r17839: do not reference possibleInferiors we have not extracted

trim duplicate may attributes
(This used to be commit 4975659fd70abdbae42ee378b7be766102f4df55)

2 files changed, 81 insertions, 405 deletions

diff --git a/source4/setup/schema.ldif b/source4/setup/schema.ldif
index 3a583faf2e..c664a55ba9 100644
--- a/source4/setup/schema.ldif
+++ b/source4/setup/schema.ldif
@@ -6951,41 +6951,18 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RP;;;WD)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)(A;;RPLCLORC;;;AU)(A;;RPWPCRLCLOCCRCWDWOSW;;;DA)(A;CI;RPWPCRLCLOCCRCWDWOSDSW;;;BA)(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EA)(A;CI;LC;;;RU)(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;;RP;c7407360-20bf-11d0-a768-00aa006e0529;;RU)(OA;CIIO;RPLCLORC;;bf967a9c-0de6-11d0-a285-00aa003049e2;RU)(A;;RPRC;;;RU)(OA;CIIO;RPLCLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(A;;LCRPLORC;;;ED)(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;CIIO;RPLCLORC;;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;RU)(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;AU)(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;ED)(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;DD)(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)(OA;;CR;e2a36dc9-ae17-47c3-b58b-be34c55ba633;;S-1-5-32-557)(OA;;CR;280f369c-67c7-438e-ae98-1d46f3c6f541;;AU)(OA;;CR;ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501;;AU)(OA;;CR;05c74c5e-4deb-43b4-bd9f-86664c2a7fd5;;AU)S:(AU;SA;WDWOWP;;;WD)(AU;SA;CR;;;BA)(AU;SA;CR;;;DU)(OU;CISA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: samServer
 possibleInferiors: group
-possibleInferiors: msPKI-Key-Recovery-Agent
 possibleInferiors: lostAndFound
-possibleInferiors: rpcContainer
 possibleInferiors: builtinDomain
-possibleInferiors: msMQ-Custom-Recipient
-possibleInferiors: msCOM-Partition
-possibleInferiors: friendlyCountry
-possibleInferiors: msCOM-PartitionSet
 possibleInferiors: computer
 possibleInferiors: user
 possibleInferiors: container
-possibleInferiors: rFC822LocalPart
-possibleInferiors: groupPolicyContainer
 possibleInferiors: organization
-possibleInferiors: inetOrgPerson
 possibleInferiors: domainDNS
-possibleInferiors: printQueue
-possibleInferiors: volume
-possibleInferiors: dfsConfiguration
 possibleInferiors: locality
-possibleInferiors: intellimirrorGroup
-possibleInferiors: physicalLocation
 possibleInferiors: msDS-AzAdminManager
-possibleInferiors: msExchConfigurationContainer
-possibleInferiors: msDS-QuotaContainer
-possibleInferiors: groupOfUniqueNames
 possibleInferiors: country
 possibleInferiors: organizationalUnit
-possibleInferiors: remoteMailRecipient
-possibleInferiors: classStore
-possibleInferiors: domainPolicy
-possibleInferiors: contact
-possibleInferiors: mSMQMigratedUser
 schemaIDGUID: 19195a5b-6da0-11d0-afd3-00c04fd930c9
 
 dn: CN=ms-DS-Az-Application,CN=Schema,CN=Configuration,${BASEDN}
@@ -7012,14 +6989,8 @@ systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;CO)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
 possibleInferiors: group
-possibleInferiors: rpcContainer
 possibleInferiors: container
 possibleInferiors: msDS-AzScope
-possibleInferiors: groupPolicyContainer
-possibleInferiors: msDS-AzTask
-possibleInferiors: msDS-AzRole
-possibleInferiors: msExchConfigurationContainer
-possibleInferiors: msDS-AzOperation
 schemaIDGUID: ddf8de9b-cba5-4e12-842e-28d8b66f75ec
 
 dn: CN=Builtin-Domain,CN=Schema,CN=Configuration,${BASEDN}
@@ -7041,11 +7012,8 @@ systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPLCLORC;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
 possibleInferiors: group
-possibleInferiors: msPKI-Key-Recovery-Agent
 possibleInferiors: computer
 possibleInferiors: user
-possibleInferiors: inetOrgPerson
-possibleInferiors: mSMQMigratedUser
 schemaIDGUID: bf967a81-0de6-11d0-a285-00aa003049e2
 
 dn: CN=Infrastructure-Update,CN=Schema,CN=Configuration,${BASEDN}
@@ -7090,14 +7058,8 @@ systemOnly: TRUE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
 possibleInferiors: lostAndFound
-possibleInferiors: rpcContainer
 possibleInferiors: sitesContainer
-possibleInferiors: addressBookContainer
 possibleInferiors: container
-possibleInferiors: groupPolicyContainer
-possibleInferiors: physicalLocation
-possibleInferiors: msExchConfigurationContainer
-possibleInferiors: msDS-QuotaContainer
 schemaIDGUID: bf967a87-0de6-11d0-a285-00aa003049e2
 
 dn: CN=Cross-Ref,CN=Schema,CN=Configuration,${BASEDN}
@@ -7210,12 +7172,7 @@ systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;CO)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
 possibleInferiors: group
-possibleInferiors: rpcContainer
 possibleInferiors: container
-possibleInferiors: groupPolicyContainer
-possibleInferiors: msDS-AzTask
-possibleInferiors: msDS-AzRole
-possibleInferiors: msExchConfigurationContainer
 schemaIDGUID: 4feae054-ce55-47bb-860e-5b12063a51de
 
 dn: CN=Locality,CN=Schema,CN=Configuration,${BASEDN}
@@ -7244,11 +7201,8 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: residentialPerson
 possibleInferiors: organization
-possibleInferiors: groupOfNames
 possibleInferiors: locality
-possibleInferiors: physicalLocation
 schemaIDGUID: bf967aa0-0de6-11d0-a285-00aa003049e2
 
 dn: CN=Cross-Ref-Container,CN=Schema,CN=Configuration,${BASEDN}
@@ -7332,7 +7286,6 @@ systemFlags: 16
 systemOnly: TRUE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: nTDSConnection
 schemaIDGUID: f0f8ffab-1191-11d0-a060-00aa006c33ed
 
 dn: CN=Sam-Domain,CN=Schema,CN=Configuration,${BASEDN}
@@ -7453,7 +7406,6 @@ defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCL
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
 possibleInferiors: organization
 possibleInferiors: locality
-possibleInferiors: physicalLocation
 possibleInferiors: organizationalUnit
 schemaIDGUID: bf967a8c-0de6-11d0-a285-00aa003049e2
 
@@ -7509,65 +7461,15 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(OA;;CCDC;bf967a86-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967aba-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967a9c-0de6-11d0-a285-00aa003049e2;;AO)(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)(A;;RPLCLORC;;;AU)(A;;LCRPLORC;;;ED)(OA;;CCDC;4828CC14-1437-45bc-9B07-AD6F015E5F28;;AO)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: applicationEntity
 possibleInferiors: group
-possibleInferiors: applicationVersion
-possibleInferiors: msPKI-Key-Recovery-Agent
-possibleInferiors: rpcContainer
-possibleInferiors: msieee80211-Policy
-possibleInferiors: msMQ-Custom-Recipient
-possibleInferiors: documentSeries
-possibleInferiors: msCOM-Partition
-possibleInferiors: device
-possibleInferiors: msCOM-PartitionSet
-possibleInferiors: serviceAdministrationPoint
 possibleInferiors: computer
-possibleInferiors: rRASAdministrationConnectionPoint
-possibleInferiors: organizationalRole
-possibleInferiors: residentialPerson
-possibleInferiors: mS-SQL-OLAPServer
 possibleInferiors: user
-possibleInferiors: document
 possibleInferiors: container
-possibleInferiors: rFC822LocalPart
-possibleInferiors: groupPolicyContainer
-possibleInferiors: remoteStorageServicePoint
-possibleInferiors: msDS-AppData
-possibleInferiors: inetOrgPerson
-possibleInferiors: groupOfNames
 possibleInferiors: person
-possibleInferiors: intellimirrorSCP
-possibleInferiors: printQueue
-possibleInferiors: msTAPI-RtPerson
-possibleInferiors: volume
-possibleInferiors: ipsecNFA
 possibleInferiors: locality
-possibleInferiors: msDS-App-Configuration
-possibleInferiors: serviceConnectionPoint
-possibleInferiors: intellimirrorGroup
-possibleInferiors: physicalLocation
-possibleInferiors: ipsecNegotiationPolicy
 possibleInferiors: msDS-AzAdminManager
-possibleInferiors: mS-SQL-SQLServer
-possibleInferiors: indexServerCatalog
-possibleInferiors: msExchConfigurationContainer
-possibleInferiors: groupOfUniqueNames
-possibleInferiors: nTFRSSettings
 possibleInferiors: organizationalUnit
-possibleInferiors: msTAPI-RtConference
-possibleInferiors: room
-possibleInferiors: msMQ-Group
-possibleInferiors: remoteMailRecipient
-possibleInferiors: classStore
-possibleInferiors: ipsecPolicy
-possibleInferiors: dSA
-possibleInferiors: ipsecFilter
 possibleInferiors: organizationalPerson
-possibleInferiors: account
-possibleInferiors: domainPolicy
-possibleInferiors: contact
-possibleInferiors: mSMQMigratedUser
-possibleInferiors: ipsecISAKMPPolicy
 schemaIDGUID: bf967aa5-0de6-11d0-a285-00aa003049e2
 
 dn: CN=Lost-And-Found,CN=Schema,CN=Configuration,${BASEDN}
@@ -7590,172 +7492,34 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: applicationEntity
-possibleInferiors: msWMI-RangeParam
-possibleInferiors: pKIEnrollmentService
-possibleInferiors: mSMQEnterpriseSettings
-possibleInferiors: serviceInstance
-possibleInferiors: samServer
 possibleInferiors: group
-possibleInferiors: msWMI-UnknownRangeParam
-possibleInferiors: applicationVersion
-possibleInferiors: msPKI-Key-Recovery-Agent
 possibleInferiors: msDS-AzApplication
 possibleInferiors: lostAndFound
-possibleInferiors: rpcProfile
-possibleInferiors: nTDSSiteSettings
-possibleInferiors: linkTrackOMTEntry
-possibleInferiors: meeting
-possibleInferiors: trustedDomain
-possibleInferiors: linkTrackObjectMoveTable
-possibleInferiors: fTDfs
-possibleInferiors: mS-SQL-SQLRepository
-possibleInferiors: msWMI-ShadowObject
-possibleInferiors: rpcProfileElement
-possibleInferiors: rpcContainer
-possibleInferiors: dSUISettings
 possibleInferiors: subnetContainer
-possibleInferiors: interSiteTransport
-possibleInferiors: msieee80211-Policy
 possibleInferiors: builtinDomain
-possibleInferiors: msMQ-Custom-Recipient
-possibleInferiors: mSMQSiteLink
-possibleInferiors: msWMI-PolicyTemplate
-possibleInferiors: documentSeries
-possibleInferiors: msCOM-Partition
-possibleInferiors: device
-possibleInferiors: friendlyCountry
 possibleInferiors: sitesContainer
-possibleInferiors: msWMI-PolicyType
-possibleInferiors: linkTrackVolEntry
-possibleInferiors: msCOM-PartitionSet
 possibleInferiors: serversContainer
-possibleInferiors: attributeSchema
-possibleInferiors: serviceClass
-possibleInferiors: serviceAdministrationPoint
-possibleInferiors: packageRegistration
-possibleInferiors: msWMI-StringSetParam
 possibleInferiors: classSchema
 possibleInferiors: computer
-possibleInferiors: fileLinkTracking
-possibleInferiors: rRASAdministrationConnectionPoint
-possibleInferiors: organizationalRole
-possibleInferiors: certificationAuthority
-possibleInferiors: residentialPerson
-possibleInferiors: msWMI-ObjectEncoding
-possibleInferiors: mS-SQL-OLAPServer
-possibleInferiors: mSMQQueue
-possibleInferiors: fileLinkTrackingEntry
-possibleInferiors: msWMI-UintRangeParam
 possibleInferiors: foreignSecurityPrincipal
 possibleInferiors: user
-possibleInferiors: nTDSConnection
-possibleInferiors: msWMI-UintSetParam
-possibleInferiors: addressBookContainer
-possibleInferiors: mS-SQL-OLAPCube
-possibleInferiors: document
 possibleInferiors: container
-possibleInferiors: comConnectionPoint
-possibleInferiors: rFC822LocalPart
 possibleInferiors: msDS-AzScope
-possibleInferiors: nTFRSMember
-possibleInferiors: dHCPClass
-possibleInferiors: siteLinkBridge
-possibleInferiors: dnsNode
-possibleInferiors: groupPolicyContainer
-possibleInferiors: remoteStorageServicePoint
-possibleInferiors: mS-SQL-SQLPublication
-possibleInferiors: nTFRSSubscriptions
 possibleInferiors: site
 possibleInferiors: organization
-possibleInferiors: msDS-AppData
-possibleInferiors: inetOrgPerson
 possibleInferiors: domainDNS
-possibleInferiors: siteLink
-possibleInferiors: licensingSiteSettings
-possibleInferiors: rpcServer
-possibleInferiors: groupOfNames
-possibleInferiors: nTFRSSubscriber
-possibleInferiors: mS-SQL-SQLDatabase
 possibleInferiors: person
-possibleInferiors: intellimirrorSCP
-possibleInferiors: msWMI-WMIGPO
-possibleInferiors: aCSResourceLimits
-possibleInferiors: interSiteTransportContainer
-possibleInferiors: printQueue
-possibleInferiors: msTAPI-RtPerson
-possibleInferiors: volume
-possibleInferiors: ipsecNFA
-possibleInferiors: queryPolicy
-possibleInferiors: msDS-AzTask
-possibleInferiors: msPKI-Enterprise-Oid
-possibleInferiors: msDS-AzRole
-possibleInferiors: mS-SQL-OLAPDatabase
-possibleInferiors: dfsConfiguration
-possibleInferiors: aCSPolicy
-possibleInferiors: typeLibrary
-possibleInferiors: rpcGroup
 possibleInferiors: locality
-possibleInferiors: msDS-App-Configuration
-possibleInferiors: serviceConnectionPoint
-possibleInferiors: rpcServerElement
-possibleInferiors: intellimirrorGroup
-possibleInferiors: mSMQConfiguration
-possibleInferiors: msPKI-PrivateKeyRecoveryAgent
-possibleInferiors: msWMI-IntRangeParam
-possibleInferiors: physicalLocation
-possibleInferiors: msWMI-MergeablePolicyTemplate
-possibleInferiors: ipsecNegotiationPolicy
 possibleInferiors: subnet
 possibleInferiors: msDS-AzAdminManager
-possibleInferiors: mS-SQL-SQLServer
-possibleInferiors: msWMI-RealRangeParam
 possibleInferiors: crossRef
-possibleInferiors: mSMQSettings
-possibleInferiors: controlAccessRight
 possibleInferiors: displaySpecifier
 possibleInferiors: nTDSService
-possibleInferiors: indexServerCatalog
-possibleInferiors: displayTemplate
-possibleInferiors: msExchConfigurationContainer
-possibleInferiors: msDS-QuotaContainer
-possibleInferiors: groupOfUniqueNames
 possibleInferiors: country
-possibleInferiors: addressTemplate
-possibleInferiors: msWMI-Rule
-possibleInferiors: msWMI-IntSetParam
-possibleInferiors: nTFRSSettings
-possibleInferiors: msWMI-SimplePolicyTemplate
-possibleInferiors: pKICertificateTemplate
-possibleInferiors: rRASAdministrationDictionary
 possibleInferiors: organizationalUnit
-possibleInferiors: msTAPI-RtConference
-possibleInferiors: linkTrackVolumeTable
-possibleInferiors: msWMI-Som
 possibleInferiors: secret
-possibleInferiors: room
-possibleInferiors: aCSSubnet
-possibleInferiors: msMQ-Group
-possibleInferiors: remoteMailRecipient
-possibleInferiors: classStore
-possibleInferiors: ipsecPolicy
-possibleInferiors: dSA
-possibleInferiors: categoryRegistration
-possibleInferiors: msDS-AzOperation
-possibleInferiors: ipsecFilter
 possibleInferiors: organizationalPerson
-possibleInferiors: account
-possibleInferiors: storage
-possibleInferiors: domainPolicy
 possibleInferiors: server
-possibleInferiors: classRegistration
-possibleInferiors: nTFRSReplicaSet
-possibleInferiors: cRLDistributionPoint
-possibleInferiors: dnsZone
-possibleInferiors: contact
-possibleInferiors: msDS-QuotaControl
-possibleInferiors: mSMQMigratedUser
-possibleInferiors: ipsecISAKMPPolicy
 schemaIDGUID: 52ab8671-5709-11d1-a9c6-0000f80367c1
 
 dn: CN=Organizational-Person,CN=Schema,CN=Configuration,${BASEDN}
@@ -7857,10 +7621,7 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: rpcContainer
 possibleInferiors: container
-possibleInferiors: groupPolicyContainer
-possibleInferiors: msExchConfigurationContainer
 schemaIDGUID: 19195a5f-6da0-11d0-afd3-00c04fd930c9
 
 dn: CN=Servers-Container,CN=Schema,CN=Configuration,${BASEDN}
@@ -7927,37 +7688,6 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPCRLCLORCSDDT;;;CO)(OA;;WP;4c164200-20c0-11d0-a768-00aa006e0529;;CO)(A;;RPLCLORC;;;AU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(A;;CCDC;;;PS)(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;CA)(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;PS)(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;PS)(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;CO)(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;CO)(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: serviceInstance
-possibleInferiors: applicationVersion
-possibleInferiors: rpcProfile
-possibleInferiors: rpcProfileElement
-possibleInferiors: msieee80211-Policy
-possibleInferiors: serviceAdministrationPoint
-possibleInferiors: rRASAdministrationConnectionPoint
-possibleInferiors: mS-SQL-OLAPServer
-possibleInferiors: comConnectionPoint
-possibleInferiors: remoteStorageServicePoint
-possibleInferiors: nTFRSSubscriptions
-possibleInferiors: msDS-AppData
-possibleInferiors: rpcServer
-possibleInferiors: intellimirrorSCP
-possibleInferiors: printQueue
-possibleInferiors: volume
-possibleInferiors: ipsecNFA
-possibleInferiors: rpcGroup
-possibleInferiors: msDS-App-Configuration
-possibleInferiors: serviceConnectionPoint
-possibleInferiors: rpcServerElement
-possibleInferiors: mSMQConfiguration
-possibleInferiors: ipsecNegotiationPolicy
-possibleInferiors: mS-SQL-SQLServer
-possibleInferiors: indexServerCatalog
-possibleInferiors: classStore
-possibleInferiors: ipsecPolicy
-possibleInferiors: dSA
-possibleInferiors: ipsecFilter
-possibleInferiors: storage
-possibleInferiors: ipsecISAKMPPolicy
 schemaIDGUID: bf967a86-0de6-11d0-a285-00aa003049e2
 
 dn: CN=Person,CN=Schema,CN=Configuration,${BASEDN}
@@ -8018,106 +7748,17 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: applicationEntity
-possibleInferiors: pKIEnrollmentService
-possibleInferiors: mSMQEnterpriseSettings
-possibleInferiors: serviceInstance
-possibleInferiors: samServer
 possibleInferiors: group
-possibleInferiors: applicationVersion
-possibleInferiors: msPKI-Key-Recovery-Agent
-possibleInferiors: rpcProfile
-possibleInferiors: meeting
-possibleInferiors: trustedDomain
-possibleInferiors: linkTrackObjectMoveTable
-possibleInferiors: rpcProfileElement
-possibleInferiors: rpcContainer
-possibleInferiors: dSUISettings
-possibleInferiors: msieee80211-Policy
-possibleInferiors: msMQ-Custom-Recipient
-possibleInferiors: msWMI-PolicyTemplate
-possibleInferiors: documentSeries
-possibleInferiors: msCOM-Partition
-possibleInferiors: device
-possibleInferiors: msWMI-PolicyType
-possibleInferiors: msCOM-PartitionSet
-possibleInferiors: serviceClass
-possibleInferiors: serviceAdministrationPoint
 possibleInferiors: computer
-possibleInferiors: fileLinkTracking
-possibleInferiors: rRASAdministrationConnectionPoint
-possibleInferiors: organizationalRole
-possibleInferiors: certificationAuthority
-possibleInferiors: residentialPerson
-possibleInferiors: msWMI-ObjectEncoding
-possibleInferiors: mS-SQL-OLAPServer
 possibleInferiors: foreignSecurityPrincipal
 possibleInferiors: user
-possibleInferiors: document
 possibleInferiors: container
-possibleInferiors: comConnectionPoint
-possibleInferiors: rFC822LocalPart
-possibleInferiors: dHCPClass
-possibleInferiors: groupPolicyContainer
-possibleInferiors: remoteStorageServicePoint
-possibleInferiors: msDS-AppData
-possibleInferiors: inetOrgPerson
-possibleInferiors: rpcServer
-possibleInferiors: groupOfNames
 possibleInferiors: person
-possibleInferiors: intellimirrorSCP
-possibleInferiors: msWMI-WMIGPO
-possibleInferiors: aCSResourceLimits
-possibleInferiors: printQueue
-possibleInferiors: volume
-possibleInferiors: ipsecNFA
-possibleInferiors: queryPolicy
-possibleInferiors: msDS-AzTask
-possibleInferiors: msPKI-Enterprise-Oid
-possibleInferiors: msDS-AzRole
-possibleInferiors: dfsConfiguration
-possibleInferiors: aCSPolicy
-possibleInferiors: rpcGroup
-possibleInferiors: msDS-App-Configuration
-possibleInferiors: serviceConnectionPoint
-possibleInferiors: rpcServerElement
-possibleInferiors: intellimirrorGroup
-possibleInferiors: msPKI-PrivateKeyRecoveryAgent
-possibleInferiors: msWMI-MergeablePolicyTemplate
-possibleInferiors: ipsecNegotiationPolicy
 possibleInferiors: msDS-AzAdminManager
-possibleInferiors: mS-SQL-SQLServer
-possibleInferiors: controlAccessRight
 possibleInferiors: displaySpecifier
 possibleInferiors: nTDSService
-possibleInferiors: indexServerCatalog
-possibleInferiors: displayTemplate
-possibleInferiors: msExchConfigurationContainer
-possibleInferiors: groupOfUniqueNames
-possibleInferiors: addressTemplate
-possibleInferiors: msWMI-Rule
-possibleInferiors: nTFRSSettings
-possibleInferiors: msWMI-SimplePolicyTemplate
-possibleInferiors: pKICertificateTemplate
-possibleInferiors: rRASAdministrationDictionary
-possibleInferiors: linkTrackVolumeTable
-possibleInferiors: msWMI-Som
 possibleInferiors: secret
-possibleInferiors: room
-possibleInferiors: aCSSubnet
-possibleInferiors: classStore
-possibleInferiors: ipsecPolicy
-possibleInferiors: dSA
-possibleInferiors: msDS-AzOperation
-possibleInferiors: ipsecFilter
 possibleInferiors: organizationalPerson
-possibleInferiors: account
-possibleInferiors: storage
-possibleInferiors: domainPolicy
-possibleInferiors: cRLDistributionPoint
-possibleInferiors: dnsZone
-possibleInferiors: contact
-possibleInferiors: ipsecISAKMPPolicy
 schemaIDGUID: bf967a8b-0de6-11d0-a285-00aa003049e2
 
 dn: CN=Site,CN=Schema,CN=Configuration,${BASEDN}
@@ -8147,9 +7788,7 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)(A;;LCRPLORC;;;ED)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: nTDSSiteSettings
 possibleInferiors: serversContainer
-possibleInferiors: licensingSiteSettings
 schemaIDGUID: bf967ab3-0de6-11d0-a285-00aa003049e2
 
 dn: CN=Organization,CN=Schema,CN=Configuration,${BASEDN}
@@ -8192,28 +7831,14 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: msPKI-Key-Recovery-Agent
-possibleInferiors: rpcContainer
-possibleInferiors: device
-possibleInferiors: friendlyCountry
 possibleInferiors: computer
-possibleInferiors: organizationalRole
 possibleInferiors: user
 possibleInferiors: container
-possibleInferiors: rFC822LocalPart
-possibleInferiors: groupPolicyContainer
-possibleInferiors: inetOrgPerson
 possibleInferiors: domainDNS
-possibleInferiors: groupOfNames
-possibleInferiors: msTAPI-RtPerson
 possibleInferiors: locality
-possibleInferiors: physicalLocation
-possibleInferiors: msExchConfigurationContainer
 possibleInferiors: country
-possibleInferiors: nTFRSSettings
 possibleInferiors: organizationalUnit
 possibleInferiors: organizationalPerson
-possibleInferiors: contact
 schemaIDGUID: bf967aa3-0de6-11d0-a285-00aa003049e2
 
 dn: CN=ms-DS-Az-Admin-Manager,CN=Schema,CN=Configuration,${BASEDN}
@@ -8245,10 +7870,7 @@ defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCL
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
 possibleInferiors: group
 possibleInferiors: msDS-AzApplication
-possibleInferiors: rpcContainer
 possibleInferiors: container
-possibleInferiors: groupPolicyContainer
-possibleInferiors: msExchConfigurationContainer
 schemaIDGUID: cfee1051-5f28-4bae-a863-5d0cc18a8ed1
 
 dn: CN=Security-Principal,CN=Schema,CN=Configuration,${BASEDN}
@@ -8461,8 +8083,6 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPLCLORC;;;PS)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B2-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B3-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;RS)(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;RS)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;RS)(A;;RC;;;AU)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)(OA;;RP;77B5B886-944A-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;E45795B3-9455-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;RS)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;CA)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;WPRP;6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: nTFRSSubscriptions
-possibleInferiors: classStore
 schemaIDGUID: bf967aba-0de6-11d0-a285-00aa003049e2
 
 dn: CN=DMD,CN=Schema,CN=Configuration,${BASEDN}
@@ -8490,7 +8110,6 @@ systemOnly: TRUE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
 possibleInferiors: lostAndFound
-possibleInferiors: attributeSchema
 possibleInferiors: classSchema
 schemaIDGUID: bf967a8f-0de6-11d0-a285-00aa003049e2
 
@@ -8554,7 +8173,6 @@ defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCL
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
 possibleInferiors: subnetContainer
 possibleInferiors: site
-possibleInferiors: interSiteTransportContainer
 schemaIDGUID: 7a4117da-cd67-11d0-afff-0000f80367c1
 
 dn: CN=Server,CN=Schema,CN=Configuration,${BASEDN}
@@ -8580,16 +8198,7 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: applicationVersion
-possibleInferiors: rpcContainer
 possibleInferiors: container
-possibleInferiors: groupPolicyContainer
-possibleInferiors: msDS-AppData
-possibleInferiors: msDS-App-Configuration
-possibleInferiors: mSMQSettings
-possibleInferiors: msExchConfigurationContainer
-possibleInferiors: nTFRSSettings
-possibleInferiors: dSA
 schemaIDGUID: bf967a92-0de6-11d0-a285-00aa003049e2
 
 dn: CN=SubSchema,CN=Schema,CN=Configuration,${BASEDN}
@@ -8635,7 +8244,6 @@ defaultHidingValue: TRUE
 systemFlags: 16
 systemOnly: FALSE
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: rFC822LocalPart
 possibleInferiors: domainDNS
 schemaIDGUID: 19195a5a-6da0-11d0-afd3-00c04fd930c9
 
@@ -8680,10 +8288,7 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: rpcContainer
 possibleInferiors: container
-possibleInferiors: groupPolicyContainer
-possibleInferiors: msExchConfigurationContainer
 schemaIDGUID: b7b13124-b82e-11d0-afee-0000f80367c1
 
 dn: CN=Mail-Recipient,CN=Schema,CN=Configuration,${BASEDN}
@@ -8759,7 +8364,6 @@ systemFlags: 16
 systemOnly: FALSE
 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPLCLORC;;;PS)(OA;;CR;ab721a55-1e2f-11d0-9819-00aa0040529b;;AU)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)
 objectCategory: CN=Class-Schema,CN=Schema,CN=Configuration,${BASEDN}
-possibleInferiors: classStore
 schemaIDGUID: bf967a9c-0de6-11d0-a285-00aa003049e2
 
 dn: CN=Aggregate,CN=Schema,CN=Configuration,${BASEDN}
diff --git a/testprogs/ejs/minschema.js b/testprogs/ejs/minschema.js
index 9ad39827ac..c51caaca84 100755
--- a/testprogs/ejs/minschema.js
+++ b/testprogs/ejs/minschema.js
@@ -399,7 +399,80 @@ function walk_naming_context(ldb, namingContext) {
   trim the may attributes for an objectClass
 */
 function trim_objectclass_attributes(ldb, class) {
-	/* not implemented yet */
+	var i,j,n;
+
+	/* trim possibleInferiors,
+	 * include only the classes we extracted */
+	var possinf = class["possibleInferiors"];
+	if (possinf != undefined) {
+		var newpossinf = new Array();
+		if (typeof(possinf) == "string") {
+			possinf = new Array(possinf);
+		}
+		n = 0;
+		for (j = 0;j < possinf.length; j++) {
+			var x = possinf[j];
+			if (objectclasses[x] != undefined) {
+				newpossinf[n] = x;
+				n++;
+			}
+		}
+		class["possibleInferiors"] = newpossinf;
+	}
+
+	/* trim systemMayContain,
+	 * remove duplicates */
+	var sysmay = class["systemMayContain"];
+	if (sysmay != undefined) {
+		var newsysmay = new Array();
+		if (typeof(sysmay) == "string") {
+			sysmay = new Array(sysmay);
+		}
+		for (j = 0;j < sysmay.length; j++) {
+			var x = sysmay[j];
+			var dup = false;
+			if (newsysmay[0] == undefined) {
+				newsysmay[0] = x;
+			} else {
+				for (n = 0; n < newsysmay.length; n++) {
+					if (newsysmay[n] == x) {
+						dup = true;
+					}
+				}
+				if (dup == false) {
+					newsysmay[n] = x;
+				}
+			}
+		}
+		class["systemMayContain"] = newsysmay;
+	}
+
+	/* trim mayContain,
+	 * remove duplicates */
+	var may = class["mayContain"];
+	if (may != undefined) {
+		var newmay = new Array();
+		if (typeof(may) == "string") {
+			may = new Array(may);
+		}
+		for (j = 0;j < may.length; j++) {
+			var x = may[j];
+			var dup = false;
+			if (newmay[0] == undefined) {
+				newmay[0] = x;
+			} else {
+				for (n = 0; n < newmay.length; n++) {
+					if (newmay[n] == x) {
+						dup = true;
+					}
+				}
+				if (dup == false) {
+					newmay[n] = x;
+				}
+			}
+		}
+		class["mayContain"] = newmay;
+	}
 }
 
 /*
@@ -444,7 +517,6 @@ function list_append(a1, a2) {
 function attribute_list(class, attr1, attr2) {
 	var a1 = class[attr1];
 	var a2 = class[attr2];
-	var i;
 	if (typeof(a1) == "string") {
 		a1 = new Array(a1);
 	}
@@ -637,13 +709,6 @@ for (i in objectclasses) {
 }
 
 /*
-  trim the 'may' attribute lists to those really needed
-*/
-for (i in objectclasses) {
-	trim_objectclass_attributes(ldb, objectclasses[i]);
-}
-
-/*
   form the full list of attributes
 */
 for (i in objectclasses) {
@@ -656,6 +721,13 @@ for (i in attributes) {
 }
 
 /*
+  trim the 'may' attribute lists to those really needed
+*/
+for (i in objectclasses) {
+	trim_objectclass_attributes(ldb, objectclasses[i]);
+}
+
+/*
   dump an ldif form of the attributes and objectclasses
 */
 write_ldif(attributes, attrib_attrs);