char *name, const union drsuapi_DsGetNCChangesCompressedCtr *r);
diff --git a/source3/librpc/gen_ndr/ndr_svcctl.c b/source3/librpc/gen_ndr/ndr_svcctl.c
index ec1450b48b..e897ef334b 100644
--- a/source3/librpc/gen_ndr/ndr_svcctl.c
+++ b/source3/librpc/gen_ndr/ndr_svcctl.c
@@ -353,6 +353,215 @@ _PUBLIC_ void ndr_print_svcctl_ServiceAccessMask(struct ndr_print *ndr, const ch
 	ndr->depth--;
 }
 
+_PUBLIC_ enum ndr_err_code ndr_push_QUERY_SERVICE_CONFIG(struct ndr_push *ndr, int ndr_flags, const struct QUERY_SERVICE_CONFIG *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->service_type));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->start_type));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->error_control));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->executablepath));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->loadordergroup));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->tag_id));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->dependencies));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->startname));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->displayname));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->executablepath) {
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->executablepath, CH_UTF16)));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->executablepath, CH_UTF16)));
+			NDR_CHECK(ndr_push_charset(ndr, NDR_SCALARS, r->executablepath, ndr_charset_length(r->executablepath, CH_UTF16), sizeof(uint16_t), CH_UTF16));
+		}
+		if (r->loadordergroup) {
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->loadordergroup, CH_UTF16)));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->loadordergroup, CH_UTF16)));
+			NDR_CHECK(ndr_push_charset(ndr, NDR_SCALARS, r->loadordergroup, ndr_charset_length(r->loadordergroup, CH_UTF16), sizeof(uint16_t), CH_UTF16));
+		}
+		if (r->dependencies) {
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->dependencies, CH_UTF16)));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->dependencies, CH_UTF16)));
+			NDR_CHECK(ndr_push_charset(ndr, NDR_SCALARS, r->dependencies, ndr_charset_length(r->dependencies, CH_UTF16), sizeof(uint16_t), CH_UTF16));
+		}
+		if (r->startname) {
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->startname, CH_UTF16)));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->startname, CH_UTF16)));
+			NDR_CHECK(ndr_push_charset(ndr, NDR_SCALARS, r->startname, ndr_charset_length(r->startname, CH_UTF16), sizeof(uint16_t), CH_UTF16));
+		}
+		if (r->displayname) {
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->displayname, CH_UTF16)));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
+			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->displayname, CH_UTF16)));
+			NDR_CHECK(ndr_push_charset(ndr, NDR_SCALARS, r->displayname, ndr_charset_length(r->displayname, CH_UTF16), sizeof(uint16_t), CH_UTF16));
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+_PUBLIC_ enum ndr_err_code ndr_pull_QUERY_SERVICE_CONFIG(struct ndr_pull *ndr, int ndr_flags, struct QUERY_SERVICE_CONFIG *r)
+{
+	uint32_t _ptr_executablepath;
+	TALLOC_CTX *_mem_save_executablepath_0;
+	uint32_t _ptr_loadordergroup;
+	TALLOC_CTX *_mem_save_loadordergroup_0;
+	uint32_t _ptr_dependencies;
+	TALLOC_CTX *_mem_save_dependencies_0;
+	uint32_t _ptr_startname;
+	TALLOC_CTX *_mem_save_startname_0;
+	uint32_t _ptr_displayname;
+	TALLOC_CTX *_mem_save_displayname_0;
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_pull_align(ndr, 4));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->service_type));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->start_type));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->error_control));
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_executablepath));
+		if (_ptr_executablepath) {
+			NDR_PULL_ALLOC(ndr, r->executablepath);
+		} else {
+			r->executablepath = NULL;
+		}
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_loadordergroup));
+		if (_ptr_loadordergroup) {
+			NDR_PULL_ALLOC(ndr, r->loadordergroup);
+		} else {
+			r->loadordergroup = NULL;
+		}
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->tag_id));
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_dependencies));
+		if (_ptr_dependencies) {
+			NDR_PULL_ALLOC(ndr, r->dependencies);
+		} else {
+			r->dependencies = NULL;
+		}
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_startname));
+		if (_ptr_startname) {
+			NDR_PULL_ALLOC(ndr, r->startname);
+		} else {
+			r->startname = NULL;
+		}
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_displayname));
+		if (_ptr_displayname) {
+			NDR_PULL_ALLOC(ndr, r->displayname);
+		} else {
+			r->displayname = NULL;
+		}
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->executablepath) {
+			_mem_save_executablepath_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->executablepath, 0);
+			NDR_CHECK(ndr_pull_array_size(ndr, &r->executablepath));
+			NDR_CHECK(ndr_pull_array_length(ndr, &r->executablepath));
+			if (ndr_get_array_length(ndr, &r->executablepath) > ndr_get_array_size(ndr, &r->executablepath)) {
+				return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->executablepath), ndr_get_array_length(ndr, &r->executablepath));
+			}
+			NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->executablepath), sizeof(uint16_t)));
+			NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->executablepath, ndr_get_array_length(ndr, &r->executablepath), sizeof(uint16_t), CH_UTF16));
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_executablepath_0, 0);
+		}
+		if (r->loadordergroup) {
+			_mem_save_loadordergroup_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->loadordergroup, 0);
+			NDR_CHECK(ndr_pull_array_size(ndr, &r->loadordergroup));
+			NDR_CHECK(ndr_pull_array_length(ndr, &r->loadordergroup));
+			if (ndr_get_array_length(ndr, &r->loadordergroup) > ndr_get_array_size(ndr, &r->loadordergroup)) {
+				return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->loadordergroup), ndr_get_array_length(ndr, &r->loadordergroup));
+			}
+			NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->loadordergroup), sizeof(uint16_t)));
+			NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->loadordergroup, ndr_get_array_length(ndr, &r->loadordergroup), sizeof(uint16_t), CH_UTF16));
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_loadordergroup_0, 0);
+		}
+		if (r->dependencies) {
+			_mem_save_dependencies_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->dependencies, 0);
+			NDR_CHECK(ndr_pull_array_size(ndr, &r->dependencies));
+			NDR_CHECK(ndr_pull_array_length(ndr, &r->dependencies));
+			if (ndr_get_array_length(ndr, &r->dependencies) > ndr_get_array_size(ndr, &r->dependencies)) {
+				return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->dependencies), ndr_get_array_length(ndr, &r->dependencies));
+			}
+			NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->dependencies), sizeof(uint16_t)));
+			NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->dependencies, ndr_get_array_length(ndr, &r->dependencies), sizeof(uint16_t), CH_UTF16));
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dependencies_0, 0);
+		}
+		if (r->startname) {
+			_mem_save_startname_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->startname, 0);
+			NDR_CHECK(ndr_pull_array_size(ndr, &r->startname));
+			NDR_CHECK(ndr_pull_array_length(ndr, &r->startname));
+			if (ndr_get_array_length(ndr, &r->startname) > ndr_get_array_size(ndr, &r->startname)) {
+				return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->startname), ndr_get_array_length(ndr, &r->startname));
+			}
+			NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->startname), sizeof(uint16_t)));
+			NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->startname, ndr_get_array_length(ndr, &r->startname), sizeof(uint16_t), CH_UTF16));
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_startname_0, 0);
+		}
+		if (r->displayname) {
+			_mem_save_displayname_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->displayname, 0);
+			NDR_CHECK(ndr_pull_array_size(ndr, &r->displayname));
+			NDR_CHECK(ndr_pull_array_length(ndr, &r->displayname));
+			if (ndr_get_array_length(ndr, &r->displayname) > ndr_get_array_size(ndr, &r->displayname)) {
+				return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should exceed array length %u", ndr_get_array_size(ndr, &r->displayname), ndr_get_array_length(ndr, &r->displayname));
+			}
+			NDR_CHECK(ndr_check_string_terminator(ndr, ndr_get_array_length(ndr, &r->displayname), sizeof(uint16_t)));
+			NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->displayname, ndr_get_array_length(ndr, &r->displayname), sizeof(uint16_t), CH_UTF16));
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_displayname_0, 0);
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+_PUBLIC_ void ndr_print_QUERY_SERVICE_CONFIG(struct ndr_print *ndr, const char *name, const struct QUERY_SERVICE_CONFIG *r)
+{
+	ndr_print_struct(ndr, name, "QUERY_SERVICE_CONFIG");
+	ndr->depth++;
+	ndr_print_uint32(ndr, "service_type", r->service_type);
+	ndr_print_uint32(ndr, "start_type", r->start_type);
+	ndr_print_uint32(ndr, "error_control", r->error_control);
+	ndr_print_ptr(ndr, "executablepath", r->executablepath);
+	ndr->depth++;
+	if (r->executablepath) {
+		ndr_print_string(ndr, "executablepath", r->executablepath);
+	}
+	ndr->depth--;
+	ndr_print_ptr(ndr, "loadordergroup", r->loadordergroup);
+	ndr->depth++;
+	if (r->loadordergroup) {
+		ndr_print_string(ndr, "loadordergroup", r->loadordergroup);
+	}
+	ndr->depth--;
+	ndr_print_uint32(ndr, "tag_id", r->tag_id);
+	ndr_print_ptr(ndr, "dependencies", r->dependencies);
+	ndr->depth++;
+	if (r->dependencies) {
+		ndr_print_string(ndr, "dependencies", r->dependencies);
+	}
+	ndr->depth--;
+	ndr_print_ptr(ndr, "startname", r->startname);
+	ndr->depth++;
+	if (r->startname) {
+		ndr_print_string(ndr, "startname", r->startname);
+	}
+	ndr->depth--;
+	ndr_print_ptr(ndr, "displayname", r->displayname);
+	ndr->depth++;
+	if (r->displayname) {
+		ndr_print_string(ndr, "displayname", r->displayname);
+	}
+	ndr->depth--;
+	ndr->depth--;
+}
+
+_PUBLIC_ size_t ndr_size_QUERY_SERVICE_CONFIG(const struct QUERY_SERVICE_CONFIG *r, int flags)
+{
+	return ndr_size_struct(r, flags, (ndr_push_flags_fn_t)ndr_push_QUERY_SERVICE_CONFIG);
+}
+
 static enum ndr_err_code ndr_push_svcctl_CloseServiceHandle(struct ndr_push *ndr, int flags, const struct svcctl_CloseServiceHandle *r)
 {
 	if (flags & NDR_IN) {
@@ -2260,7 +2469,10 @@ static enum ndr_err_code ndr_push_svcctl_QueryServiceConfigW(struct ndr_push *nd
 		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->in.buf_size));
 	}
 	if (flags & NDR_OUT) {
-		NDR_CHECK(ndr_push_array_uint8(ndr, NDR_SCALARS, r->out.query, r->in.buf_size));
+		if (r->out.query == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_QUERY_SERVICE_CONFIG(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.query));
 		if (r->out.bytes_needed == NULL) {
 			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
 		}
@@ -2273,6 +2485,7 @@ static enum ndr_err_code ndr_push_svcctl_QueryServiceConfigW(struct ndr_push *nd
 static enum ndr_err_code ndr_pull_svcctl_QueryServiceConfigW(struct ndr_pull *ndr, int flags, struct svcctl_QueryServiceConfigW *r)
 {
 	TALLOC_CTX *_mem_save_handle_0;
+	TALLOC_CTX *_mem_save_query_0;
 	TALLOC_CTX *_mem_save_bytes_needed_0;
 	if (flags & NDR_IN) {
 		ZERO_STRUCT(r->out);
@@ -2285,18 +2498,31 @@ static enum ndr_err_code ndr_pull_svcctl_QueryServiceConfigW(struct ndr_pull *nd
 		NDR_CHECK(ndr_pull_policy_handle(ndr, NDR_SCALARS, r->in.handle));
 		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_handle_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.buf_size));
+		if (r->in.buf_size < 0 || r->in.buf_size > 8192) {
+			return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+		}
+		NDR_PULL_ALLOC(ndr, r->out.query);
+		ZERO_STRUCTP(r->out.query);
 		NDR_PULL_ALLOC(ndr, r->out.bytes_needed);
 		ZERO_STRUCTP(r->out.bytes_needed);
 	}
 	if (flags & NDR_OUT) {
-		NDR_PULL_ALLOC_N(ndr, r->out.query, r->in.buf_size);
-		NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->out.query, r->in.buf_size));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, r->out.query);
+		}
+		_mem_save_query_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->out.query, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_QUERY_SERVICE_CONFIG(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.query));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_query_0, LIBNDR_FLAG_REF_ALLOC);
 		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
 			NDR_PULL_ALLOC(ndr, r->out.bytes_needed);
 		}
 		_mem_save_bytes_needed_0 = NDR_PULL_GET_MEM_CTX(ndr);
 		NDR_PULL_SET_MEM_CTX(ndr, r->out.bytes_needed, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, r->out.bytes_needed));
+		if (*r->out.bytes_needed < 0 || *r->out.bytes_needed > 8192) {
+			return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+		}
 		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_bytes_needed_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_WERROR(ndr, NDR_SCALARS, &r->out.result));
 	}
@@ -2323,7 +2549,10 @@ _PUBLIC_ void ndr_print_svcctl_QueryServiceConfigW(struct ndr_print *ndr, const
 	if (flags & NDR_OUT) {
 		ndr_print_struct(ndr, "out", "svcctl_QueryServiceConfigW");
 		ndr->depth++;
-		ndr_print_array_uint8(ndr, "query", r->out.query, r->in.buf_size);
+		ndr_print_ptr(ndr, "query", r->out.query);
+		ndr->depth++;
+		ndr_print_QUERY_SERVICE_CONFIG(ndr, "query", r->out.query);
+		ndr->depth--;
 		ndr_print_ptr(ndr, "bytes_needed", r->out.bytes_needed);
 		ndr->depth++;
 		ndr_print_uint32(ndr, "bytes_needed", *r->out.bytes_needed);
diff --git a/source3/librpc/gen_ndr/ndr_svcctl.h b/source3/librpc/gen_ndr/ndr_svcctl.h
index 4475b08792..0bebd3401a 100644
--- a/source3/librpc/gen_ndr/ndr_svcctl.h
+++ b/source3/librpc/gen_ndr/ndr_svcctl.h
@@ -108,6 +108,10 @@ enum ndr_err_code ndr_pull_svcctl_ServerType(struct ndr_pull *ndr, int ndr_flags
 void ndr_print_svcctl_ServerType(struct ndr_print *ndr, const char *name, uint32_t r);
 void ndr_print_svcctl_MgrAccessMask(struct ndr_print *ndr, const char *name, uint32_t r);
 void ndr_print_svcctl_ServiceAccessMask(struct ndr_print *ndr, const char *name, uint32_t r);
+enum ndr_err_code ndr_push_QUERY_SERVICE_CONFIG(struct ndr_push *ndr, int ndr_flags, const struct QUERY_SERVICE_CONFIG *r);
+enum ndr_err_code ndr_pull_QUERY_SERVICE_CONFIG(struct ndr_pull *ndr, int ndr_flags, struct QUERY_SERVICE_CONFIG *r);
+void ndr_print_QUERY_SERVICE_CONFIG(struct ndr_print *ndr, const char *name, const struct QUERY_SERVICE_CONFIG *r);
+size_t ndr_size_QUERY_SERVICE_CONFIG(const struct QUERY_SERVICE_CONFIG *r, int flags);
 void ndr_print_svcctl_CloseServiceHandle(struct ndr_print *ndr, const char *name, int flags, const struct svcctl_CloseServiceHandle *r);
 void ndr_print_svcctl_ControlService(struct ndr_print *ndr, const char *name, int flags, const struct svcctl_ControlService *r);
 void ndr_print_svcctl_DeleteService(struct ndr_print *ndr, const char *name, int flags, const struct svcctl_DeleteService *r);
diff --git a/source3/librpc/gen_ndr/srv_svcctl.c b/source3/librpc/gen_ndr/srv_svcctl.c
index 05184e6785..2349b4fd93 100644
--- a/source3/librpc/gen_ndr/srv_svcctl.c
+++ b/source3/librpc/gen_ndr/srv_svcctl.c
@@ -1392,7 +1392,7 @@ static bool api_svcctl_QueryServiceConfigW(pipes_struct *p)
 	}
 
 	ZERO_STRUCT(r->out);
-	r->out.query = talloc_zero_array(r, uint8_t, r->in.buf_size);
+	r->out.query = talloc_zero(r, struct QUERY_SERVICE_CONFIG);
 	if (r->out.query == NULL) {
 		talloc_free(r);
 		return false;
diff --git a/source3/librpc/gen_ndr/svcctl.h b/source3/librpc/gen_ndr/svcctl.h
index b7f39a9b02..42ed039784 100644
--- a/source3/librpc/gen_ndr/svcctl.h
+++ b/source3/librpc/gen_ndr/svcctl.h
@@ -99,6 +99,18 @@ enum SERVICE_CONTROL
 #define SC_RIGHT_SVC_INTERROGATE ( 0x0080 )
 #define SC_RIGHT_SVC_USER_DEFINED_CONTROL ( 0x0100 )
 
+struct QUERY_SERVICE_CONFIG {
+	uint32_t service_type;
+	uint32_t start_type;
+	uint32_t error_control;
+	const char *executablepath;/* [unique,range(0,8192),charset(UTF16)] */
+	const char *loadordergroup;/* [unique,range(0,8192),charset(UTF16)] */
+	uint32_t tag_id;
+	const char *dependencies;/* [unique,range(0,8192),charset(UTF16)] */
+	const char *startname;/* [unique,range(0,8192),charset(UTF16)] */
+	const char *displayname;/* [unique,range(0,8192),charset(UTF16)] */
+}/* [gensize,public] */;
+
 
 struct svcctl_CloseServiceHandle {
 	struct {
@@ -360,12 +372,12 @@ struct svcctl_OpenServiceW {
 struct svcctl_QueryServiceConfigW {
 	struct {
 		struct policy_handle *handle;/* [ref] */
-		uint32_t buf_size;
+		uint32_t buf_size;/* [range(0,8192)] */
 	} in;
 
 	struct {
-		uint8_t *query;
-		uint32_t *bytes_needed;/* [ref] */
+		struct QUERY_SERVICE_CONFIG *query;/* [ref] */
+		uint32_t *bytes_needed;/* [ref,range(0,8192)] */
 		WERROR result;
 	} out;
 
diff --git a/source3/librpc/idl/drsuapi.idl b/source3/librpc/idl/drsuapi.idl
index df6dcba23a..adcd2d741b 100644
--- a/source3/librpc/idl/drsuapi.idl
+++ b/source3/librpc/idl/drsuapi.idl
@@ -629,36 +629,44 @@ interface drsuapi
 		WERROR drs_error;
 	} drsuapi_DsGetNCChangesCtr6;
 
-	typedef struct {
+	typedef [public] struct {
+		[subcontext(0xFFFFFC01)] drsuapi_DsGetNCChangesCtr1 ctr1;
+	} drsuapi_DsGetNCChangesCtr1TS;
+
+	typedef [public] struct {
+		[subcontext(0xFFFFFC01)] drsuapi_DsGetNCChangesCtr6 ctr6;
+	} drsuapi_DsGetNCChangesCtr6TS;
+
+	typedef [nopush] struct {
 		uint32 decompressed_length;
 		uint32 compressed_length;
 		[subcontext(4),subcontext_size(compressed_length),
 		 compression(NDR_COMPRESSION_MSZIP,compressed_length,decompressed_length)]
-		 drsuapi_DsGetNCChangesCtr1 *ctr1;
+		 drsuapi_DsGetNCChangesCtr1TS *ts;
 	} drsuapi_DsGetNCChangesMSZIPCtr1;
 
-	typedef struct {
+	typedef [nopush] struct {
 		uint32 decompressed_length;
 		uint32 compressed_length;
 		[subcontext(4),subcontext_size(compressed_length),
 		 compression(NDR_COMPRESSION_MSZIP,compressed_length,decompressed_length)]
-		 drsuapi_DsGetNCChangesCtr6 *ctr6;
+		 drsuapi_DsGetNCChangesCtr6TS *ts;
 	} drsuapi_DsGetNCChangesMSZIPCtr6;
 
-	typedef struct {
+	typedef [nopush] struct {
 		uint32 decompressed_length;
 		uint32 compressed_length;
 		[subcontext(4),subcontext_size(compressed_length),
 		 compression(NDR_COMPRESSION_XPRESS,compressed_length,decompressed_length)]
-		 drsuapi_DsGetNCChangesCtr1 *ctr1;
+		 drsuapi_DsGetNCChangesCtr1TS *ts;
 	} drsuapi_DsGetNCChangesXPRESSCtr1;
 
-	typedef struct {
+	typedef [nopush] struct {
 		uint32 decompressed_length;
 		uint32 compressed_length;
 		[subcontext(4),subcontext_size(compressed_length),
 		 compression(NDR_COMPRESSION_XPRESS,compressed_length,decompressed_length)]
-		 drsuapi_DsGetNCChangesCtr6 *ctr6;
+		 drsuapi_DsGetNCChangesCtr6TS *ts;
 	} drsuapi_DsGetNCChangesXPRESSCtr6;
 
 	typedef [enum16bit] enum {
@@ -674,13 +682,7 @@ interface drsuapi
 	} drsuapi_DsGetNCChangesCompressedCtr;
 
 	typedef struct {
-		/* 
-		 * this is a bit ugly, as the compression depends on the flags
-		 * in the DsBind(), but only w2k uses DsGetNCChangesReq5
-		 * and will get DsGetNCChangesCtr2 replies, and w2k only knowns
-		 * about MSZIP and level 1 replies
-		 */
-		[switch_is(1|(DRSUAPI_COMPRESSION_TYPE_MSZIP<<16))] drsuapi_DsGetNCChangesCompressedCtr ctr;
+		drsuapi_DsGetNCChangesMSZIPCtr1 mszip1;
 	} drsuapi_DsGetNCChangesCtr2;
 
 	typedef struct {
@@ -973,7 +975,7 @@ interface drsuapi
 	typedef struct {
 		[charset(UTF16),string] uint16 *server_dn;
 		[charset(UTF16),string] uint16 *domain_dn;
-		uint32 unknown; /* 0x000000001 */
+		boolean32 commit;
 	} drsuapi_DsRemoveDSServerRequest1;
 
 	typedef [switch_type(int32)] union {
@@ -981,7 +983,7 @@ interface drsuapi
 	} drsuapi_DsRemoveDSServerRequest;
 
 	typedef struct {
-		WERROR status;
+		boolean32 last_dc_in_domain;
 	} drsuapi_DsRemoveDSServerResult1;
 
 	typedef [switch_type(int32)] union {
diff --git a/source3/librpc/ndr/ndr_drsuapi.c b/source3/librpc/ndr/ndr_drsuapi.c
index aeb81c87bd..8bc44dcc36 100644
--- a/source3/librpc/ndr/ndr_drsuapi.c
+++ b/source3/librpc/ndr/ndr_drsuapi.c
@@ -23,6 +23,8 @@
 #include "includes.h"
 #include "librpc/gen_ndr/ndr_drsuapi.h"
 #include "librpc/gen_ndr/ndr_misc.h"
+#include "../lib/util/asn1.h"
+#include "librpc/ndr/ndr_compression.h"
 
 void ndr_print_drsuapi_DsReplicaObjectListItem(struct ndr_print *ndr, const char *name,
 					       const struct drsuapi_DsReplicaObjectListItem *r)
@@ -144,7 +146,7 @@ enum ndr_err_code ndr_pull_drsuapi_DsReplicaOID(struct ndr_pull *ndr, int ndr_fl
 			} else {
 				_OID_PULL_CHECK(ber_read_OID_String(ndr, _oid_array, &_oid));
 			}
-			TALLOC_FREE(_oid_array.data);
+			data_blob_free(&_oid_array);
 			talloc_steal(r->oid, _oid);
 			r->oid = _oid;
 		}
@@ -175,3 +177,175 @@ size_t ndr_size_drsuapi_DsReplicaOID_oid(const char *oid, int flags)
 	data_blob_free(&_blob);
 	return ret;
 }
+
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesMSZIPCtr1(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesMSZIPCtr1 *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		uint32_t decompressed_length = 0;
+		uint32_t compressed_length = 0;
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					decompressed_length = _ndr_ts_compressed->offset;
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+				}
+				compressed_length = _ndr_ts->offset;
+				talloc_free(_ndr_ts);
+			}
+		}
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, decompressed_length));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, compressed_length));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ts));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+				}
+				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ts, 4, -1));
+			}
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesMSZIPCtr6(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesMSZIPCtr6 *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		uint32_t decompressed_length = 0;
+		uint32_t compressed_length = 0;
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					decompressed_length = _ndr_ts_compressed->offset;
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+				}
+				compressed_length = _ndr_ts->offset;
+				talloc_free(_ndr_ts);
+			}
+		}
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, decompressed_length));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, compressed_length));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ts));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_MSZIP, -1));
+				}
+				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ts, 4, -1));
+			}
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesXPRESSCtr1(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesXPRESSCtr1 *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		uint32_t decompressed_length = 0;
+		uint32_t compressed_length = 0;
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					decompressed_length = _ndr_ts_compressed->offset;
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+				}
+				compressed_length = _ndr_ts->offset;
+				talloc_free(_ndr_ts);
+			}
+		}
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, decompressed_length));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, compressed_length));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ts));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr1TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+				}
+				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ts, 4, -1));
+			}
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
+
+enum ndr_err_code ndr_push_drsuapi_DsGetNCChangesXPRESSCtr6(struct ndr_push *ndr, int ndr_flags, const struct drsuapi_DsGetNCChangesXPRESSCtr6 *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		uint32_t decompressed_length = 0;
+		uint32_t compressed_length = 0;
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					decompressed_length = _ndr_ts_compressed->offset;
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+				}
+				compressed_length = _ndr_ts->offset;
+				talloc_free(_ndr_ts);
+			}
+		}
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, decompressed_length));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, compressed_length));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->ts));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		if (r->ts) {
+			{
+				struct ndr_push *_ndr_ts;
+				NDR_CHECK(ndr_push_subcontext_start(ndr, &_ndr_ts, 4, -1));
+				{
+					struct ndr_push *_ndr_ts_compressed;
+					NDR_CHECK(ndr_push_compression_start(_ndr_ts, &_ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+					NDR_CHECK(ndr_push_drsuapi_DsGetNCChangesCtr6TS(_ndr_ts_compressed, NDR_SCALARS|NDR_BUFFERS, r->ts));
+					NDR_CHECK(ndr_push_compression_end(_ndr_ts, _ndr_ts_compressed, NDR_COMPRESSION_XPRESS, -1));
+				}
+				NDR_CHECK(ndr_push_subcontext_end(ndr, _ndr_ts, 4, -1));
+			}
+		}
+	}
+	return NDR_ERR_SUCCESS;
+}
diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c
index f32a33fdb6..9d566ea3d6 100644
--- a/source3/rpc_client/cli_pipe.c
+++ b/source3/rpc_client/cli_pipe.c
@@ -2906,7 +2906,7 @@ static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
 	fnum = cli_nt_create(cli, result->trans.np.pipe_name,
 			     DESIRED_ACCESS_PIPE);
 	if (fnum == -1) {
-		DEBUG(1,("rpc_pipe_open_np: cli_nt_create failed on pipe %s "
+		DEBUG(3,("rpc_pipe_open_np: cli_nt_create failed on pipe %s "
 			 "to machine %s.  Error was %s\n",
 			 result->trans.np.pipe_name, cli->desthost,
 			 cli_errstr(cli)));
diff --git a/source3/rpc_client/cli_svcctl.c b/source3/rpc_client/cli_svcctl.c
index 3c29dcdee8..51678083d3 100644
--- a/source3/rpc_client/cli_svcctl.c
+++ b/source3/rpc_client/cli_svcctl.c
@@ -90,79 +90,3 @@ WERROR rpccli_svcctl_enumerate_services( struct rpc_pipe_client *cli, TALLOC_CTX
 	
 	return out.status;
 }
-
-/*******************************************************************
-*******************************************************************/
-
-WERROR rpccli_svcctl_query_config(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
-                                POLICY_HND *hService, SERVICE_CONFIG *config )
-{
-	SVCCTL_Q_QUERY_SERVICE_CONFIG in;
-	SVCCTL_R_QUERY_SERVICE_CONFIG out;
-	prs_struct qbuf, rbuf;
-	
-	ZERO_STRUCT(in);
-	ZERO_STRUCT(out);
-	
-	memcpy( &in.handle, hService, sizeof(POLICY_HND) );
-	in.buffer_size = 0;
-	
-	
-	CLI_DO_RPC_WERR( cli, mem_ctx, &ndr_table_svcctl.syntax_id,
-			 SVCCTL_QUERY_SERVICE_CONFIG_W,
-	            in, out, 
-	            qbuf, rbuf,
-	            svcctl_io_q_query_service_config,
-	            svcctl_io_r_query_service_config, 
-	            WERR_GENERAL_FAILURE );
-	
-	if ( W_ERROR_EQUAL( out.status, WERR_INSUFFICIENT_BUFFER ) ) {
-		in.buffer_size = out.needed;
-
-		CLI_DO_RPC_WERR( cli, mem_ctx, &ndr_table_svcctl.syntax_id,
-				 SVCCTL_QUERY_SERVICE_CONFIG_W,
-		            in, out, 
-		            qbuf, rbuf,
-		            svcctl_io_q_query_service_config,
-		            svcctl_io_r_query_service_config, 
-		            WERR_GENERAL_FAILURE );
-	}
-	
-	if ( !W_ERROR_IS_OK( out.status ) )
-		return out.status;
-
-	memcpy( config, &out.config, sizeof(SERVICE_CONFIG) );
-	
-	config->executablepath = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-	config->loadordergroup = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-	config->dependencies   = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-	config->startname      = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-	config->displayname    = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-	
-	if ( out.config.executablepath ) {
-		config->executablepath = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-		copy_unistr2( config->executablepath, out.config.executablepath );
-	}
-
-	if ( out.config.loadordergroup ) {
-		config->loadordergroup = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-		copy_unistr2( config->loadordergroup, out.config.loadordergroup );
-	}
-
-	if ( out.config.dependencies ) {
-		config->dependencies = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-		copy_unistr2( config->dependencies, out.config.dependencies );
-	}
-
-	if ( out.config.startname ) {
-		config->startname = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-		copy_unistr2( config->startname, out.config.startname );
-	}
-
-	if ( out.config.displayname ) {
-		config->displayname = TALLOC_ZERO_P( mem_ctx, UNISTR2 );
-		copy_unistr2( config->displayname, out.config.displayname );
-	}
-	
-	return out.status;
-}
diff --git a/source3/rpc_parse/parse_svcctl.c b/source3/rpc_parse/parse_svcctl.c
index c5d93864ba..7d31f4b2f0 100644
--- a/source3/rpc_parse/parse_svcctl.c
+++ b/source3/rpc_parse/parse_svcctl.c
@@ -58,51 +58,6 @@ static bool svcctl_io_service_status( const char *desc, SERVICE_STATUS *status,
 /*******************************************************************
 ********************************************************************/
 
-static bool svcctl_io_service_config( const char *desc, SERVICE_CONFIG *config, prs_struct *ps, int depth )
-{
-
-	prs_debug(ps, depth, desc, "svcctl_io_service_config");
-	depth++;
-
-	if(!prs_uint32("service_type", ps, depth, &config->service_type))
-		return False;
-	if(!prs_uint32("start_type", ps, depth, &config->start_type))
-		return False;
-	if(!prs_uint32("error_control", ps, depth, &config->error_control))
-		return False;
-
-	if (!prs_io_unistr2_p("", ps, depth, &config->executablepath))
-		return False;
-	if (!prs_io_unistr2_p("", ps, depth, &config->loadordergroup))
-		return False;
-
-	if(!prs_uint32("tag_id", ps, depth, &config->tag_id))
-		return False;
-
-	if (!prs_io_unistr2_p("", ps, depth, &config->dependencies))
-		return False;
-	if (!prs_io_unistr2_p("", ps, depth, &config->startname))
-		return False;
-	if (!prs_io_unistr2_p("", ps, depth, &config->displayname))
-		return False;
-
-	if (!prs_io_unistr2("", ps, depth, config->executablepath))
-		return False;
-	if (!prs_io_unistr2("", ps, depth, config->loadordergroup))
-		return False;
-	if (!prs_io_unistr2("", ps, depth, config->dependencies))
-		return False;
-	if (!prs_io_unistr2("", ps, depth, config->startname))
-		return False;
-	if (!prs_io_unistr2("", ps, depth, config->displayname))
-		return False;
-
-	return True;
-}
-
-/*******************************************************************
-********************************************************************/
-
 bool svcctl_io_enum_services_status( const char *desc, ENUM_SERVICES_STATUS *enum_status, RPC_BUFFER *buffer, int depth )
 {
 	prs_struct *ps=&buffer->prs;
@@ -175,26 +130,6 @@ static uint32 sizeof_unistr2( UNISTR2 *string )
 	return size;
 }
 
-/********************************************************************
-********************************************************************/
-
-uint32 svcctl_sizeof_service_config( SERVICE_CONFIG *config )
-{
-	uint32 size = 0;
-
-	size = sizeof(uint32) * 4;	/* static uint32 fields */
-
-	/* now add the UNISTR2 + pointer sizes */
-
-	size += sizeof(uint32) * sizeof_unistr2(config->executablepath);
-	size += sizeof(uint32) * sizeof_unistr2(config->loadordergroup);
-	size += sizeof(uint32) * sizeof_unistr2(config->dependencies);
-	size += sizeof(uint32) * sizeof_unistr2(config->startname);
-	size += sizeof(uint32) * sizeof_unistr2(config->displayname);
-	
-	return size;
-}
-
 /*******************************************************************
 ********************************************************************/
 
@@ -262,57 +197,6 @@ bool svcctl_io_r_enum_services_status(const char *desc, SVCCTL_R_ENUM_SERVICES_S
 /*******************************************************************
 ********************************************************************/
 
-bool svcctl_io_q_query_service_config(const char *desc, SVCCTL_Q_QUERY_SERVICE_CONFIG *q_u, prs_struct *ps, int depth)
-{
-	if (q_u == NULL)
-		return False;
-
-	prs_debug(ps, depth, desc, "svcctl_io_q_query_service_config");
-	depth++;
-
-	if(!prs_align(ps))
-		return False;
-
-	if(!smb_io_pol_hnd("service_pol", &q_u->handle, ps, depth))
-		return False;
-
-	if(!prs_uint32("buffer_size", ps, depth, &q_u->buffer_size))
-		return False;
-
-	return True;
-}
-
-/*******************************************************************
-********************************************************************/
-
-bool svcctl_io_r_query_service_config(const char *desc, SVCCTL_R_QUERY_SERVICE_CONFIG *r_u, prs_struct *ps, int depth)
-{
-	if (r_u == NULL)
-		return False;
-
-	prs_debug(ps, depth, desc, "svcctl_io_r_query_service_config");
-	depth++;
-
-
-	if(!prs_align(ps))
-		return False;
-
-	if(!svcctl_io_service_config("config", &r_u->config, ps, depth))
-		return False;
-
-	if(!prs_uint32("needed", ps, depth, &r_u->needed))
-		return False;
-
-	if(!prs_werror("status", ps, depth, &r_u->status))
-		return False;
-
-
- 	return True;
-}
-
-/*******************************************************************
-********************************************************************/
-
 bool svcctl_io_q_query_service_config2(const char *desc, SVCCTL_Q_QUERY_SERVICE_CONFIG2 *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL)
diff --git a/source3/rpc_server/srv_svcctl.c b/source3/rpc_server/srv_svcctl.c
index 483fb8e1e9..84864364f7 100644
--- a/source3/rpc_server/srv_svcctl.c
+++ b/source3/rpc_server/srv_svcctl.c
@@ -155,23 +155,7 @@ static bool api_svcctl_control_service(pipes_struct *p)
 
 static bool api_svcctl_query_service_config(pipes_struct *p)
 {
-	SVCCTL_Q_QUERY_SERVICE_CONFIG q_u;
-	SVCCTL_R_QUERY_SERVICE_CONFIG r_u;
-	prs_struct *data = &p->in_data.data;
-	prs_struct *rdata = &p->out_data.rdata;
-
-	ZERO_STRUCT(q_u);
-	ZERO_STRUCT(r_u);
-
-	if(!svcctl_io_q_query_service_config("", &q_u, data, 0))
-		return False;
-
-	r_u.status = _svcctl_query_service_config(p, &q_u, &r_u);
-
-	if(!svcctl_io_r_query_service_config("", &r_u, rdata, 0))
-		return False;
-
-	return True;
+	return proxy_svcctl_call(p, SVCCTL_QUERY_SERVICE_CONFIG_W);
 }
 
 /*******************************************************************
diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c
index 1caf4941a4..a7215ac686 100644
--- a/source3/rpc_server/srv_svcctl_nt.c
+++ b/source3/rpc_server/srv_svcctl_nt.c
@@ -6,6 +6,7 @@
  *
  *  Largely Rewritten (Again) by:
  *  Copyright (C) Gerald (Jerry) Carter             2005.
+ *  Copyright (C) Guenther Deschner                 2008.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -610,7 +611,9 @@ WERROR _svcctl_query_service_status_ex( pipes_struct *p, SVCCTL_Q_QUERY_SERVICE_
 /********************************************************************
 ********************************************************************/
 
-static WERROR fill_svc_config( TALLOC_CTX *ctx, const char *name, SERVICE_CONFIG *config, NT_USER_TOKEN *token )
+static WERROR fill_svc_config( TALLOC_CTX *ctx, const char *name,
+			       struct QUERY_SERVICE_CONFIG *config,
+			       NT_USER_TOKEN *token )
 {
 	REGVAL_CTR *values;
 	REGISTRY_VALUE *val;
@@ -622,20 +625,17 @@ static WERROR fill_svc_config( TALLOC_CTX *ctx, const char *name, SERVICE_CONFIG
 
 	/* now fill in the individual values */
 
-	config->displayname = TALLOC_ZERO_P( ctx, UNISTR2 );
 	if ( (val = regval_ctr_getvalue( values, "DisplayName" )) != NULL )
-		init_unistr2( config->displayname, regval_sz( val ), UNI_STR_TERMINATE );
+		config->displayname = regval_sz(val);
 	else
-		init_unistr2( config->displayname, name, UNI_STR_TERMINATE );
+		config->displayname = name;
 
 	if ( (val = regval_ctr_getvalue( values, "ObjectName" )) != NULL ) {
-		config->startname = TALLOC_ZERO_P( ctx, UNISTR2 );
-		init_unistr2( config->startname, regval_sz( val ), UNI_STR_TERMINATE );
+		config->startname = regval_sz(val);
 	}
 
 	if ( (val = regval_ctr_getvalue( values, "ImagePath" )) != NULL ) {
-		config->executablepath = TALLOC_ZERO_P( ctx, UNISTR2 );
-		init_unistr2( config->executablepath, regval_sz( val ), UNI_STR_TERMINATE );
+		config->executablepath = regval_sz(val);
 	}
 
 	/* a few hard coded values */
@@ -663,11 +663,13 @@ static WERROR fill_svc_config( TALLOC_CTX *ctx, const char *name, SERVICE_CONFIG
 }
 
 /********************************************************************
+ _svcctl_QueryServiceConfigW
 ********************************************************************/
 
-WERROR _svcctl_query_service_config( pipes_struct *p, SVCCTL_Q_QUERY_SERVICE_CONFIG *q_u, SVCCTL_R_QUERY_SERVICE_CONFIG *r_u )
+WERROR _svcctl_QueryServiceConfigW(pipes_struct *p,
+				   struct svcctl_QueryServiceConfigW *r)
 {
-	SERVICE_INFO *info = find_service_info_by_hnd( p, &q_u->handle );
+	SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
 	uint32 buffer_size;
 	WERROR wresult;
 
@@ -682,17 +684,17 @@ WERROR _svcctl_query_service_config( pipes_struct *p, SVCCTL_Q_QUERY_SERVICE_CON
 	/* we have to set the outgoing buffer size to the same as the
 	   incoming buffer size (even in the case of failure */
 
-	r_u->needed      = q_u->buffer_size;
+	*r->out.bytes_needed = r->in.buf_size;
 
-	wresult = fill_svc_config( p->mem_ctx, info->name, &r_u->config, p->pipe_user.nt_user_token );
+	wresult = fill_svc_config( p->mem_ctx, info->name, r->out.query, p->pipe_user.nt_user_token );
 	if ( !W_ERROR_IS_OK(wresult) )
 		return wresult;
 
-	buffer_size = svcctl_sizeof_service_config( &r_u->config );
-	r_u->needed = (buffer_size > q_u->buffer_size) ? buffer_size : q_u->buffer_size;
+	buffer_size = ndr_size_QUERY_SERVICE_CONFIG(r->out.query, 0);
+	*r->out.bytes_needed = (buffer_size > r->in.buf_size) ? buffer_size : r->in.buf_size;
 
-        if (buffer_size > q_u->buffer_size ) {
-		ZERO_STRUCTP( &r_u->config );
+        if (buffer_size > r->in.buf_size ) {
+		TALLOC_FREE(r->out.query);
                 return WERR_INSUFFICIENT_BUFFER;
 	}
 
@@ -956,12 +958,6 @@ WERROR _svcctl_EnumServicesStatusW(pipes_struct *p, struct svcctl_EnumServicesSt
 	return WERR_NOT_SUPPORTED;
 }
 
-WERROR _svcctl_QueryServiceConfigW(pipes_struct *p, struct svcctl_QueryServiceConfigW *r)
-{
-	p->rng_fault_state = True;
-	return WERR_NOT_SUPPORTED;
-}
-
 WERROR _svcctl_QueryServiceLockStatusW(pipes_struct *p, struct svcctl_QueryServiceLockStatusW *r)
 {
 	p->rng_fault_state = True;
diff --git a/source3/rpcclient/cmd_drsuapi.c b/source3/rpcclient/cmd_drsuapi.c
index 71757f5ea3..004810eba0 100644
--- a/source3/rpcclient/cmd_drsuapi.c
+++ b/source3/rpcclient/cmd_drsuapi.c
@@ -495,9 +495,9 @@ static WERROR cmd_drsuapi_getncchanges(struct rpc_pipe_client *cli,
 		if (level_out == 1) {
 			out_level = 1;
 			ctr1 = &ctr.ctr1;
-		} else if (level_out == 2) {
+		} else if (level_out == 2 && ctr.ctr2.mszip1.ts) {
 			out_level = 1;
-			ctr1 = ctr.ctr2.ctr.mszip1.ctr1;
+			ctr1 = &ctr.ctr2.mszip1.ts->ctr1;
 		}
 
 		status = cli_get_session_key(mem_ctx, cli, &session_key);
@@ -527,9 +527,16 @@ static WERROR cmd_drsuapi_getncchanges(struct rpc_pipe_client *cli,
 			ctr6 = &ctr.ctr6;
 		} else if (level_out == 7
 			   && ctr.ctr7.level == 6
-			   && ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP) {
+			   && ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP
+			   && ctr.ctr7.ctr.mszip6.ts) {
 			out_level = 6;
-			ctr6 = ctr.ctr7.ctr.mszip6.ctr6;
+			ctr6 = &ctr.ctr7.ctr.mszip6.ts->ctr6;
+		} else if (level_out == 7
+			   && ctr.ctr7.level == 6
+			   && ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS
+			   && ctr.ctr7.ctr.xpress6.ts) {
+			out_level = 6;
+			ctr6 = &ctr.ctr7.ctr.xpress6.ts->ctr6;
 		}
 
 		if (out_level == 6) {
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 00fee0d34d..1da45a8b58 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -7065,10 +7065,11 @@ static void call_trans2mkdir(connection_struct *conn, struct smb_request *req,
 			reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 			return;
 		}
-	} else if (IVAL(pdata,0) != 4) {
-		reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-		return;
 	}
+	/* If total_data == 4 Windows doesn't care what values
+	 * are placed in that field, it just ignores them.
+	 * The System i QNTC IBM SMB client puts bad values here,
+	 * so ignore them. */
 
 	status = create_directory(conn, req, directory);
 
diff --git a/source3/utils/net_rpc_service.c b/source3/utils/net_rpc_service.c
index d1349a903d..133173116c 100644
--- a/source3/utils/net_rpc_service.c
+++ b/source3/utils/net_rpc_service.c
@@ -264,8 +264,9 @@ static NTSTATUS rpc_service_status_internal(struct net_context *c,
 	WERROR result = WERR_GENERAL_FAILURE;
 	NTSTATUS status;
 	SERVICE_STATUS service_status;
-	SERVICE_CONFIG config;
-	fstring ascii_string;
+	struct QUERY_SERVICE_CONFIG config;
+	uint32_t buf_size = sizeof(config);
+	uint32_t ret_size = 0;
 
 	if (argc != 1 ) {
 		d_printf("Usage: net rpc service status <service>\n");
@@ -314,8 +315,23 @@ static NTSTATUS rpc_service_status_internal(struct net_context *c,
 
 	/* get the config */
 
-	result = rpccli_svcctl_query_config(pipe_hnd, mem_ctx, &hService, &config  );
-	if ( !W_ERROR_IS_OK(result) ) {
+	status = rpccli_svcctl_QueryServiceConfigW(pipe_hnd, mem_ctx,
+						   &hService,
+						   &config,
+						   buf_size,
+						   &ret_size,
+						   &result);
+	if (W_ERROR_EQUAL(result, WERR_INSUFFICIENT_BUFFER)) {
+		buf_size = ret_size;
+		status = rpccli_svcctl_QueryServiceConfigW(pipe_hnd, mem_ctx,
+							   &hService,
+							   &config,
+							   buf_size,
+							   &ret_size,
+							   &result);
+	}
+
+	if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result) ) {
 		d_fprintf(stderr, "Query config request failed.  [%s]\n", dos_errstr(result));
 		goto done;
 	}
@@ -329,29 +345,24 @@ static NTSTATUS rpc_service_status_internal(struct net_context *c,
 	d_printf("\tError Control        = 0x%x\n", config.error_control);
 	d_printf("\tTag ID               = 0x%x\n", config.tag_id);
 
-	if ( config.executablepath ) {
-		rpcstr_pull( ascii_string, config.executablepath->buffer, sizeof(ascii_string), -1, STR_TERMINATE );
-		d_printf("\tExecutable Path      = %s\n", ascii_string);
+	if (config.executablepath) {
+		d_printf("\tExecutable Path      = %s\n", config.executablepath);
 	}
 
-	if ( config.loadordergroup ) {
-		rpcstr_pull( ascii_string, config.loadordergroup->buffer, sizeof(ascii_string), -1, STR_TERMINATE );
-		d_printf("\tLoad Order Group     = %s\n", ascii_string);
+	if (config.loadordergroup) {
+		d_printf("\tLoad Order Group     = %s\n", config.loadordergroup);
 	}
 
-	if ( config.dependencies ) {
-		rpcstr_pull( ascii_string, config.dependencies->buffer, sizeof(ascii_string), -1, STR_TERMINATE );
-		d_printf("\tDependencies         = %s\n", ascii_string);
+	if (config.dependencies) {
+		d_printf("\tDependencies         = %s\n", config.dependencies);
 	}
 
-	if ( config.startname ) {
-		rpcstr_pull( ascii_string, config.startname->buffer, sizeof(ascii_string), -1, STR_TERMINATE );
-		d_printf("\tStart Name           = %s\n", ascii_string);
+	if (config.startname) {
+		d_printf("\tStart Name           = %s\n", config.startname);
 	}
 
-	if ( config.displayname ) {
-		rpcstr_pull( ascii_string, config.displayname->buffer, sizeof(ascii_string), -1, STR_TERMINATE );
-		d_printf("\tDisplay Name         = %s\n", ascii_string);
+	if (config.displayname) {
+		d_printf("\tDisplay Name         = %s\n", config.displayname);
 	}
 
 done:
diff --git a/source4/dsdb/samdb/ldb_modules/objectguid.c b/source4/dsdb/samdb/ldb_modules/objectguid.c
index 054905992d..3d725686e7 100644
--- a/source4/dsdb/samdb/ldb_modules/objectguid.c
+++ b/source4/dsdb/samdb/ldb_modules/objectguid.c
@@ -194,7 +194,7 @@ static int objectguid_add(struct ldb_module *module, struct ldb_request *req)
 	}
 
 	/* Get a sequence number from the backend */
-	/* FIXME: ldb_sequence_number is still SYNC now, when this changes,
+	/* FIXME: ldb_sequence_number is a semi-async call,
 	 * make sure this function is split and a callback is used */
 	ret = ldb_sequence_number(module->ldb, LDB_SEQ_NEXT, &seq_num);
 	if (ret == LDB_SUCCESS) {
diff --git a/source4/dsdb/samdb/ldb_modules/partition.c b/source4/dsdb/samdb/ldb_modules/partition.c
index b452b66d56..b4a7a47a23 100644
--- a/source4/dsdb/samdb/ldb_modules/partition.c
+++ b/source4/dsdb/samdb/ldb_modules/partition.c
@@ -115,10 +115,6 @@ int partition_request(struct ldb_module *module, struct ldb_request *request)
 		PARTITION_FIND_OP(module, extended);
 		ret = module->ops->extended(module, request);
 		break;
-	case LDB_SEQUENCE_NUMBER:
-		PARTITION_FIND_OP(module, sequence_number);
-		ret = module->ops->sequence_number(module, request);
-		break;
 	default:
 		PARTITION_FIND_OP(module, request);
 		ret = module->ops->request(module, request);
@@ -716,9 +712,8 @@ static int partition_del_trans(struct ldb_module *module)
 	return ret2;
 }
 
-/* NOTE: ldb_sequence_number is still a completely SYNCHRONOUS call
- * implemented only in ldb_rdb. It does not require ldb_wait() to be
- * called after a request is made */
+
+/* FIXME: This function is still semi-async */
 static int partition_sequence_number(struct ldb_module *module, struct ldb_request *req)
 {
 	int i, ret;
@@ -727,113 +722,241 @@ static int partition_sequence_number(struct ldb_module *module, struct ldb_reque
 	uint64_t timestamp = 0;
 	struct partition_private_data *data = talloc_get_type(module->private_data, 
 							      struct partition_private_data);
+	struct ldb_seqnum_request *seq;
+	struct ldb_seqnum_result *seqr;
+	struct ldb_request *treq;
+	struct ldb_seqnum_request *tseq;
+	struct ldb_seqnum_result *tseqr;
+	struct ldb_extended *ext;
+	struct ldb_result *res;
 
-	switch (req->op.seq_num.type) {
+	seq = talloc_get_type(req->op.extended.data, struct ldb_seqnum_request);
+
+	switch (seq->type) {
 	case LDB_SEQ_NEXT:
 	case LDB_SEQ_HIGHEST_SEQ:
-	       	ret = ldb_next_request(module, req);
-		if (ret != LDB_SUCCESS) {
-			return ret;
+		res = talloc_zero(req, struct ldb_result);
+		if (res == NULL) {
+			return LDB_ERR_OPERATIONS_ERROR;
 		}
-		if (req->op.seq_num.flags & LDB_SEQ_TIMESTAMP_SEQUENCE) {
-			timestamp_sequence = req->op.seq_num.seq_num;
-		} else {
-			seq_number = seq_number + req->op.seq_num.seq_num;
+		tseq = talloc_zero(res, struct ldb_seqnum_request);
+		if (tseq == NULL) {
+			talloc_free(res);
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+		tseq->type = seq->type;
+
+		ret = ldb_build_extended_req(&treq, module->ldb, res,
+					     LDB_EXTENDED_SEQUENCE_NUMBER,
+					     tseq,
+					     NULL,
+					     res,
+					     ldb_extended_default_callback,
+					     NULL);
+	       	ret = ldb_next_request(module, treq);
+		if (ret == LDB_SUCCESS) {
+			ret = ldb_wait(treq->handle, LDB_WAIT_ALL);
 		}
-
-		/* gross hack part1 */
-		ret = ldb_request_add_control(req,
-					DSDB_CONTROL_CURRENT_PARTITION_OID,
-					false, NULL);
 		if (ret != LDB_SUCCESS) {
+			talloc_free(res);
 			return ret;
 		}
+		seqr = talloc_get_type(res->extended->data,
+					struct ldb_seqnum_result);
+		if (seqr->flags & LDB_SEQ_TIMESTAMP_SEQUENCE) {
+			timestamp_sequence = seqr->seq_num;
+		} else {
+			seq_number += seqr->seq_num;
+		}
+		talloc_free(res);
 
-		/* Look at base DN */
-		/* Figure out which partition it is under */
 		/* Skip the lot if 'data' isn't here yet (initialistion) */
 		for (i=0; data && data->partitions && data->partitions[i]; i++) {
 
-			/* gross hack part2 */
-			int j;
-			for (j=0; req->controls[j]; j++) {
-				if (strcmp(req->controls[j]->oid, DSDB_CONTROL_CURRENT_PARTITION_OID) == 0) {
-					req->controls[j]->data = data->partitions[i];
-					break;
-				}
+			res = talloc_zero(req, struct ldb_result);
+			if (res == NULL) {
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+			tseq = talloc_zero(res, struct ldb_seqnum_request);
+			if (tseq == NULL) {
+				talloc_free(res);
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+			tseq->type = seq->type;
+
+			ret = ldb_build_extended_req(&treq, module->ldb, res,
+						     LDB_EXTENDED_SEQUENCE_NUMBER,
+						     tseq,
+						     NULL,
+						     res,
+						     ldb_extended_default_callback,
+						     NULL);
+			if (ret != LDB_SUCCESS) {
+				talloc_free(res);
+				return ret;
 			}
 
-			ret = partition_request(data->partitions[i]->module, req);
+			ret = ldb_request_add_control(treq,
+						      DSDB_CONTROL_CURRENT_PARTITION_OID,
+						      false, data->partitions[i]);
 			if (ret != LDB_SUCCESS) {
+				talloc_free(res);
 				return ret;
 			}
-			if (req->op.seq_num.flags & LDB_SEQ_TIMESTAMP_SEQUENCE) {
-				timestamp_sequence = MAX(timestamp_sequence, req->op.seq_num.seq_num);
+
+			ret = partition_request(data->partitions[i]->module, treq);
+			if (ret != LDB_SUCCESS) {
+				talloc_free(res);
+				return ret;
+			}
+			ret = ldb_wait(treq->handle, LDB_WAIT_ALL);
+			if (ret != LDB_SUCCESS) {
+				talloc_free(res);
+				return ret;
+			}
+			tseqr = talloc_get_type(res->extended->data,
+						struct ldb_seqnum_result);
+			if (tseqr->flags & LDB_SEQ_TIMESTAMP_SEQUENCE) {
+				timestamp_sequence = MAX(timestamp_sequence,
+							 tseqr->seq_num);
 			} else {
-				seq_number = seq_number + req->op.seq_num.seq_num;
+				seq_number += tseqr->seq_num;
 			}
+			talloc_free(res);
 		}
-		/* fall though */
+		/* fall through */
 	case LDB_SEQ_HIGHEST_TIMESTAMP:
-	{
-		struct ldb_request *date_req = talloc(req, struct ldb_request);
-		if (!date_req) {
+
+		res = talloc_zero(req, struct ldb_result);
+		if (res == NULL) {
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
-		*date_req = *req;
-		date_req->op.seq_num.flags = LDB_SEQ_HIGHEST_TIMESTAMP;
 
-		ret = ldb_next_request(module, date_req);
+		tseq = talloc_zero(res, struct ldb_seqnum_request);
+		if (tseq == NULL) {
+			talloc_free(res);
+			return LDB_ERR_OPERATIONS_ERROR;
+		}
+		tseq->type = LDB_SEQ_HIGHEST_TIMESTAMP;
+
+		ret = ldb_build_extended_req(&treq, module->ldb, res,
+					     LDB_EXTENDED_SEQUENCE_NUMBER,
+					     tseq,
+					     NULL,
+					     res,
+					     ldb_extended_default_callback,
+					     NULL);
 		if (ret != LDB_SUCCESS) {
+			talloc_free(res);
 			return ret;
 		}
-		timestamp = date_req->op.seq_num.seq_num;
 
-		/* Look at base DN */
-		/* Figure out which partition it is under */
+		ret = ldb_next_request(module, treq);
+		if (ret != LDB_SUCCESS) {
+			talloc_free(res);
+			return ret;
+		}
+		ret = ldb_wait(treq->handle, LDB_WAIT_ALL);
+		if (ret != LDB_SUCCESS) {
+			talloc_free(res);
+			return ret;
+		}
+
+		tseqr = talloc_get_type(res->extended->data,
+					   struct ldb_seqnum_result);
+		timestamp = tseqr->seq_num;
+
+		talloc_free(res);
+
 		/* Skip the lot if 'data' isn't here yet (initialistion) */
 		for (i=0; data && data->partitions && data->partitions[i]; i++) {
 
-			ret = partition_request(data->partitions[i]->module, req);
+			res = talloc_zero(req, struct ldb_result);
+			if (res == NULL) {
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+
+			tseq = talloc_zero(res, struct ldb_seqnum_request);
+			if (tseq == NULL) {
+				talloc_free(res);
+				return LDB_ERR_OPERATIONS_ERROR;
+			}
+			tseq->type = LDB_SEQ_HIGHEST_TIMESTAMP;
+
+			ret = ldb_build_extended_req(&treq, module->ldb, res,
+						     LDB_EXTENDED_SEQUENCE_NUMBER,
+						     tseq,
+						     NULL,
+						     res,
+						     ldb_extended_default_callback,
+						     NULL);
+			if (ret != LDB_SUCCESS) {
+				talloc_free(res);
+				return ret;
+			}
+
+			ret = partition_request(data->partitions[i]->module, treq);
 			if (ret != LDB_SUCCESS) {
+				talloc_free(res);
 				return ret;
 			}
-			timestamp = MAX(timestamp, date_req->op.seq_num.seq_num);
+			ret = ldb_wait(treq->handle, LDB_WAIT_ALL);
+			if (ret != LDB_SUCCESS) {
+				talloc_free(res);
+				return ret;
+			}
+
+			tseqr = talloc_get_type(res->extended->data,
+						  struct ldb_seqnum_result);
+			timestamp = MAX(timestamp, tseqr->seq_num);
+
+			talloc_free(res);
 		}
+
 		break;
 	}
+
+	ext = talloc_zero(req, struct ldb_extended);
+	if (!ext) {
+		return LDB_ERR_OPERATIONS_ERROR;
 	}
+	seqr = talloc_zero(ext, struct ldb_seqnum_result);
+	if (seqr == NULL) {
+		talloc_free(ext);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	ext->oid = LDB_EXTENDED_SEQUENCE_NUMBER;
+	ext->data = seqr;
 
-	switch (req->op.seq_num.flags) {
+	switch (seq->type) {
 	case LDB_SEQ_NEXT:
 	case LDB_SEQ_HIGHEST_SEQ:
 
-		req->op.seq_num.flags = 0;
-
 		/* Has someone above set a timebase sequence? */
 		if (timestamp_sequence) {
-			req->op.seq_num.seq_num = (((unsigned long long)timestamp << 24) | (seq_number & 0xFFFFFF));
+			seqr->seq_num = (((unsigned long long)timestamp << 24) | (seq_number & 0xFFFFFF));
 		} else {
-			req->op.seq_num.seq_num = seq_number;
+			seqr->seq_num = seq_number;
 		}
 
-		if (timestamp_sequence > req->op.seq_num.seq_num) {
-			req->op.seq_num.seq_num = timestamp_sequence;
-			req->op.seq_num.flags |= LDB_SEQ_TIMESTAMP_SEQUENCE;
+		if (timestamp_sequence > seqr->seq_num) {
+			seqr->seq_num = timestamp_sequence;
+			seqr->flags |= LDB_SEQ_TIMESTAMP_SEQUENCE;
 		}
 
-		req->op.seq_num.flags |= LDB_SEQ_GLOBAL_SEQUENCE;
+		seqr->flags |= LDB_SEQ_GLOBAL_SEQUENCE;
 		break;
 	case LDB_SEQ_HIGHEST_TIMESTAMP:
-		req->op.seq_num.seq_num = timestamp;
+		seqr->seq_num = timestamp;
 		break;
 	}
 
-	switch (req->op.seq_num.flags) {
-	case LDB_SEQ_NEXT:
-		req->op.seq_num.seq_num++;
+	if (seq->type == LDB_SEQ_NEXT) {
+		seqr->seq_num++;
 	}
-	return LDB_SUCCESS;
+
+	/* send request done */
+	return ldb_module_done(req, NULL, ext, LDB_SUCCESS);
 }
 
 static int partition_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
@@ -906,6 +1029,10 @@ static int partition_extended(struct ldb_module *module, struct ldb_request *req
 		return ldb_next_request(module, req);
 	}
 
+	if (strcmp(req->op.extended.oid, LDB_EXTENDED_SEQUENCE_NUMBER) == 0) {
+		return partition_sequence_number(module, req);
+	}
+
 	if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
 		return partition_extended_replicated_objects(module, req);
 	}
@@ -1204,7 +1331,6 @@ _PUBLIC_ const struct ldb_module_ops ldb_partition_module_ops = {
 	.del               = partition_delete,
 	.rename            = partition_rename,
 	.extended          = partition_extended,
-	.sequence_number   = partition_sequence_number,
 	.start_transaction = partition_start_trans,
 	.end_transaction   = partition_end_trans,
 	.del_transaction   = partition_del_trans,
diff --git a/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c b/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c
index d15e85ad41..c353914e2c 100644
--- a/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c
+++ b/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c
@@ -603,10 +603,18 @@ static int nsuniqueid_init(struct ldb_module *module)
 	return ldb_next_init(module);
 }
 
-static int get_seq(struct ldb_request *req,
-		   struct ldb_reply *ares)
+static int get_seq_callback(struct ldb_request *req,
+			    struct ldb_reply *ares)
 {
 	unsigned long long *seq = (unsigned long long *)req->context;
+
+	if (!ares) {
+		return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
+	}
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_request_done(req, ares->error);
+	}
+
 	if (ares->type == LDB_REPLY_ENTRY) {
 		struct ldb_message_element *el = ldb_msg_find_element(ares->message, "contextCSN");
 		if (el) {
@@ -618,6 +626,7 @@ static int get_seq(struct ldb_request *req,
 		return ldb_request_done(req, LDB_SUCCESS);
 	}
 
+	talloc_free(ares);
 	return LDB_SUCCESS;
 }
 
@@ -626,7 +635,7 @@ static int entryuuid_sequence_number(struct ldb_module *module, struct ldb_reque
 	int ret;
 	struct map_private *map_private;
 	struct entryuuid_private *entryuuid_private;
-	unsigned long long seq = 0;
+	unsigned long long seq_num = 0;
 	struct ldb_request *search_req;
 
 	const struct ldb_control *partition_ctrl;
@@ -636,6 +645,12 @@ static int entryuuid_sequence_number(struct ldb_module *module, struct ldb_reque
 		"contextCSN", NULL
 	};
 
+	struct ldb_seqnum_request *seq;
+	struct ldb_seqnum_result *seqr;
+	struct ldb_extended *ext;
+
+	seq = talloc_get_type(req->op.extended.data, struct ldb_seqnum_request);
+
 	map_private = talloc_get_type(module->private_data, struct map_private);
 
 	entryuuid_private = talloc_get_type(map_private->caller_private, struct entryuuid_private);
@@ -655,7 +670,7 @@ static int entryuuid_sequence_number(struct ldb_module *module, struct ldb_reque
 	ret = ldb_build_search_req(&search_req, module->ldb, req,
 				   partition->dn, LDB_SCOPE_BASE,
 				   NULL, contextCSN_attr, NULL,
-				   &seq, get_seq,
+				   &seq_num, get_seq_callback,
 				   NULL);
 	if (ret != LDB_SUCCESS) {
 		return ret;
@@ -672,36 +687,59 @@ static int entryuuid_sequence_number(struct ldb_module *module, struct ldb_reque
 		return ret;
 	}
 
-	switch (req->op.seq_num.type) {
+	ext = talloc_zero(req, struct ldb_extended);
+	if (!ext) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	seqr = talloc_zero(req, struct ldb_seqnum_result);
+	if (seqr == NULL) {
+		talloc_free(ext);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+	ext->oid = LDB_EXTENDED_SEQUENCE_NUMBER;
+	ext->data = seqr;
+
+	switch (seq->type) {
 	case LDB_SEQ_HIGHEST_SEQ:
-		req->op.seq_num.seq_num = seq;
+		seqr->seq_num = seq_num;
 		break;
 	case LDB_SEQ_NEXT:
-		req->op.seq_num.seq_num = seq;
-		req->op.seq_num.seq_num++;
+		seqr->seq_num = seq_num;
+		seqr->seq_num++;
 		break;
 	case LDB_SEQ_HIGHEST_TIMESTAMP:
 	{
-		req->op.seq_num.seq_num = (seq >> 24);
+		seqr->seq_num = (seq_num >> 24);
 		break;
 	}
 	}
-	req->op.seq_num.flags = 0;
-	req->op.seq_num.flags |= LDB_SEQ_TIMESTAMP_SEQUENCE;
-	req->op.seq_num.flags |= LDB_SEQ_GLOBAL_SEQUENCE;
-	return LDB_SUCCESS;
+	seqr->flags = 0;
+	seqr->flags |= LDB_SEQ_TIMESTAMP_SEQUENCE;
+	seqr->flags |= LDB_SEQ_GLOBAL_SEQUENCE;
+
+	/* send request done */
+	return ldb_module_done(req, NULL, ext, LDB_SUCCESS);
+}
+
+static int entryuuid_extended(struct ldb_module *module, struct ldb_request *req)
+{
+	if (strcmp(req->op.extended.oid, LDB_EXTENDED_SEQUENCE_NUMBER) == 0) {
+		return entryuuid_sequence_number(module, req);
+	}
+
+	return ldb_next_request(module, req);
 }
 
 _PUBLIC_ const struct ldb_module_ops ldb_entryuuid_module_ops = {
 	.name		   = "entryuuid",
 	.init_context	   = entryuuid_init,
-	.sequence_number   = entryuuid_sequence_number,
+	.extended          = entryuuid_extended,
 	LDB_MAP_OPS
 };
 
 _PUBLIC_ const struct ldb_module_ops ldb_nsuniqueid_module_ops = {
 	.name		   = "nsuniqueid",
 	.init_context	   = nsuniqueid_init,
-	.sequence_number   = entryuuid_sequence_number,
+	.extended          = entryuuid_extended,
 	LDB_MAP_OPS
 };
diff --git a/source4/lib/ldb/common/ldb.c b/source4/lib/ldb/common/ldb.c
index 75c8109042..c013565da0 100644
--- a/source4/lib/ldb/common/ldb.c
+++ b/source4/lib/ldb/common/ldb.c
@@ -527,10 +527,6 @@ int ldb_request(struct ldb_context *ldb, struct ldb_request *req)
 		FIRST_OP(ldb, extended);
 		ret = module->ops->extended(module, req);
 		break;
-	case LDB_SEQUENCE_NUMBER:
-		FIRST_OP(ldb, sequence_number);
-		ret = module->ops->sequence_number(module, req);
-		break;
 	default:
 		FIRST_OP(ldb, request);
 		ret = module->ops->request(module, req);
@@ -1172,35 +1168,47 @@ int ldb_rename(struct ldb_context *ldb,
 int ldb_sequence_number(struct ldb_context *ldb,
 			enum ldb_sequence_type type, uint64_t *seq_num)
 {
-	struct ldb_request *req;
+	struct ldb_seqnum_request *seq;
+	struct ldb_seqnum_result *seqr;
+	struct ldb_result *res;
+	TALLOC_CTX *tmp_ctx;
 	int ret;
 
-	req = talloc_zero(ldb, struct ldb_request);
-	if (req == NULL) {
+	*seq_num = 0;
+
+	tmp_ctx = talloc_zero(ldb, struct ldb_request);
+	if (tmp_ctx == NULL) {
 		ldb_set_errstring(ldb, "Out of Memory");
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
+	seq = talloc_zero(tmp_ctx, struct ldb_seqnum_request);
+	if (seq == NULL) {
+		ldb_set_errstring(ldb, "Out of Memory");
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
+	}
+	seq->type = type;
 
-	req->operation = LDB_SEQUENCE_NUMBER;
-	req->controls = NULL;
-	req->context = NULL;
-	req->callback = ldb_op_default_callback;
-	ldb_set_timeout(ldb, req, 0); /* use default timeout */
-
-	req->op.seq_num.type = type;
-	/* do request and autostart a transaction */
-	ret = ldb_request(ldb, req);
+	ret = ldb_extended(ldb, LDB_EXTENDED_SEQUENCE_NUMBER, seq, &res);
+	if (ret != LDB_SUCCESS) {
+		goto done;
+	}
+	talloc_steal(tmp_ctx, res);
 
-	if (ret == LDB_SUCCESS) {
-		*seq_num = req->op.seq_num.seq_num;
+	if (strcmp(LDB_EXTENDED_SEQUENCE_NUMBER, res->extended->oid) != 0) {
+		ldb_set_errstring(ldb, "Invalid OID in reply");
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
 	}
+	seqr = talloc_get_type(res->extended->data,
+				struct ldb_seqnum_result);
+	*seq_num = seqr->seq_num;
 
-	talloc_free(req);
+done:
+	talloc_free(tmp_ctx);
 	return ret;
 }
 
-
-
 /*
   return extended error information
 */
diff --git a/source4/lib/ldb/common/ldb_modules.c b/source4/lib/ldb/common/ldb_modules.c
index 5cc8de29b4..2b453bb0c3 100644
--- a/source4/lib/ldb/common/ldb_modules.c
+++ b/source4/lib/ldb/common/ldb_modules.c
@@ -517,10 +517,6 @@ int ldb_next_request(struct ldb_module *module, struct ldb_request *request)
 		FIND_OP(module, extended);
 		ret = module->ops->extended(module, request);
 		break;
-	case LDB_SEQUENCE_NUMBER:
-		FIND_OP(module, sequence_number);
-		ret = module->ops->sequence_number(module, request);
-		break;
 	default:
 		FIND_OP(module, request);
 		ret = module->ops->request(module, request);
diff --git a/source4/lib/ldb/include/ldb.h b/source4/lib/ldb/include/ldb.h
index b1ce3ef70b..9bc5c183d8 100644
--- a/source4/lib/ldb/include/ldb.h
+++ b/source4/lib/ldb/include/ldb.h
@@ -652,7 +652,6 @@ enum ldb_request_type {
 	LDB_DELETE,
 	LDB_RENAME,
 	LDB_EXTENDED,
-	LDB_SEQUENCE_NUMBER,
 	LDB_REQ_REGISTER_CONTROL,
 	LDB_REQ_REGISTER_PARTITION
 };
@@ -679,21 +678,38 @@ struct ldb_extended {
 	void *data; /* NULL or a valid talloc pointer! talloc_get_type() will be used on it */
 };
 
+#define LDB_EXTENDED_SEQUENCE_NUMBER	"1.3.6.1.4.1.7165.4.4.3"
+
+enum ldb_sequence_type {
+	LDB_SEQ_HIGHEST_SEQ,
+	LDB_SEQ_HIGHEST_TIMESTAMP,
+	LDB_SEQ_NEXT
+};
+
+struct ldb_seqnum_request {
+	enum ldb_sequence_type type;
+};
+
+struct ldb_seqnum_result {
+	uint64_t seq_num;
+	uint32_t flags;
+};
+
 struct ldb_result {
 	unsigned int count;
 	struct ldb_message **msgs;
-	char **refs;
 	struct ldb_extended *extended;
 	struct ldb_control **controls;
+	char **refs;
 };
 
 struct ldb_reply {
+	int error;
 	enum ldb_reply_type type;
 	struct ldb_message *message;
 	struct ldb_extended *response;
-	char *referral;
 	struct ldb_control **controls;
-	int error;
+	char *referral;
 };
 
 struct ldb_request;
@@ -732,18 +748,6 @@ struct ldb_register_partition {
 	struct ldb_dn *dn;
 };
 
-enum ldb_sequence_type {
-	LDB_SEQ_HIGHEST_SEQ,
-	LDB_SEQ_HIGHEST_TIMESTAMP,
-	LDB_SEQ_NEXT
-};
-
-struct ldb_sequence_number {
-	enum ldb_sequence_type type;
-	uint64_t seq_num;
-	uint32_t flags;
-};
-
 typedef int (*ldb_request_callback_t)(struct ldb_request *, struct ldb_reply *);
 
 struct ldb_request {
@@ -757,7 +761,6 @@ struct ldb_request {
 		struct ldb_delete del;
 		struct ldb_rename rename;
 		struct ldb_extended extended;
-		struct ldb_sequence_number seq_num;
 		struct ldb_register_control reg_control;
 		struct ldb_register_partition reg_partition;
 	} op;
diff --git a/source4/lib/ldb/ldb.i b/source4/lib/ldb/ldb.i
index 024ba1959a..6013462225 100644
--- a/source4/lib/ldb/ldb.i
+++ b/source4/lib/ldb/ldb.i
@@ -1219,25 +1219,6 @@ int py_module_del_transaction(struct ldb_module *mod)
     return LDB_SUCCESS;
 }
 
-int py_module_sequence_number(struct ldb_module *mod, struct ldb_request *req)
-{
-    PyObject *py_ldb = mod->private_data;
-    PyObject *py_result;
-    int ret;
-
-    py_result = PyObject_CallMethod(py_ldb, "sequence_number", "ili", req->op.seq_num.type, req->op.seq_num.seq_num, req->op.seq_num.flags);
-
-    if (py_result == NULL) {
-        return LDB_ERR_OPERATIONS_ERROR;
-    }
-
-    ret = PyInt_AsLong(py_result);
-
-    Py_DECREF(py_result);
-
-    return ret;
-}
-
 static int py_module_destructor(void *_mod)
 {
     struct ldb_module *mod = _mod;
@@ -1292,7 +1273,6 @@ int py_module_init (struct ldb_module *mod)
     $1->start_transaction = py_module_start_transaction;
     $1->end_transaction = py_module_end_transaction;
     $1->del_transaction = py_module_del_transaction;
-    $1->sequence_number = py_module_sequence_number;
 }
 
 %feature("docstring") ldb_register_module "S.register_module(module) -> None\n"
diff --git a/source4/lib/ldb/ldb_tdb/ldb_search.c b/source4/lib/ldb/ldb_tdb/ldb_search.c
index a220b4a628..1c76411db2 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_search.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_search.c
@@ -277,30 +277,6 @@ int ltdb_search_dn1(struct ldb_module *module, struct ldb_dn *dn, struct ldb_mes
 }
 
 /*
-  lock the database for read - use by ltdb_search
-*/
-static int ltdb_lock_read(struct ldb_module *module)
-{
-	struct ltdb_private *ltdb = (struct ltdb_private *)module->private_data;
-	if (ltdb->in_transaction == 0) {
-		return tdb_lockall_read(ltdb->tdb);
-	}
-	return 0;
-}
-
-/*
-  unlock the database after a ltdb_lock_read()
-*/
-static int ltdb_unlock_read(struct ldb_module *module)
-{
-	struct ltdb_private *ltdb = (struct ltdb_private *)module->private_data;
-	if (ltdb->in_transaction == 0) {
-		return tdb_unlockall_read(ltdb->tdb);
-	}
-	return 0;
-}
-
-/*
   add a set of attributes from a record to a set of results
   return 0 on success, -1 on failure
 */
diff --git a/source4/lib/ldb/ldb_tdb/ldb_tdb.c b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
index 0087f6c44d..2282f61d47 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_tdb.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
@@ -79,6 +79,30 @@ static int ltdb_err_map(enum TDB_ERROR tdb_code)
 	return LDB_ERR_OTHER;
 }
 
+/*
+  lock the database for read - use by ltdb_search and ltdb_sequence_number
+*/
+int ltdb_lock_read(struct ldb_module *module)
+{
+	struct ltdb_private *ltdb = (struct ltdb_private *)module->private_data;
+	if (ltdb->in_transaction == 0) {
+		return tdb_lockall_read(ltdb->tdb);
+	}
+	return 0;
+}
+
+/*
+  unlock the database after a ltdb_lock_read()
+*/
+int ltdb_unlock_read(struct ldb_module *module)
+{
+	struct ltdb_private *ltdb = (struct ltdb_private *)module->private_data;
+	if (ltdb->in_transaction == 0) {
+		return tdb_unlockall_read(ltdb->tdb);
+	}
+	return 0;
+}
+
 
 /*
   form a TDB_DATA for a record key
@@ -860,61 +884,88 @@ static int ltdb_del_trans(struct ldb_module *module)
 /*
   return sequenceNumber from @BASEINFO
 */
-static int ltdb_sequence_number(struct ldb_module *module,
-				struct ldb_request *req)
+static int ltdb_sequence_number(struct ltdb_context *ctx,
+				struct ldb_extended **ext)
 {
+	struct ldb_module *module = ctx->module;
+	struct ldb_request *req = ctx->req;
 	TALLOC_CTX *tmp_ctx;
+	struct ldb_seqnum_request *seq;
+	struct ldb_seqnum_result *res;
 	struct ldb_message *msg = NULL;
 	struct ldb_dn *dn;
 	const char *date;
-	int tret;
+	int ret;
 
+	seq = talloc_get_type(req->op.extended.data,
+				struct ldb_seqnum_request);
+	if (seq == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	req->handle->state = LDB_ASYNC_PENDING;
+
+	if (ltdb_lock_read(module) != 0) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	res = talloc_zero(req, struct ldb_seqnum_result);
+	if (res == NULL) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
+	}
 	tmp_ctx = talloc_new(req);
 	if (tmp_ctx == NULL) {
-		talloc_free(tmp_ctx);
-		return LDB_ERR_OPERATIONS_ERROR;
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
 	}
 
 	dn = ldb_dn_new(tmp_ctx, module->ldb, LTDB_BASEINFO);
 
 	msg = talloc(tmp_ctx, struct ldb_message);
 	if (msg == NULL) {
-		talloc_free(tmp_ctx);
-		return LDB_ERR_OPERATIONS_ERROR;
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
 	}
 
-	req->op.seq_num.flags = 0;
-
-	tret = ltdb_search_dn1(module, dn, msg);
-	if (tret != LDB_SUCCESS) {
-		talloc_free(tmp_ctx);
-		/* zero is as good as anything when we don't know */
-		req->op.seq_num.seq_num = 0;
-		return tret;
+	ret = ltdb_search_dn1(module, dn, msg);
+	if (ret != LDB_SUCCESS) {
+		goto done;
 	}
 
-	switch (req->op.seq_num.type) {
+	switch (seq->type) {
 	case LDB_SEQ_HIGHEST_SEQ:
-		req->op.seq_num.seq_num = ldb_msg_find_attr_as_uint64(msg, LTDB_SEQUENCE_NUMBER, 0);
+		res->seq_num = ldb_msg_find_attr_as_uint64(msg, LTDB_SEQUENCE_NUMBER, 0);
 		break;
 	case LDB_SEQ_NEXT:
-		req->op.seq_num.seq_num = ldb_msg_find_attr_as_uint64(msg, LTDB_SEQUENCE_NUMBER, 0);
-		req->op.seq_num.seq_num++;
+		res->seq_num = ldb_msg_find_attr_as_uint64(msg, LTDB_SEQUENCE_NUMBER, 0);
+		res->seq_num++;
 		break;
 	case LDB_SEQ_HIGHEST_TIMESTAMP:
 		date = ldb_msg_find_attr_as_string(msg, LTDB_MOD_TIMESTAMP, NULL);
 		if (date) {
-			req->op.seq_num.seq_num = ldb_string_to_time(date);
+			res->seq_num = ldb_string_to_time(date);
 		} else {
-			req->op.seq_num.seq_num = 0;
+			res->seq_num = 0;
 			/* zero is as good as anything when we don't know */
 		}
 		break;
 	}
 
-	talloc_free(tmp_ctx);
+	*ext = talloc_zero(req, struct ldb_extended);
+	if (*ext == NULL) {
+		ret = LDB_ERR_OPERATIONS_ERROR;
+		goto done;
+	}
+	(*ext)->oid = LDB_EXTENDED_SEQUENCE_NUMBER;
+	(*ext)->data = talloc_steal(*ext, res);
 
-	return LDB_SUCCESS;
+	ret = LDB_SUCCESS;
+
+done:
+	talloc_free(tmp_ctx);
+	ltdb_unlock_read(module);
+	return ret;
 }
 
 void ltdb_request_done(struct ldb_request *req, int error)
@@ -949,6 +1000,47 @@ static void ltdb_timeout(struct event_context *ev,
 	ltdb_request_done(ctx->req, LDB_ERR_TIME_LIMIT_EXCEEDED);
 }
 
+static void ltdb_request_extended_done(struct ldb_request *req,
+					struct ldb_extended *ext,
+					int error)
+{
+	struct ldb_reply *ares;
+
+	/* if we already returned an error just return */
+	if (req->handle->status != LDB_SUCCESS) {
+		return;
+	}
+
+	ares = talloc_zero(req, struct ldb_reply);
+	if (!ares) {
+		ldb_oom(req->handle->ldb);
+		req->callback(req, NULL);
+		return;
+	}
+	ares->type = LDB_REPLY_DONE;
+	ares->response = ext;
+	ares->error = error;
+
+	req->callback(req, ares);
+}
+
+static void ltdb_handle_extended(struct ltdb_context *ctx)
+{
+	struct ldb_extended *ext = NULL;
+	int ret;
+
+	if (strcmp(ctx->req->op.extended.oid,
+		   LDB_EXTENDED_SEQUENCE_NUMBER) == 0) {
+		/* get sequence number */
+		ret = ltdb_sequence_number(ctx, &ext);
+	} else {
+		/* not recognized */
+		ret = LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION;
+	}
+
+	ltdb_request_extended_done(ctx->req, ext, ret);
+}
+
 static void ltdb_callback(struct event_context *ev,
 			  struct timed_event *te,
 			  struct timeval t,
@@ -975,6 +1067,9 @@ static void ltdb_callback(struct event_context *ev,
 	case LDB_RENAME:
 		ret = ltdb_rename(ctx);
 		break;
+	case LDB_EXTENDED:
+		ltdb_handle_extended(ctx);
+		return;
 	default:
 		/* no other op supported */
 		ret = LDB_ERR_UNWILLING_TO_PERFORM;
@@ -1037,11 +1132,10 @@ static const struct ldb_module_ops ltdb_ops = {
 	.modify            = ltdb_handle_request,
 	.del               = ltdb_handle_request,
 	.rename            = ltdb_handle_request,
-/*	.request           = ltdb_handle_request, */
+	.extended          = ltdb_handle_request,
 	.start_transaction = ltdb_start_trans,
 	.end_transaction   = ltdb_end_trans,
 	.del_transaction   = ltdb_del_trans,
-	.sequence_number   = ltdb_sequence_number
 };
 
 /*
diff --git a/source4/lib/ldb/ldb_tdb/ldb_tdb.h b/source4/lib/ldb/ldb_tdb/ldb_tdb.h
index 223181ca0b..61e90bccc6 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_tdb.h
+++ b/source4/lib/ldb/ldb_tdb/ldb_tdb.h
@@ -112,6 +112,8 @@ int ltdb_filter_attrs(struct ldb_message *msg, const char * const *attrs);
 int ltdb_search(struct ltdb_context *ctx);
 
 /* The following definitions come from lib/ldb/ldb_tdb/ldb_tdb.c  */
+int ltdb_lock_read(struct ldb_module *module);
+int ltdb_unlock_read(struct ldb_module *module);
 struct TDB_DATA ltdb_key(struct ldb_module *module, struct ldb_dn *dn);
 int ltdb_store(struct ldb_module *module, const struct ldb_message *msg, int flgs);
 int ltdb_delete_noindex(struct ldb_module *module, struct ldb_dn *dn);
diff --git a/source4/lib/ldb/ldb_wrap.c b/source4/lib/ldb/ldb_wrap.c
index cc8099f27f..bc9266a306 100644
--- a/source4/lib/ldb/ldb_wrap.c
+++ b/source4/lib/ldb/ldb_wrap.c
@@ -3505,25 +3505,6 @@ int py_module_del_transaction(struct ldb_module *mod)
     return LDB_SUCCESS;
 }
 
-int py_module_sequence_number(struct ldb_module *mod, struct ldb_request *req)
-{
-    PyObject *py_ldb = mod->private_data;
-    PyObject *py_result;
-    int ret;
-
-    py_result = PyObject_CallMethod(py_ldb, "sequence_number", "ili", req->op.seq_num.type, req->op.seq_num.seq_num, req->op.seq_num.flags);
-
-    if (py_result == NULL) {
-        return LDB_ERR_OPERATIONS_ERROR;
-    }
-
-    ret = PyInt_AsLong(py_result);
-
-    Py_DECREF(py_result);
-
-    return ret;
-}
-
 static int py_module_destructor(void *_mod)
 {
     struct ldb_module *mod = _mod;
@@ -6648,7 +6629,6 @@ SWIGINTERN PyObject *_wrap_register_module(PyObject *SWIGUNUSEDPARM(self), PyObj
   arg1->start_transaction = py_module_start_transaction;
   arg1->end_transaction = py_module_end_transaction;
   arg1->del_transaction = py_module_del_transaction;
-  arg1->sequence_number = py_module_sequence_number;
   result = ldb_register_module((struct ldb_module_ops const *)arg1);
   if (result != 0) {
     PyErr_SetObject(PyExc_LdbError, Py_BuildValue((char *)"(i,s)", result, ldb_strerror(result)));
diff --git a/source4/librpc/idl/drsuapi.idl b/source4/librpc/idl/drsuapi.idl
index a41bc9cf19..b0fb583ed4 100644
--- a/source4/librpc/idl/drsuapi.idl
+++ b/source4/librpc/idl/drsuapi.idl
@@ -1044,6 +1044,29 @@ interface drsuapi
 		[size_is(count)] drsuapi_DsGetDCInfo2 *array;
 	} drsuapi_DsGetDCInfoCtr2;
 
+	typedef struct {
+		[charset(UTF16),string] uint16 *netbios_name;
+		[charset(UTF16),string] uint16 *dns_name;
+		[charset(UTF16),string] uint16 *site_name;
+		[charset(UTF16),string] uint16 *site_dn;
+		[charset(UTF16),string] uint16 *computer_dn;
+		[charset(UTF16),string] uint16 *server_dn;
+		[charset(UTF16),string] uint16 *ntds_dn;
+		uint32 is_pdc;
+		uint32 is_enabled;
+		uint32 is_gc;
+		uint32 is_rodc;
+		GUID site_guid;
+		GUID computer_guid;
+		GUID server_guid;
+		GUID ntds_guid;
+	} drsuapi_DsGetDCInfo3;
+
+	typedef struct {
+		[range(0,10000)] uint32 count;
+		[size_is(count)] drsuapi_DsGetDCInfo3 *array;
+	} drsuapi_DsGetDCInfoCtr3;
+
 	/*
 	 * this represents an active connection to the
 	 * Directory System Agent (DSA)
@@ -1075,12 +1098,14 @@ interface drsuapi
 	typedef [v1_enum] enum {
 		DRSUAPI_DC_INFO_CTR_1  = 1,
 		DRSUAPI_DC_INFO_CTR_2  = 2,
+		DRSUAPI_DC_INFO_CTR_3  = 3,
 		DRSUAPI_DC_CONNECTION_CTR_01 = -1
 	} drsuapi_DsGetDCInfoCtrLevels;
 
         typedef [switch_type(int32)] union {
 		[case(DRSUAPI_DC_INFO_CTR_1)]  drsuapi_DsGetDCInfoCtr1  ctr1;
 		[case(DRSUAPI_DC_INFO_CTR_2)]  drsuapi_DsGetDCInfoCtr2  ctr2;
+		[case(DRSUAPI_DC_INFO_CTR_3)]  drsuapi_DsGetDCInfoCtr3  ctr3;
 		[case(DRSUAPI_DC_CONNECTION_CTR_01)] drsuapi_DsGetDCConnectionCtr01 ctr01;
 	} drsuapi_DsGetDCInfoCtr;
 
diff --git a/source4/setup/schema_samba4.ldif b/source4/setup/schema_samba4.ldif
index 2c007395fb..c27157d713 100644
--- a/source4/setup/schema_samba4.ldif
+++ b/source4/setup/schema_samba4.ldif
@@ -177,6 +177,8 @@ oMSyntax: 20
 #Allocated: DSDB_CONTROL_REPLICATED_UPDATE_OID 1.3.6.1.4.1.7165.4.3.3
 
 #Allocated: DSDB_EXTENDED_REPLICATED_OBJECTS_OID 1.3.6.1.4.1.7165.4.4.1
+#Allocated: DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID 1.3.6.1.4.1.7165.4.4.2
+#Allocated: LDB_EXTENDED_SEQUENCE_NUMBER 1.3.6.1.4.1.7165.4.4.3
 
 #Allocated: (middleName) attributeID: 1.3.6.1.4.1.7165.4.255.1
 
diff --git a/testprogs/win32/midltests/Makefile b/testprogs/win32/midltests/Makefile
new file mode 100644
index 0000000000..535968b16d
--- /dev/null
+++ b/testprogs/win32/midltests/Makefile
@@ -0,0 +1,27 @@
+INCLUDES=-I
+CFLAGS=$(INCLUDES) -Zi -D_WIN32_WINNT=0x502
+LIBS=rpcrt4.lib
+
+all: midltests.exe
+
+clean:
+	del *~ *.obj *.exe midltests.h midltests_s.c midltests_c.c
+
+#MIDL_ARGS=/target NT50
+MIDL_ARGS=/Os /prefix client cli_ /prefix server srv_ /prefix switch swi_
+midltests.h midltests_s.c midltests_c.c: midltests.idl midltests.acf
+	midl $(MIDL_ARGS) /acf midltests.acf midltests.idl
+
+MIDLTESTS_OBJ = midltests.obj midltests_s_m.obj midltests_c_m.obj midltests_marshall.obj utils.obj
+midltests.exe: $(MIDLTESTS_OBJ)
+	$(CC) -o midltests.exe $(MIDLTESTS_OBJ) $(LIBS)
+
+midltests.obj: midltests.h midltests.idl
+midltests_c_m.c: midltests_c.c
+midltests_s_m.c: midltests_s.c
+
+midltests.obj: midltests.h midltests.idl midltests.c
+midltests_s_m.obj: midltests_marshall.h midltests_s.c midltests_s_m.c
+midltests_c_m.obj: midltests_marshall.h midltests_c.c midltests_c_m.c
+midltests_marshall.obj: midltests.h midltests_marshall.c
+utils.obj: midltests.h utils.c