Merge branch 'v4-0-trivial' into v4-0-python

(This used to be commit b874f07175ae38a041f53f0e4ac6a4050dcefeae)

164 files changed, 5219 insertions, 3182 deletions

diff --git a/.gitignore b/.gitignore
index 9ed0334ea1..a85553dc49 100644
--- a/.gitignore
+++ b/.gitignore
@@ -193,3 +193,5 @@ source/lib/util/apidocs
 source/lib/util/util_ldb.h
 source/libcli/ldap/ldap_ndr.h
 source/libcli/resolve/lp_proto.h
+source/apidocs
+*.swp
diff --git a/PFIF.txt b/PFIF.txt
new file mode 100644
index 0000000000..09f1458e44
--- /dev/null
+++ b/PFIF.txt
@@ -0,0 +1,7 @@
+This code was developed in participation with the Protocol Freedom
+Information Foundation.
+
+Please see 
+  http://protocolfreedom.org/ and
+  http://samba.org/samba/PFIF/ 
+for more details.
diff --git a/source4/auth/auth_sam_reply.c b/source4/auth/auth_sam_reply.c
index 6ab220498d..ea6f0a1f60 100644
--- a/source4/auth/auth_sam_reply.c
+++ b/source4/auth/auth_sam_reply.c
@@ -132,7 +132,7 @@ NTSTATUS auth_convert_server_info_saminfo3(TALLOC_CTX *mem_ctx,
 			continue;
 		}
 		sam3->sids[sam3->sidcount].sid = talloc_reference(sam3->sids,server_info->domain_groups[i]);
-		sam3->sids[sam3->sidcount].attribute = 
+		sam3->sids[sam3->sidcount].attributes =
 			SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED;
 		sam3->sidcount += 1;
 	}
diff --git a/source4/auth/credentials/config.mk b/source4/auth/credentials/config.mk
index 8d33bdbd55..fee9519ae5 100644
--- a/source4/auth/credentials/config.mk
+++ b/source4/auth/credentials/config.mk
@@ -14,5 +14,5 @@ PRIVATE_DEPENDENCIES = \
 		SECRETS
 
 [PYTHON::swig_credentials]
-PUBLIC_DEPENDENCIES = CREDENTIALS
+PUBLIC_DEPENDENCIES = CREDENTIALS LIBCMDLINE_CREDENTIALS
 SWIG_FILE = credentials.i
diff --git a/source4/auth/credentials/credentials.i b/source4/auth/credentials/credentials.i
index ee09b43a75..41ec67580e 100644
--- a/source4/auth/credentials/credentials.i
+++ b/source4/auth/credentials/credentials.i
@@ -27,6 +27,7 @@
 #include "includes.h"
 #include "auth/credentials/credentials.h"
 #include "param/param.h"
+#include "lib/cmdline/credentials.h"
 typedef struct cli_credentials cli_credentials;
 %}
 
@@ -51,7 +52,7 @@ typedef struct cli_credentials cli_credentials;
 typedef struct cli_credentials {
     %extend {
         cli_credentials(void) {
-            return cli_credentials_init(NULL);
+            return cli_credentials_init_anon(NULL);
         }
         /* username */
         const char *get_username(void);
@@ -93,6 +94,8 @@ typedef struct cli_credentials {
         bool authentication_requested(void);
 
         bool wrong_password(void);
+
+        bool set_cmdline_callbacks();
     }
 } cli_credentials;
 
diff --git a/source4/auth/credentials/credentials.py b/source4/auth/credentials/credentials.py
index 0d91526b8f..14526af910 100644
--- a/source4/auth/credentials/credentials.py
+++ b/source4/auth/credentials/credentials.py
@@ -82,6 +82,7 @@ Credentials.is_anonymous = new_instancemethod(_credentials.Credentials_is_anonym
 Credentials.get_nt_hash = new_instancemethod(_credentials.Credentials_get_nt_hash,None,Credentials)
 Credentials.authentication_requested = new_instancemethod(_credentials.Credentials_authentication_requested,None,Credentials)
 Credentials.wrong_password = new_instancemethod(_credentials.Credentials_wrong_password,None,Credentials)
+Credentials.set_cmdline_callbacks = new_instancemethod(_credentials.Credentials_set_cmdline_callbacks,None,Credentials)
 Credentials_swigregister = _credentials.Credentials_swigregister
 Credentials_swigregister(Credentials)
 
diff --git a/source4/auth/credentials/credentials_wrap.c b/source4/auth/credentials/credentials_wrap.c
index 146a81abaf..b1b904c8a3 100644
--- a/source4/auth/credentials/credentials_wrap.c
+++ b/source4/auth/credentials/credentials_wrap.c
@@ -2521,13 +2521,14 @@ static swig_module_info swig_module = {swig_types, 16, 0, 0, 0, 0};
 #include "includes.h"
 #include "auth/credentials/credentials.h"
 #include "param/param.h"
+#include "lib/cmdline/credentials.h"
 typedef struct cli_credentials cli_credentials;
 
 
 #include "librpc/gen_ndr/samr.h" /* for struct samr_Password */
 
 SWIGINTERN cli_credentials *new_cli_credentials(){
-            return cli_credentials_init(NULL);
+            return cli_credentials_init_anon(NULL);
         }
 
 SWIGINTERN swig_type_info*
@@ -3486,6 +3487,34 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_Credentials_set_cmdline_callbacks(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  cli_credentials *arg1 = (cli_credentials *) 0 ;
+  bool result;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  PyObject * obj0 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self", NULL 
+  };
+  
+  arg1 = NULL;
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|O:Credentials_set_cmdline_callbacks",kwnames,&obj0)) SWIG_fail;
+  if (obj0) {
+    res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_cli_credentials, 0 |  0 );
+    if (!SWIG_IsOK(res1)) {
+      SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Credentials_set_cmdline_callbacks" "', argument " "1"" of type '" "cli_credentials *""'"); 
+    }
+    arg1 = (cli_credentials *)(argp1);
+  }
+  result = (bool)cli_credentials_set_cmdline_callbacks(arg1);
+  resultobj = SWIG_From_bool((bool)(result));
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_delete_Credentials(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   cli_credentials *arg1 = (cli_credentials *) 0 ;
@@ -3545,6 +3574,7 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"Credentials_get_nt_hash", (PyCFunction) _wrap_Credentials_get_nt_hash, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_authentication_requested", (PyCFunction) _wrap_Credentials_authentication_requested, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_wrong_password", (PyCFunction) _wrap_Credentials_wrong_password, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"Credentials_set_cmdline_callbacks", (PyCFunction) _wrap_Credentials_set_cmdline_callbacks, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"delete_Credentials", (PyCFunction) _wrap_delete_Credentials, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Credentials_swigregister", Credentials_swigregister, METH_VARARGS, NULL},
 	 { (char *)"Credentials_swiginit", Credentials_swiginit, METH_VARARGS, NULL},
diff --git a/source4/auth/credentials/tests/bindings.py b/source4/auth/credentials/tests/bindings.py
index 8312e77e9e..d2ca68d115 100644
--- a/source4/auth/credentials/tests/bindings.py
+++ b/source4/auth/credentials/tests/bindings.py
@@ -83,6 +83,9 @@ class CredentialsTests(unittest.TestCase):
         # Just check the method is there and doesn't raise an exception
         self.creds.guess()
 
+    def test_set_cmdline_callbacks(self):
+        self.creds.set_cmdline_callbacks()
+
     def test_authentication_requested(self):
         self.creds.set_username("")
         self.assertFalse(self.creds.authentication_requested())
diff --git a/source4/auth/gensec/config.mk b/source4/auth/gensec/config.mk
index fea157c40b..a53dff8bfe 100644
--- a/source4/auth/gensec/config.mk
+++ b/source4/auth/gensec/config.mk
@@ -1,9 +1,9 @@
 #################################
 # Start SUBSYSTEM gensec
 [LIBRARY::gensec]
+PC_FILE = gensec.pc
 VERSION = 0.0.1
 SO_VERSION = 0
-DESCRIPTION = Generic Security Library
 PUBLIC_HEADERS = gensec.h spnego.h
 PUBLIC_PROTO_HEADER = gensec_proto.h
 OBJ_FILES = gensec.o socket.o
diff --git a/source4/auth/gensec/gensec.pc.in b/source4/auth/gensec/gensec.pc.in
new file mode 100644
index 0000000000..faf772ae73
--- /dev/null
+++ b/source4/auth/gensec/gensec.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+modulesdir=${prefix}/modules/gensec
+
+Name: gensec
+Description: Generic Security Library
+Version: 0.0.1
+Libs: -L${libdir} -lgensec 
+Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/build/m4/check_make.m4 b/source4/build/m4/check_make.m4
index 4780f43e1c..d7799649a7 100644
--- a/source4/build/m4/check_make.m4
+++ b/source4/build/m4/check_make.m4
@@ -46,3 +46,11 @@ AC_ARG_ENABLE(automatic-dependencies,
 [ automatic_dependencies=no ])
 AC_MSG_RESULT($automatic_dependencies)
 AC_SUBST(automatic_dependencies)
+
+FIRST_PREREQ="\$*.c"
+AC_SUBST(FIRST_PREREQ)
+
+if test x$GNU_MAKE = xyes; then
+	FIRST_PREREQ="\$<"
+fi
+
diff --git a/source4/build/m4/public.m4 b/source4/build/m4/public.m4
index 6d693eaeee..4192128bbd 100644
--- a/source4/build/m4/public.m4
+++ b/source4/build/m4/public.m4
@@ -34,21 +34,20 @@ ENABLE = YES
 "
 ])
 
-dnl SMB_LIBRARY(name,description,obj_files,required_subsystems,version,so_version,cflags,ldflags,pcname)
+dnl SMB_LIBRARY(name,obj_files,required_subsystems,version,so_version,cflags,ldflags,pcname)
 AC_DEFUN([SMB_LIBRARY],
 [
 SMB_INFO_LIBRARIES="$SMB_INFO_LIBRARIES
 ###################################
 # Start Library $1
 @<:@LIBRARY::$1@:>@
-DESCRIPTION = $2
-OBJ_FILES = $3
-PRIVATE_DEPENDENCIES = $4
-VERSION = $5
-SO_VERSION = $6 
-CFLAGS = $7
-LDFLAGS = $8
-PC_NAME = $9
+OBJ_FILES = $2
+PRIVATE_DEPENDENCIES = $3
+VERSION = $4
+SO_VERSION = $5 
+CFLAGS = $6
+LDFLAGS = $7
+PC_NAME = $8
 ENABLE = YES
 # End Library $1
 ###################################
@@ -65,30 +64,28 @@ AC_DEFUN([SMB_EXT_LIB_FROM_PKGCONFIG],
 	fi
 
 	if test "$PKG_CONFIG" = "no" ; then
-    		echo "*** The pkg-config script could not be found. Make sure it is"
-    		echo "*** in your path, or set the PKG_CONFIG environment variable"
-    		echo "*** to the full path to pkg-config."
-    		echo "*** Or see http://pkg-config.freedesktop.org/ to get pkg-config."
+		echo "*** The pkg-config script could not be found. Make sure it is"
+		echo "*** in your path, or set the PKG_CONFIG environment variable"
+		echo "*** to the full path to pkg-config."
+		echo "*** Or see http://pkg-config.freedesktop.org/ to get pkg-config."
 			ac_cv_$1_found=no
 	else
 		if $PKG_CONFIG --atleast-pkgconfig-version 0.9.0; then
-        		AC_MSG_CHECKING(for $2)
+			AC_MSG_CHECKING(for $2)
 
-          		if $PKG_CONFIG --exists '$2' ; then
+			if $PKG_CONFIG --exists '$2' ; then
 				AC_MSG_RESULT(yes)
 
-
 				$1_CFLAGS="`$PKG_CONFIG --cflags '$2'`"
-    			OLD_CFLAGS="$CFLAGS"
-	    		CFLAGS="$CFLAGS $$1_CFLAGS"
-		    	AC_MSG_CHECKING([that the C compiler can use the $1_CFLAGS])
-    			AC_TRY_RUN([#include "${srcdir-.}/build/tests/trivial.c"],
+				OLD_CFLAGS="$CFLAGS"
+				CFLAGS="$CFLAGS $$1_CFLAGS"
+				AC_MSG_CHECKING([that the C compiler can use the $1_CFLAGS])
+				AC_TRY_RUN([#include "${srcdir-.}/build/tests/trivial.c"],
 					SMB_ENABLE($1, YES)
-			    	AC_MSG_RESULT(yes),
+					AC_MSG_RESULT(yes),
 					AC_MSG_RESULT(no),
 					AC_MSG_WARN([cannot run when cross-compiling]))
-    			CFLAGS="$OLD_CFLAGS"
-
+				CFLAGS="$OLD_CFLAGS"
 
 				SMB_EXT_LIB($1, 
 					[`$PKG_CONFIG --libs-only-l '$2'`], 
@@ -98,17 +95,17 @@ AC_DEFUN([SMB_EXT_LIB_FROM_PKGCONFIG],
 					[ $2 ])
 				ac_cv_$1_found=yes
 
-        		else
+			else
 				AC_MSG_RESULT(no)
-            			$PKG_CONFIG --errors-to-stdout --print-errors '$2'
+				$PKG_CONFIG --errors-to-stdout --print-errors '$2'
 				ac_cv_$1_found=no
-        		fi
-     		else
-        		echo "*** Your version of pkg-config is too old. You need version $PKG_CONFIG_MIN_VERSION or newer."
-        			echo "*** See http://pkg-config.freedesktop.org/"
-				ac_cv_$1_found=no
-     		fi
-  	fi
+			fi
+		else
+			echo "*** Your version of pkg-config is too old. You need version $PKG_CONFIG_MIN_VERSION or newer."
+			echo "*** See http://pkg-config.freedesktop.org/"
+			ac_cv_$1_found=no
+		fi
+	fi
 	if test x$ac_cv_$1_found = x"yes"; then
 		ifelse([$3], [], [echo -n ""], [$3])
 	else
diff --git a/source4/build/smb_build/config_mk.pm b/source4/build/smb_build/config_mk.pm
index d07660ba1d..b7dc9697a9 100644
--- a/source4/build/smb_build/config_mk.pm
+++ b/source4/build/smb_build/config_mk.pm
@@ -91,6 +91,7 @@ my $section_types = {
 		"LIBRARY_REALNAME" => "string",
 
 		"PC_NAME" => "string",
+		"PC_FILE" => "string",
 		
 		"INIT_FUNCTION_TYPE"	=> "string",
 		"INIT_FUNCTION_SENTINEL" => "string",
@@ -98,8 +99,6 @@ my $section_types = {
 
 		"OBJ_FILES"		=> "list",
 
-		"DESCRIPTION"		=> "string",
-
 		"PRIVATE_DEPENDENCIES"	=> "list",
 		"PUBLIC_DEPENDENCIES"	=> "list",
 
@@ -252,6 +251,8 @@ sub run_config_mk($$$$)
 			next;
 		}
 
+		$line =~ s/^mkinclude /include /;
+
 		# empty line
 		if ($line =~ /^[ \t]*$/) {
 			$section = "GLOBAL";
diff --git a/source4/build/smb_build/env.pm b/source4/build/smb_build/env.pm
index 8fbbe9cfd5..76cd8d1a26 100644
--- a/source4/build/smb_build/env.pm
+++ b/source4/build/smb_build/env.pm
@@ -54,64 +54,4 @@ sub _set_config($$)
 	$self->{automatic_deps} = ($self->{config}->{automatic_dependencies} eq "yes");
 }
 
-sub PkgConfig($$$$$$$$$$$$)
-{
-	my ($self,$path,$name,$libs,$privlibs,$cflags,$version,$desc,$hasmodules,$pubdep,$privdep,$dirs) = @_;
-
-	print __FILE__.": creating $path\n";
-
-	if ($self->{config}->{libreplace_cv_immediate_structures} eq "yes") {
-		$cflags .= " -DHAVE_IMMEDIATE_STRUCTURES=1";
-	}
-
-	mkpath(dirname($path),0,0755);
-	open(OUT, ">$path") or die("Can't open $path: $!");
-
-	foreach (@$dirs) {
-		print OUT "$_\n";
-	}
-	if ($hasmodules) {
-		print OUT "modulesdir=$self->{config}->{modulesdir}/$name\n" ;
-	}
-
-	print OUT "\n";
-
-	print OUT "Name: $name\n";
-	if (defined($desc)) {
-		print OUT "Description: $desc\n";
-	}
-	print OUT "Requires: $pubdep\n" if defined($pubdep);
-	print OUT "Requires.private: $privdep\n" if defined($privdep);
-	print OUT "Version: $version\n";
-	print OUT "Libs: $libs\n";
-	print OUT "Libs.private: $privlibs\n" if (defined($privlibs));
-	print OUT "Cflags: -I\${includedir} $cflags\n";
-
-	close(OUT);
-}
-
-sub Import($$)
-{
-	my ($self,$items) = @_;
-
-	foreach (keys %$items) {
-		if (defined($self->{items})) {
-			print "Warning: Importing $_ twice!\n";
-		}
-		$self->{items}->{$_} = $items->{$_};
-	}
-}
-
-sub GetInfo($$)
-{
-	my ($self,$name) = @_;
-
-	unless (defined($self->{info}->{$name})) 
-	{
-		$self->{info}->{$name} = $self->{items}->Build($self);
-	}
-
-	return $self->{info}->{$name};
-}
-
 1;
diff --git a/source4/build/smb_build/main.pl b/source4/build/smb_build/main.pl
index e084d48a77..fb769103d0 100644
--- a/source4/build/smb_build/main.pl
+++ b/source4/build/smb_build/main.pl
@@ -60,8 +60,9 @@ foreach my $key (values %$OUTPUT) {
 	next unless defined $key->{OUTPUT_TYPE};
 
 	$mkenv->StaticLibrary($key) if grep(/STATIC_LIBRARY/, @{$key->{OUTPUT_TYPE}});
-	$mkenv->PkgConfig($key, $OUTPUT) if $key->{TYPE} eq "LIBRARY" 
-		                    and defined($key->{VERSION});
+	if (defined($key->{PC_FILE})) {
+		push(@{$mkenv->{pc_files}}, "$key->{BASEDIR}/$key->{PC_FILE}");
+	} 
 	$mkenv->SharedLibrary($key) if ($key->{TYPE} eq "LIBRARY") and
 					grep(/SHARED_LIBRARY/, @{$key->{OUTPUT_TYPE}});
 	if ($key->{TYPE} eq "LIBRARY" and 
diff --git a/source4/build/smb_build/makefile.pm b/source4/build/smb_build/makefile.pm
index 7e715b47eb..5799d89c57 100644
--- a/source4/build/smb_build/makefile.pm
+++ b/source4/build/smb_build/makefile.pm
@@ -111,53 +111,9 @@ __EOD__
 sub _prepare_suffix_rules($)
 {
 	my ($self) = @_;
-	my $first_prereq = '$*.c';
-
-	if ($self->{config}->{GNU_MAKE} eq 'yes') {
-		$first_prereq = '$<';
-	}
 
 	$self->output(<< "__EOD__"
-FIRST_PREREQ = $first_prereq
-
-# Dependencies command
-DEPENDS = \$(CC) -M -MG -MP -MT \$(<:.c=.o) -MT \$@ \\
-    \$(CFLAGS) `\$(PERL) \$(srcdir)/script/cflags.pl \$@` \\
-    \$(CPPFLAGS) \$(FIRST_PREREQ) -o \$@
-# Dependencies for host objects
-HDEPENDS = \$(CC) -M -MG -MP -MT \$(<:.c=.ho) -MT \$@ \\
-    \$(HOSTCC_FLAGS) `\$(PERL) \$(srcdir)/script/cflags.pl \$@` \\
-    \$(CPPFLAGS) \$(FIRST_PREREQ) -o \$@
-# Dependencies for precompiled headers
-PCHDEPENDS = \$(CC) -M -MG -MT include/includes.h.gch -MT \$@ \\
-    \$(CFLAGS) \$(CPPFLAGS) \$(FIRST_PREREQ) -o \$@
-
-# \$< is broken in older BSD versions:
-# when \$@ is foo/bar.o, \$< could be torture/foo/bar.c
-# if it also exists. So better use \$* which is foo/bar
-# and append .c manually to get foo/bar.c
-#
-# If we have GNU Make, it is safe to use \$<, which also lets
-# building with \$srcdir != \$builddir work.
-
-# Run a static analysis checker
-CHECK = \$(CC_CHECKER) \$(CFLAGS) `\$(PERL) \$(srcdir)/script/cflags.pl \$@` \\
-    \$(PICFLAG) \$(CPPLAGS) -c \$(FIRST_PREREQ) -o \$@
-
-# Run the configured compiler
-COMPILE = \$(CC) \$(CFLAGS)  \$(PICFLAG) \\
-          `\$(PERL) \$(srcdir)/script/cflags.pl \$@` \\
-		  \$(CPPFLAGS) \\
-		  -c \$(FIRST_PREREQ) -o \$@
-
-# Run the compiler for the build host
-HCOMPILE = \$(HOSTCC) \$(HOSTCC_FLAGS) `\$(PERL) \$(srcdir)/script/cflags.pl \$@` \\
-	 \$(CPPFLAGS) -c \$(FIRST_PREREQ) -o \$@
-
-# Precompile headers
-PCHCOMPILE = @\$(CC) -Ilib/replace \\
-    \$(CFLAGS) `\$(PERL) \$(srcdir)/script/cflags.pl \$@` \\
-    \$(PICFLAG) \$(CPPFLAGS) -c \$(FIRST_PREREQ) -o \$@
+FIRST_PREREQ = $self->{config}->{FIRST_PREREQ}
 
 __EOD__
 );
@@ -500,7 +456,6 @@ sub Binary($$)
 		push (@{$self->{torture_progs}}, "$installdir/$ctx->{BINARY}");
 	}
 
-
 	push (@{$self->{binaries}}, "$localdir/$ctx->{BINARY}");
 
 	$self->_prepare_list($ctx, "OBJ_LIST");
@@ -552,115 +507,6 @@ sub Manpage($$)
 	push (@{$self->{manpages}}, $path);
 }
 
-sub PkgConfig($$$)
-{
-	my ($self,$ctx,$other) = @_;
-	
-	my $link_name = $ctx->{NAME};
-
-	$link_name =~ s/^LIB//g;
-	$link_name = lc($link_name);
-
-	return if (not defined($ctx->{DESCRIPTION}));
-
-	my $path = output::add_dir_str($ctx->{BASEDIR}, "$link_name.pc");
-
-	push (@{$self->{pc_files}}, $path);
-
-	my $pubs;
-	my $privs;
-	my $privlibs;
-	my $publibs = "";
-
-	if (defined($ctx->{PUBLIC_DEPENDENCIES})) {
-		foreach (@{$ctx->{PUBLIC_DEPENDENCIES}}) {
-			next if ($other->{$_}->{ENABLE} eq "NO");
-			if (defined($other->{$_}->{PC_NAME})) {
-				$pubs .= "$other->{$_}->{PC_NAME} ";
-			} elsif ($other->{$_}->{TYPE} eq "EXT_LIB") {
-				my $e = $other->{$_};
-				my $ldflags = join(" ", @{$e->{LDFLAGS}});
-				$ldflags .= " " unless $ldflags eq "";
-				my $libs = join(" ", @{$e->{LIBS}});
-				$libs .= " " unless $libs eq "";
-
-				$publibs .= $ldflags.$libs;
-			} else {
-				s/^LIB//g;
-				$_ = lc($_);
-
-				$privlibs .= "-l$_ ";
-			}
-		}
-	}
-
-	if (defined($ctx->{PRIVATE_DEPENDENCIES})) {
-		foreach (@{$ctx->{PRIVATE_DEPENDENCIES}}) {
-			next if ($other->{$_}->{ENABLE} eq "NO");
-			if ($other->{$_}->{TYPE} eq "EXT_LIB") {
-				my $e = $other->{$_};
-
-				my $ldflags = join(" ", @{$e->{LDFLAGS}});
-				$ldflags .= " " unless $ldflags eq "";
-				my $libs = join(" ", @{$e->{LIBS}});
-				$libs .= " " unless $libs eq "";
-
-				$privlibs .= $ldflags.$libs;
-			} elsif ($other->{$_}->{TYPE} eq "LIBRARY") {
-				s/^LIB//g;
-				$_ = lc($_);
-
-				$privs .= "$_ ";
-			} else {
-				s/^LIB//g;
-				$_ = lc($_);
-
-				$privlibs .= "-l$_ ";
-			}
-		}
-	}
-
-	smb_build::env::PkgConfig($self,
-		$path,
-		$link_name,
-		"-L\${libdir} -l$link_name $publibs",
-		$privlibs,
-		"",
-		"$ctx->{VERSION}",
-		$ctx->{DESCRIPTION},
-		defined($ctx->{INIT_FUNCTIONS}),
-		$pubs,
-		"",
-		[
-			"prefix=$self->{config}->{prefix}",
-			"exec_prefix=$self->{config}->{exec_prefix}",
-			"libdir=$self->{config}->{libdir}",
-			"includedir=$self->{config}->{includedir}"
-		]
-	); 
-	my $abs_srcdir = abs_path($self->{config}->{srcdir});
-	smb_build::env::PkgConfig($self,
-		"bin/pkgconfig/$link_name-uninstalled.pc",
-		$link_name,
-		"-Lbin/shared -Lbin/static -l$link_name",
-		$privlibs,
-		join(' ', 
-			"-I$abs_srcdir",
-			"-I$abs_srcdir/include",
-			"-I$abs_srcdir/lib",
-			"-I$abs_srcdir/lib/replace"),
-		"$ctx->{VERSION}",
-		$ctx->{DESCRIPTION},
-		defined($ctx->{INIT_FUNCTIONS}),
-		$pubs,
-		$privs,
-		[
-			"prefix=bin/",
-			"includedir=$ctx->{BASEDIR}"
-		]
-	); 
-}
-
 sub ProtoHeader($$)
 {
 	my ($self,$ctx) = @_;
diff --git a/source4/cldap_server/cldap_server.c b/source4/cldap_server/cldap_server.c
index d68637104d..7858ee2cf0 100644
--- a/source4/cldap_server/cldap_server.c
+++ b/source4/cldap_server/cldap_server.c
@@ -205,18 +205,9 @@ static void cldapd_task_init(struct task_server *task)
 
 
 /*
-  initialise the cldapd server
- */
-static NTSTATUS cldapd_init(struct event_context *event_ctx, struct loadparm_context *lp_ctx, const struct model_ops *model_ops)
-{
-	return task_server_startup(event_ctx, lp_ctx, model_ops, cldapd_task_init);
-}
-
-
-/*
   register ourselves as a available server
 */
 NTSTATUS server_service_cldapd_init(void)
 {
-	return register_server_service("cldap", cldapd_init);
+	return register_server_service("cldap", cldapd_task_init);
 }
diff --git a/source4/cluster/cluster.c b/source4/cluster/cluster.c
index 6bac1dcbe5..cc61974cbd 100644
--- a/source4/cluster/cluster.c
+++ b/source4/cluster/cluster.c
@@ -47,12 +47,12 @@ static void cluster_init(void)
 }
 
 /*
-  server a server_id for the local node
+  create a server_id for the local node
 */
-struct server_id cluster_id(uint32_t id)
+struct server_id cluster_id(uint64_t id, uint32_t id2)
 {
 	cluster_init();
-	return ops->cluster_id(ops, id);
+	return ops->cluster_id(ops, id, id2);
 }
 
 
diff --git a/source4/cluster/cluster.h b/source4/cluster/cluster.h
index 7cd31282cc..7545757f2c 100644
--- a/source4/cluster/cluster.h
+++ b/source4/cluster/cluster.h
@@ -25,7 +25,9 @@
 /*
   test for same cluster id
 */
-#define cluster_id_equal(id1, id2) ((id1)->id == (id2)->id && (id1)->node == (id2)->node)
+#define cluster_id_equal(id_1, id_2) ((id_1)->id == (id_2)->id \
+				    && (id_1)->id2 == (id_2)->id2 \
+				    && (id_1)->node == (id_2)->node)
 
 /*
   test for same cluster node
@@ -36,7 +38,7 @@ struct messaging_context;
 typedef void (*cluster_message_fn_t)(struct messaging_context *, DATA_BLOB);
 
 /* prototypes */
-struct server_id cluster_id(uint32_t id);
+struct server_id cluster_id(uint64_t id, uint32_t id2);
 const char *cluster_id_string(TALLOC_CTX *mem_ctx, struct server_id id);
 struct tdb_wrap *cluster_tdb_tmp_open(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, const char *dbname, int flags);
 void *cluster_backend_handle(void);
diff --git a/source4/cluster/cluster_private.h b/source4/cluster/cluster_private.h
index 1c895b8640..79394b46db 100644
--- a/source4/cluster/cluster_private.h
+++ b/source4/cluster/cluster_private.h
@@ -23,7 +23,7 @@
 #define _CLUSTER_PRIVATE_H_
 
 struct cluster_ops {
-	struct server_id (*cluster_id)(struct cluster_ops *ops, uint32_t id);
+	struct server_id (*cluster_id)(struct cluster_ops *ops, uint64_t id, uint32_t id2);
 	const char *(*cluster_id_string)(struct cluster_ops *ops, 
 					 TALLOC_CTX *, struct server_id );
 	struct tdb_wrap *(*cluster_tdb_tmp_open)(struct cluster_ops *,
diff --git a/source4/cluster/ctdb/ctdb_cluster.c b/source4/cluster/ctdb/ctdb_cluster.c
index 53df1e968e..ce295c4474 100644
--- a/source4/cluster/ctdb/ctdb_cluster.c
+++ b/source4/cluster/ctdb/ctdb_cluster.c
@@ -52,13 +52,14 @@ struct cluster_state {
 /*
   return a server_id for a ctdb node
 */
-static struct server_id ctdb_id(struct cluster_ops *ops, uint32_t id)
+static struct server_id ctdb_id(struct cluster_ops *ops, uint64_t id, uint32_t id2)
 {
 	struct cluster_state *state = (struct cluster_state *)ops->private;
 	struct ctdb_context *ctdb = state->ctdb;
 	struct server_id server_id;
 	server_id.node = ctdb_get_vnn(ctdb);
 	server_id.id = id;
+	server_id.id2 = id2;
 	return server_id;
 }
 
@@ -69,7 +70,7 @@ static struct server_id ctdb_id(struct cluster_ops *ops, uint32_t id)
 static const char *ctdb_id_string(struct cluster_ops *ops, 
 				  TALLOC_CTX *mem_ctx, struct server_id id)
 {
-	return talloc_asprintf(mem_ctx, "%u.%u", id.node, id.id);
+	return talloc_asprintf(mem_ctx, "%u.%llu.%u", id.node, (unsigned long long)id.id, id.id2);
 }
 
 /*
diff --git a/source4/cluster/local.c b/source4/cluster/local.c
index 539e47d271..96636927f1 100644
--- a/source4/cluster/local.c
+++ b/source4/cluster/local.c
@@ -31,11 +31,12 @@
 /*
   server a server_id for the local node
 */
-static struct server_id local_id(struct cluster_ops *ops, uint32_t id)
+static struct server_id local_id(struct cluster_ops *ops, uint64_t id, uint32_t id2)
 {
 	struct server_id server_id;
 	ZERO_STRUCT(server_id);
 	server_id.id = id;
+	server_id.id2 = id2;
 	return server_id;
 }
 
@@ -46,7 +47,7 @@ static struct server_id local_id(struct cluster_ops *ops, uint32_t id)
 static const char *local_id_string(struct cluster_ops *ops,
 				   TALLOC_CTX *mem_ctx, struct server_id id)
 {
-	return talloc_asprintf(mem_ctx, "%u.%u", id.node, id.id);
+	return talloc_asprintf(mem_ctx, "%u.%llu.%u", id.node, (unsigned long long)id.id, id.id2);
 }
 
 
diff --git a/source4/configure.ac b/source4/configure.ac
index 164a21e823..ed74bc1251 100644
--- a/source4/configure.ac
+++ b/source4/configure.ac
@@ -27,11 +27,20 @@ m4_include(lib/charset/config.m4)
 m4_include(lib/socket/config.m4)
 m4_include(nsswitch/nsstest.m4)
 
+AC_CONFIG_FILES(lib/registry/registry.pc)
+AC_CONFIG_FILES(librpc/dcerpc.pc)
+AC_CONFIG_FILES(librpc/ndr.pc)
+AC_CONFIG_FILES(torture/torture.pc)
+AC_CONFIG_FILES(auth/gensec/gensec.pc)
+AC_CONFIG_FILES(param/samba-config.pc)
+AC_CONFIG_FILES(librpc/dcerpc_samr.pc)
+
 SMB_EXT_LIB_FROM_PKGCONFIG(LIBTALLOC, talloc >= 1.1.0,
 	[],
 	[
 		m4_include(lib/talloc/libtalloc.m4)
 		SMB_INCLUDE_MK(lib/talloc/config.mk)
+		AC_CONFIG_FILES(lib/talloc/talloc.pc)
 	]
 )
 
@@ -40,6 +49,7 @@ SMB_EXT_LIB_FROM_PKGCONFIG(LIBTDB, tdb >= 1.1.0,
 	[
 		m4_include(lib/tdb/libtdb.m4)
 		SMB_INCLUDE_MK(lib/tdb/config.mk)
+		AC_CONFIG_FILES(lib/tdb/tdb.pc)
 	]
 )
 
@@ -73,6 +83,7 @@ SMB_EXT_LIB_FROM_PKGCONFIG(LIBLDB, ldb >= 0.9.1,
 		m4_include(lib/ldb/sqlite3.m4)
 		m4_include(lib/ldb/libldb.m4)
 		SMB_INCLUDE_MK(lib/ldb/config.mk)
+		AC_CONFIG_FILES(lib/ldb/ldb.pc)
 	]
 )
 SMB_INCLUDE_MK(lib/ldb/python.mk) 
diff --git a/source4/dsdb/common/sidmap.c b/source4/dsdb/common/sidmap.c
index 5c170463bb..088dc6bd96 100644
--- a/source4/dsdb/common/sidmap.c
+++ b/source4/dsdb/common/sidmap.c
@@ -123,10 +123,10 @@ static NTSTATUS sidmap_primary_domain_sid(struct sidmap_context *sidmap,
 /*
   map a sid to a unix uid
 */
-_PUBLIC_ NTSTATUS sidmap_sid_to_unixuid(struct sidmap_context *sidmap, 
-					struct dom_sid *sid, uid_t *uid)
+_PUBLIC_ NTSTATUS sidmap_sid_to_unixuid(struct sidmap_context *sidmap,
+					const struct dom_sid *sid, uid_t *uid)
 {
-	const char *attrs[] = { "sAMAccountName", "uidNumber", 
+	const char *attrs[] = { "sAMAccountName", "uidNumber",
 				"sAMAccountType", "unixName", NULL };
 	int ret;
 	const char *s;
@@ -137,15 +137,17 @@ _PUBLIC_ NTSTATUS sidmap_sid_to_unixuid(struct sidmap_context *sidmap,
 
 	tmp_ctx = talloc_new(sidmap);
 
-	ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, 
-			   "objectSid=%s", ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs,
+			   "objectSid=%s",
+			   ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+
 	if (ret != 1) {
 		goto allocated_sid;
 	}
 
 	/* make sure its a user, not a group */
 	if (!is_user_account(res[0])) {
-		DEBUG(0,("sid_to_unixuid: sid %s is not an account!\n", 
+		DEBUG(0,("sid_to_unixuid: sid %s is not an account!\n",
 			 dom_sid_string(tmp_ctx, sid)));
 		talloc_free(tmp_ctx);
 		return NT_STATUS_INVALID_SID;
@@ -261,9 +263,9 @@ _PUBLIC_ bool sidmap_sid_is_group(struct sidmap_context *sidmap, struct dom_sid
   map a sid to a unix gid
 */
 _PUBLIC_ NTSTATUS sidmap_sid_to_unixgid(struct sidmap_context *sidmap,
-					struct dom_sid *sid, gid_t *gid)
+					const struct dom_sid *sid, gid_t *gid)
 {
-	const char *attrs[] = { "sAMAccountName", "gidNumber", 
+	const char *attrs[] = { "sAMAccountName", "gidNumber",
 				"unixName", "sAMAccountType", NULL };
 	int ret;
 	const char *s;
@@ -355,7 +357,7 @@ allocated_sid:
 */
 _PUBLIC_ NTSTATUS sidmap_uid_to_sid(struct sidmap_context *sidmap,
 				    TALLOC_CTX *mem_ctx,
-				    uid_t uid, struct dom_sid **sid)
+				    const uid_t uid, struct dom_sid **sid)
 {
 	const char *attrs[] = { "sAMAccountName", "objectSid", "sAMAccountType", NULL };
 	int ret, i;
@@ -453,7 +455,7 @@ allocate_sid:
 */
 _PUBLIC_ NTSTATUS sidmap_gid_to_sid(struct sidmap_context *sidmap,
 				    TALLOC_CTX *mem_ctx,
-				    gid_t gid, struct dom_sid **sid)
+				    const gid_t gid, struct dom_sid **sid)
 {
 	const char *attrs[] = { "sAMAccountName", "objectSid", "sAMAccountType", NULL };
 	int ret, i;
diff --git a/source4/dsdb/repl/drepl_service.c b/source4/dsdb/repl/drepl_service.c
index e212407e24..3375059e99 100644
--- a/source4/dsdb/repl/drepl_service.c
+++ b/source4/dsdb/repl/drepl_service.c
@@ -181,17 +181,9 @@ static void dreplsrv_task_init(struct task_server *task)
 }
 
 /*
-  initialise the dsdb replicator service
- */
-static NTSTATUS dreplsrv_init(struct event_context *event_ctx, struct loadparm_context *lp_ctx, const struct model_ops *model_ops)
-{
-	return task_server_startup(event_ctx, lp_ctx, model_ops, dreplsrv_task_init);
-}
-
-/*
   register ourselves as a available server
 */
 NTSTATUS server_service_drepl_init(void)
 {
-	return register_server_service("drepl", dreplsrv_init);
+	return register_server_service("drepl", dreplsrv_task_init);
 }
diff --git a/source4/dsdb/repl/replicated_objects.c b/source4/dsdb/repl/replicated_objects.c
index 8aff1340a5..552d83f411 100644
--- a/source4/dsdb/repl/replicated_objects.c
+++ b/source4/dsdb/repl/replicated_objects.c
@@ -400,8 +400,8 @@ WERROR dsdb_extended_replicated_objects_commit(struct ldb_context *ldb,
 
 	ret = ldb_extended(ldb, DSDB_EXTENDED_REPLICATED_OBJECTS_OID, out, &ext_res);
 	if (ret != LDB_SUCCESS) {
-		DEBUG(0,("Failed to apply records: %d: %s\n",
-			ret, ldb_strerror(ret)));
+		DEBUG(0,("Failed to apply records: %s: %s\n",
+			 ldb_errstring(ldb), ldb_strerror(ret)));
 		talloc_free(out);
 		return WERR_FOOBAR;
 	}
diff --git a/source4/dsdb/samdb/ldb_modules/extended_dn.c b/source4/dsdb/samdb/ldb_modules/extended_dn.c
index b62e806398..802f86570b 100644
--- a/source4/dsdb/samdb/ldb_modules/extended_dn.c
+++ b/source4/dsdb/samdb/ldb_modules/extended_dn.c
@@ -256,6 +256,7 @@ static int extended_search(struct ldb_module *module, struct ldb_request *req)
 
 	ac = talloc(req, struct extended_context);
 	if (ac == NULL) {
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
@@ -273,6 +274,7 @@ static int extended_search(struct ldb_module *module, struct ldb_request *req)
 
 	down_req = talloc_zero(req, struct ldb_request);
 	if (down_req == NULL) {
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
@@ -291,8 +293,10 @@ static int extended_search(struct ldb_module *module, struct ldb_request *req)
 		}
 		if (ac->remove_guid || ac->remove_sid) {
 			new_attrs = copy_attrs(down_req, req->op.search.attrs);
-			if (new_attrs == NULL)
+			if (new_attrs == NULL) {
+				ldb_oom(module->ldb);
 				return LDB_ERR_OPERATIONS_ERROR;
+			}
 			
 			if (ac->remove_guid) {
 				if (!add_attrs(down_req, &new_attrs, "objectGUID"))
@@ -339,6 +343,7 @@ static int extended_init(struct ldb_module *module)
 
 	req = talloc(module, struct ldb_request);
 	if (req == NULL) {
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
diff --git a/source4/dsdb/samdb/ldb_modules/instancetype.c b/source4/dsdb/samdb/ldb_modules/instancetype.c
index 064c28ec65..65df294e90 100644
--- a/source4/dsdb/samdb/ldb_modules/instancetype.c
+++ b/source4/dsdb/samdb/ldb_modules/instancetype.c
@@ -72,6 +72,7 @@ static int instancetype_add(struct ldb_module *module, struct ldb_request *req)
 
 	down_req = talloc(req, struct ldb_request);
 	if (down_req == NULL) {
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
@@ -81,6 +82,7 @@ static int instancetype_add(struct ldb_module *module, struct ldb_request *req)
 	down_req->op.add.message = msg = ldb_msg_copy_shallow(down_req, req->op.add.message);
 	if (msg == NULL) {
 		talloc_free(down_req);
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
diff --git a/source4/dsdb/samdb/ldb_modules/kludge_acl.c b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
index 97130495a3..ea33548b91 100644
--- a/source4/dsdb/samdb/ldb_modules/kludge_acl.c
+++ b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
@@ -316,6 +316,7 @@ static int kludge_acl_search(struct ldb_module *module, struct ldb_request *req)
 
 	ac = talloc(req, struct kludge_acl_context);
 	if (ac == NULL) {
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
@@ -329,6 +330,7 @@ static int kludge_acl_search(struct ldb_module *module, struct ldb_request *req)
 
 	down_req = talloc_zero(req, struct ldb_request);
 	if (down_req == NULL) {
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
@@ -417,6 +419,7 @@ static int kludge_acl_init(struct ldb_module *module)
 
 	data = talloc(module, struct kludge_private_data);
 	if (data == NULL) {
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
@@ -424,6 +427,7 @@ static int kludge_acl_init(struct ldb_module *module)
 	module->private_data = data;
 
 	if (!mem_ctx) {
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
@@ -453,6 +457,7 @@ static int kludge_acl_init(struct ldb_module *module)
 	data->password_attrs = talloc_array(data, const char *, password_attributes->num_values + 1);
 	if (!data->password_attrs) {
 		talloc_free(mem_ctx);
+		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 	for (i=0; i < password_attributes->num_values; i++) {
diff --git a/source4/dsdb/samdb/ldb_modules/ranged_results.c b/source4/dsdb/samdb/ldb_modules/ranged_results.c
index 345b8b8440..c527afc6db 100644
--- a/source4/dsdb/samdb/ldb_modules/ranged_results.c
+++ b/source4/dsdb/samdb/ldb_modules/ranged_results.c
@@ -153,8 +153,10 @@ static int rr_search(struct ldb_module *module, struct ldb_request *req)
 		if (strncasecmp(p, ";range=", strlen(";range=")) != 0) {
 			continue;
 		}
-		if (sscanf(p, ";range=%u-*", &start) == 1) {
-		} else if (sscanf(p, ";range=%u-%u", &start, &end) != 2) {
+		if (sscanf(p, ";range=%u-%u", &start, &end) == 2) {
+		} else if (sscanf(p, ";range=%u-*", &start) == 1) {
+			end = (unsigned int)-1;
+		} else {
 			ldb_asprintf_errstring(module->ldb, "range request error: range requst malformed");
 			return LDB_ERR_UNWILLING_TO_PERFORM;
 		}
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 5a3cc4bef4..441dbc9598 100644
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -240,12 +240,9 @@ static int replmd_prepare_originating(struct ldb_module *module, struct ldb_requ
 				      struct ldb_dn *dn, const char *fn_name,
 				      int (*fn)(struct ldb_module *,
 			 			struct ldb_request *,
-						const struct dsdb_schema *,
-						const struct dsdb_control_current_partition *))
+						const struct dsdb_schema *))
 {
 	const struct dsdb_schema *schema;
-	const struct ldb_control *partition_ctrl;
-	const struct dsdb_control_current_partition *partition;
  
 	/* do not manipulate our control entries */
 	if (ldb_dn_is_special(dn)) {
@@ -260,46 +257,16 @@ static int replmd_prepare_originating(struct ldb_module *module, struct ldb_requ
 		return LDB_ERR_CONSTRAINT_VIOLATION;
 	}
 
-	partition_ctrl = ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID);
-	if (!partition_ctrl) {
-		ldb_debug_set(module->ldb, LDB_DEBUG_FATAL,
-			      "%s: no current partition control found",
-			      fn_name);
-		return LDB_ERR_CONSTRAINT_VIOLATION;
-	}
-
-	partition = talloc_get_type(partition_ctrl->data,
-				    struct dsdb_control_current_partition);
-	if (!partition) {
-		ldb_debug_set(module->ldb, LDB_DEBUG_FATAL,
-			      "%s: current partition control contains invalid data",
-			      fn_name);
-		return LDB_ERR_CONSTRAINT_VIOLATION;
-	}
-
-	if (partition->version != DSDB_CONTROL_CURRENT_PARTITION_VERSION) {
-		ldb_debug_set(module->ldb, LDB_DEBUG_FATAL,
-			      "%s: current partition control contains invalid version [%u != %u]\n",
-			      fn_name, partition->version, DSDB_CONTROL_CURRENT_PARTITION_VERSION);
-		return LDB_ERR_CONSTRAINT_VIOLATION;
-	}
-
-	return fn(module, req, schema, partition);
+	return fn(module, req, schema);
 }
 
 static int replmd_add_originating(struct ldb_module *module,
 				  struct ldb_request *req,
-				  const struct dsdb_schema *schema,
-				  const struct dsdb_control_current_partition *partition)
+				  const struct dsdb_schema *schema)
 {
 	enum ndr_err_code ndr_err;
 	struct ldb_request *down_req;
 	struct ldb_message *msg;
-	uint32_t instance_type;
-	struct ldb_dn *new_dn;
-	const char *rdn_name;
-	const char *rdn_name_upper;
-	const struct ldb_val *rdn_value = NULL;
 	const struct dsdb_attribute *rdn_attr = NULL;
 	struct GUID guid;
 	struct ldb_val guid_value;
@@ -321,12 +288,6 @@ static int replmd_add_originating(struct ldb_module *module,
 		return LDB_ERR_UNWILLING_TO_PERFORM;
 	}
 
-	if (ldb_msg_find_element(req->op.add.message, "instanceType")) {
-		ldb_debug_set(module->ldb, LDB_DEBUG_ERROR,
-			      "replmd_add_originating: it's not allowed to add an object with instanceType\n");
-		return LDB_ERR_UNWILLING_TO_PERFORM;
-	}
-
 	/* Get a sequence number from the backend */
 	ret = ldb_sequence_number(module->ldb, LDB_SEQ_NEXT, &seq_num);
 	if (ret != LDB_SUCCESS) {
@@ -368,32 +329,9 @@ static int replmd_add_originating(struct ldb_module *module,
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	/*
-	 * get details of the rdn name
-	 */
-	rdn_name	= ldb_dn_get_rdn_name(msg->dn);
-	if (!rdn_name) {
-		talloc_free(down_req);
-		ldb_oom(module->ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
-	rdn_attr	= dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
-	if (!rdn_attr) {
-		talloc_free(down_req);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
-	rdn_value	= ldb_dn_get_rdn_val(msg->dn);
-	if (!rdn_value) {
-		talloc_free(down_req);
-		ldb_oom(module->ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
-
 	/* 
 	 * remove autogenerated attributes
 	 */
-	ldb_msg_remove_attr(msg, rdn_name);
-	ldb_msg_remove_attr(msg, "name");
 	ldb_msg_remove_attr(msg, "whenCreated");
 	ldb_msg_remove_attr(msg, "whenChanged");
 	ldb_msg_remove_attr(msg, "uSNCreated");
@@ -401,69 +339,14 @@ static int replmd_add_originating(struct ldb_module *module,
 	ldb_msg_remove_attr(msg, "replPropertyMetaData");
 
 	/*
-	 * TODO: construct a new DN out of:
-	 *       - the parent DN
-	 *       - the upper case of rdn_attr->LDAPDisplayName
-	 *       - rdn_value
-	 */
-	new_dn = ldb_dn_copy(msg, msg->dn);
-	if (!new_dn) {
-		talloc_free(down_req);
-		ldb_oom(module->ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
-	rdn_name_upper = strupper_talloc(msg, rdn_attr->lDAPDisplayName);
-	if (!rdn_name_upper) {
-		talloc_free(down_req);
-		ldb_oom(module->ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
-	ret = ldb_dn_set_component(new_dn, 0, rdn_name_upper, *rdn_value);
-	if (ret != LDB_SUCCESS) {
-		talloc_free(down_req);
-		ldb_oom(module->ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
-	msg->dn = new_dn;
-
-	/*
-	 * TODO: calculate correct instance type
-	 */
-	instance_type = INSTANCE_TYPE_WRITE;
-	if (ldb_dn_compare(partition->dn, msg->dn) == 0) {
-		instance_type |= INSTANCE_TYPE_IS_NC_HEAD;
-		if (ldb_dn_compare(msg->dn, samdb_base_dn(module->ldb)) != 0) {
-			instance_type |= INSTANCE_TYPE_NC_ABOVE;
-		}
-	}
-
-	/*
 	 * readd replicated attributes
 	 */
-	ret = ldb_msg_add_value(msg, rdn_attr->lDAPDisplayName, rdn_value, NULL);
-	if (ret != LDB_SUCCESS) {
-		talloc_free(down_req);
-		ldb_oom(module->ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
-	ret = ldb_msg_add_value(msg, "name", rdn_value, NULL);
-	if (ret != LDB_SUCCESS) {
-		talloc_free(down_req);
-		ldb_oom(module->ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
 	ret = ldb_msg_add_string(msg, "whenCreated", time_str);
 	if (ret != LDB_SUCCESS) {
 		talloc_free(down_req);
 		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
-	ret = ldb_msg_add_fmt(msg, "instanceType", "%u", instance_type);
-	if (ret != LDB_SUCCESS) {
-		talloc_free(down_req);
-		ldb_oom(module->ldb);
-		return LDB_ERR_OPERATIONS_ERROR;
-	}
 
 	/* build the replication meta_data */
 	ZERO_STRUCT(nmd);
@@ -508,6 +391,10 @@ static int replmd_add_originating(struct ldb_module *module,
 		m->originating_usn		= seq_num;
 		m->local_usn			= seq_num;
 		ni++;
+
+		if (ldb_attr_cmp(e->name, ldb_dn_get_rdn_name(msg->dn))) {
+			rdn_attr = sa;
+		}
 	}
 
 	/* fix meta data count */
@@ -598,8 +485,7 @@ static int replmd_add(struct ldb_module *module, struct ldb_request *req)
 
 static int replmd_modify_originating(struct ldb_module *module,
 				     struct ldb_request *req,
-				     const struct dsdb_schema *schema,
-				     const struct dsdb_control_current_partition *partition)
+				     const struct dsdb_schema *schema)
 {
 	struct ldb_request *down_req;
 	struct ldb_message *msg;
@@ -623,6 +509,18 @@ static int replmd_modify_originating(struct ldb_module *module,
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
+	/* TODO:
+	 * - get the whole old object
+	 * - if the old object doesn't exist report an error
+	 * - give an error when a readonly attribute should
+	 *   be modified
+	 * - merge the changed into the old object
+	 *   if the caller set values to the same value
+	 *   ignore the attribute, return success when no
+	 *   attribute was changed
+	 * - calculate the new replPropertyMetaData attribute
+	 */
+
 	if (add_time_element(msg, "whenChanged", t) != 0) {
 		talloc_free(down_req);
 		return LDB_ERR_OPERATIONS_ERROR;
@@ -637,6 +535,11 @@ static int replmd_modify_originating(struct ldb_module *module,
 		}
 	}
 
+	/* TODO:
+	 * - sort the attributes by attid with replmd_ldb_message_sort()
+	 * - replace the old object with the newly constructed one
+	 */
+
 	ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
 
 	/* go on with the call chain */
@@ -806,10 +709,16 @@ static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
 	return ldb_next_request(ar->module, ar->sub.change_req);
 #else
 	ret = ldb_next_request(ar->module, ar->sub.change_req);
-	if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
+	if (ret != LDB_SUCCESS) {
+		ldb_asprintf_errstring(ar->module->ldb, "Failed to add replicated object %s: %s", ldb_dn_get_linearized(ar->sub.change_req->op.add.message->dn), 
+				       ldb_errstring(ar->module->ldb));
+		return replmd_replicated_request_error(ar, ret);
+	}
 
-	ar->sub.change_ret = ldb_wait(ar->sub.search_req->handle, LDB_WAIT_ALL);
+	ar->sub.change_ret = ldb_wait(ar->sub.change_req->handle, LDB_WAIT_ALL);
 	if (ar->sub.change_ret != LDB_SUCCESS) {
+		ldb_asprintf_errstring(ar->module->ldb, "Failed while waiting on add replicated object %s: %s", ldb_dn_get_linearized(ar->sub.change_req->op.add.message->dn), 
+				       ldb_errstring(ar->module->ldb));
 		return replmd_replicated_request_error(ar, ar->sub.change_ret);
 	}
 
@@ -1053,7 +962,7 @@ static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
 	ret = ldb_next_request(ar->module, ar->sub.change_req);
 	if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
 
-	ar->sub.change_ret = ldb_wait(ar->sub.search_req->handle, LDB_WAIT_ALL);
+	ar->sub.change_ret = ldb_wait(ar->sub.change_req->handle, LDB_WAIT_ALL);
 	if (ar->sub.change_ret != LDB_SUCCESS) {
 		return replmd_replicated_request_error(ar, ar->sub.change_ret);
 	}
@@ -1137,7 +1046,7 @@ static int replmd_replicated_apply_search(struct replmd_replicated_request *ar)
 	if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
 
 	ar->sub.search_ret = ldb_wait(ar->sub.search_req->handle, LDB_WAIT_ALL);
-	if (ar->sub.search_ret != LDB_SUCCESS) {
+	if (ar->sub.search_ret != LDB_SUCCESS && ar->sub.search_ret != LDB_ERR_NO_SUCH_OBJECT) {
 		return replmd_replicated_request_error(ar, ar->sub.search_ret);
 	}
 	if (ar->sub.search_msg) {
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index 8a80260a69..baf419c750 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -72,7 +72,7 @@ static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
 
 	if (new_id == 0) {
 		/* out of IDs ! */
-		ldb_debug(ldb, LDB_DEBUG_FATAL, "Are we out of valid IDs ?\n");
+		ldb_set_errstring(ldb, "Are we out of valid IDs ?\n");
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
@@ -81,6 +81,7 @@ static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
 	ZERO_STRUCT(msg);
 	msg.dn = ldb_dn_copy(mem_ctx, dn);
 	if (!msg.dn) {
+		ldb_oom(ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 	msg.num_elements = 2;
@@ -91,6 +92,7 @@ static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
 	els[0].flags = LDB_FLAG_MOD_DELETE;
 	els[0].name = talloc_strdup(mem_ctx, "nextRid");
 	if (!els[0].name) {
+		ldb_oom(ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
@@ -101,12 +103,14 @@ static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
 
 	vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", old_id);
 	if (!vals[0].data) {
+		ldb_oom(ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 	vals[0].length = strlen((char *)vals[0].data);
 
 	vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", new_id);
 	if (!vals[1].data) {
+		ldb_oom(ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 	vals[1].length = strlen((char *)vals[1].data);
diff --git a/source4/dsdb/samdb/ldb_modules/schema_fsmo.c b/source4/dsdb/samdb/ldb_modules/schema_fsmo.c
index 559c91bd2d..f9dd131fd4 100644
--- a/source4/dsdb/samdb/ldb_modules/schema_fsmo.c
+++ b/source4/dsdb/samdb/ldb_modules/schema_fsmo.c
@@ -59,6 +59,7 @@ static int schema_fsmo_init(struct ldb_module *module)
 
 	schema_dn = samdb_schema_dn(module->ldb);
 	if (!schema_dn) {
+		ldb_reset_err_string(module->ldb);
 		ldb_debug(module->ldb, LDB_DEBUG_WARNING,
 			  "schema_fsmo_init: no schema dn present: (skip schema loading)\n");
 		return ldb_next_init(module);
@@ -91,6 +92,7 @@ static int schema_fsmo_init(struct ldb_module *module)
 			 NULL, schema_attrs,
 			 &schema_res);
 	if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+		ldb_reset_err_string(module->ldb);
 		ldb_debug(module->ldb, LDB_DEBUG_WARNING,
 			  "schema_fsmo_init: no schema head present: (skip schema loading)\n");
 		talloc_free(mem_ctx);
diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c
index c11eea1757..a01e442587 100644
--- a/source4/dsdb/samdb/samdb.c
+++ b/source4/dsdb/samdb/samdb.c
@@ -103,8 +103,8 @@ int samdb_copy_template(struct ldb_context *ldb,
 
 	if (!templates_ldb) {
 		templates_ldb_path = samdb_relative_path(ldb, 
-							msg, 
-							"templates.ldb");
+							 msg, 
+							 "templates.ldb");
 		if (!templates_ldb_path) {
 			*errstring = talloc_asprintf(msg, "samdb_copy_template: ERROR: Failed to contruct path for template db");
 			return LDB_ERR_OPERATIONS_ERROR;
@@ -115,6 +115,8 @@ int samdb_copy_template(struct ldb_context *ldb,
 						NULL, 0, NULL);
 		talloc_free(templates_ldb_path);
 		if (!templates_ldb) {
+			*errstring = talloc_asprintf(msg, "samdb_copy_template: ERROR: Failed to connect to templates db at: %s",
+					     templates_ldb_path);
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
 		
diff --git a/source4/dsdb/schema/schema_syntax.c b/source4/dsdb/schema/schema_syntax.c
index 9bc51c676e..2c133b6424 100644
--- a/source4/dsdb/schema/schema_syntax.c
+++ b/source4/dsdb/schema/schema_syntax.c
@@ -939,7 +939,7 @@ static WERROR dsdb_syntax_DN_BINARY_drsuapi_to_ldb(const struct dsdb_schema *sch
 		}
 
 		ndr_err = ndr_pull_struct_blob_all(in->value_ctr.values[i].blob,
-						   out->values, NULL, &id3b,
+						   out->values, lp_iconv_convenience(global_loadparm), &id3b,
 						   (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3Binary);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
@@ -997,7 +997,7 @@ static WERROR dsdb_syntax_DN_BINARY_ldb_to_drsuapi(const struct dsdb_schema *sch
 		id3b.dn		= (const char *)in->values[i].data;
 		id3b.binary	= data_blob(NULL, 0);
 
-		ndr_err = ndr_push_struct_blob(&blobs[i], blobs, NULL, &id3b,
+		ndr_err = ndr_push_struct_blob(&blobs[i], blobs, lp_iconv_convenience(global_loadparm), &id3b,
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3Binary);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/kdc/kdc.c b/source4/kdc/kdc.c
index 04e7ddd2ff..52ee475862 100644
--- a/source4/kdc/kdc.c
+++ b/source4/kdc/kdc.c
@@ -660,18 +660,8 @@ static void kdc_task_init(struct task_server *task)
 }
 
 
-/*
-  called on startup of the KDC service 
-*/
-static NTSTATUS kdc_init(struct event_context *event_ctx, 
-			 struct loadparm_context *lp_ctx,
-			 const struct model_ops *model_ops)
-{	
-	return task_server_startup(event_ctx, lp_ctx, model_ops, kdc_task_init);
-}
-
 /* called at smbd startup - register ourselves as a server service */
 NTSTATUS server_service_kdc_init(void)
 {
-	return register_server_service("kdc", kdc_init);
+	return register_server_service("kdc", kdc_task_init);
 }
diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
index 8380775c28..5b2519c035 100644
--- a/source4/ldap_server/ldap_server.c
+++ b/source4/ldap_server/ldap_server.c
@@ -576,20 +576,8 @@ failed:
 	task_server_terminate(task, "Failed to startup ldap server task");	
 }
 
-/*
-  called on startup of the web server service It's job is to start
-  listening on all configured sockets
-*/
-static NTSTATUS ldapsrv_init(struct event_context *event_context, 
-			     struct loadparm_context *lp_ctx,
-			     const struct model_ops *model_ops)
-{	
-	return task_server_startup(event_context, lp_ctx, model_ops, 
-				   ldapsrv_task_init);
-}
-
 
 NTSTATUS server_service_ldap_init(void)
 {
-	return register_server_service("ldap", ldapsrv_init);
+	return register_server_service("ldap", ldapsrv_task_init);
 }
diff --git a/source4/lib/ldb/Makefile.in b/source4/lib/ldb/Makefile.in
index 8be5d11958..7bd719cdd9 100644
--- a/source4/lib/ldb/Makefile.in
+++ b/source4/lib/ldb/Makefile.in
@@ -213,7 +213,7 @@ valgrindtest: all
 
 installcheck: install test
 
-install:: all installdirs installheaders installlibs installbin installdoc \
+install:: all installdirs installheaders installlibs installbin installdocs \
 		@PYTHON_INSTALL_TARGET@
 
 installdirs:
diff --git a/source4/lib/ldb/config.mk b/source4/lib/ldb/config.mk
index a3b10a22d5..75ce89d6cf 100644
--- a/source4/lib/ldb/config.mk
+++ b/source4/lib/ldb/config.mk
@@ -130,7 +130,7 @@ VERSION = 0.0.1
 SO_VERSION = 0
 OUTPUT_TYPE = SHARED_LIBRARY
 CFLAGS = -Ilib/ldb/include
-DESCRIPTION = LDAP-like embedded database library
+PC_FILE = ldb.pc
 INIT_FUNCTION_TYPE = int (*) (void)
 OBJ_FILES = \
 		common/ldb.o \
diff --git a/source4/lib/ldb/configure.ac b/source4/lib/ldb/configure.ac
index 62a840e561..176cef0f3e 100644
--- a/source4/lib/ldb/configure.ac
+++ b/source4/lib/ldb/configure.ac
@@ -11,7 +11,7 @@ AC_DEFUN([SMB_MODULE_DEFAULT], [echo -n ""])
 AC_DEFUN([SMB_LIBRARY_ENABLE], [echo -n ""])
 AC_DEFUN([SMB_EXT_LIB], [echo -n ""])
 AC_DEFUN([SMB_ENABLE], [echo -n ""])
-AC_INIT(ldb, 0.9.1)
+AC_INIT(ldb, 0.9.2)
 AC_CONFIG_SRCDIR([common/ldb.c])
 
 AC_LIBREPLACE_ALL_CHECKS
diff --git a/source4/lib/ldb/ldb.i b/source4/lib/ldb/ldb.i
index 560142eb6d..336100c4f0 100644
--- a/source4/lib/ldb/ldb.i
+++ b/source4/lib/ldb/ldb.i
@@ -5,7 +5,7 @@
 
    Copyright (C) 2005,2006 Tim Potter <tpot@samba.org>
    Copyright (C) 2006 Simo Sorce <idra@samba.org>
-   Copyright (C) 2007 Jelmer Vernooij <jelmer@samba.org>
+   Copyright (C) 2007-2008 Jelmer Vernooij <jelmer@samba.org>
 
      ** NOTE! The following LGPL license applies to the ldb
      ** library. This does NOT imply that all of Samba is released
@@ -102,8 +102,44 @@ typedef int ldb_error;
 	$1->data = PyString_AsString($input);
 }
 
+%inline %{
+PyObject *ldb_val_to_py_object(struct ldb_context *ldb_ctx, 
+                               struct ldb_message_element *el, 
+                               struct ldb_val *val)
+{
+        const struct ldb_schema_attribute *a;
+        struct ldb_val new_val;
+        TALLOC_CTX *mem_ctx = talloc_new(NULL);
+        PyObject *ret;
+        
+        new_val = *val;
+        
+        if (ldb_ctx != NULL) {        
+        	a = ldb_schema_attribute_by_name(ldb_ctx, el->name);
+        
+        	if (a != NULL) {
+        		if (a->syntax->ldif_write_fn(ldb_ctx, mem_ctx, val, &new_val) != 0) {
+        			talloc_free(mem_ctx);
+        			return NULL;
+        		}
+        	}
+        } 
+        
+	ret = PyString_FromStringAndSize((const char *)new_val.data, new_val.length);
+	
+	talloc_free(mem_ctx);
+	
+	return ret;
+}
+
+%}
+
+%typemap(out,noblock=1) struct ldb_val * {
+	$result = PyString_FromStringAndSize((const char *)$1->data, $1->length)
+}
+
 %typemap(out,noblock=1) struct ldb_val {
-	$result = PyString_FromStringAndSize((const char *)$1.data, $1.length);
+	$result = PyString_FromStringAndSize((const char *)$1.data, $1.length)
 }
 
 /*
@@ -259,7 +295,8 @@ ldb_msg_element *ldb_msg_element_from_pyobject(TALLOC_CTX *mem_ctx,
     return me;
 }
 
-PyObject *ldb_msg_element_to_set(ldb_msg_element *me)
+PyObject *ldb_msg_element_to_set(struct ldb_context *ldb_ctx, 
+                                 ldb_msg_element *me)
 {
     int i;
     PyObject *result;
@@ -269,8 +306,7 @@ PyObject *ldb_msg_element_to_set(ldb_msg_element *me)
 
     for (i = 0; i < me->num_values; i++) {
         PyList_SetItem(result, i,
-            PyString_FromStringAndSize((const char *)me->values[i].data, 
-                                       me->values[i].length));
+            ldb_val_to_py_object(ldb_ctx, me, &me->values[i]));
     }
 
     return result;
@@ -287,12 +323,12 @@ typedef struct ldb_message_element {
 #ifdef SWIGPYTHON
         PyObject *__iter__(void)
         {
-            return PyObject_GetIter(ldb_msg_element_to_set($self));
+            return PyObject_GetIter(ldb_msg_element_to_set(NULL, $self));
         }
 
         PyObject *__set__(void)
         {
-            return ldb_msg_element_to_set($self);
+            return ldb_msg_element_to_set(NULL, $self);
         }
 
         ldb_msg_element(PyObject *set_obj, int flags=0, const char *name = NULL)
@@ -311,9 +347,7 @@ typedef struct ldb_message_element {
             if (i < 0 || i >= $self->num_values)
                 return Py_None;
 
-            return PyString_FromStringAndSize(
-                        (const char *)$self->values[i].data, 
-                        $self->values[i].length);
+            return ldb_val_to_py_object(NULL, $self, &$self->values[i]);
         }
 
         ~ldb_msg_element() { talloc_free($self); }
@@ -622,6 +656,35 @@ typedef struct ldb_context {
         ldb_dn *get_root_basedn();
         ldb_dn *get_schema_basedn();
         ldb_dn *get_default_basedn();
+        PyObject *schema_format_value(const char *element_name, PyObject *val)
+        {
+        	const struct ldb_schema_attribute *a;
+        	struct ldb_val old_val;
+        	struct ldb_val new_val;
+        	TALLOC_CTX *mem_ctx = talloc_new(NULL);
+        	PyObject *ret;
+        	
+        	old_val.data = PyString_AsString(val);
+        	old_val.length = PyString_Size(val);
+                
+        	a = ldb_schema_attribute_by_name($self, element_name);
+        
+        	if (a == NULL) {
+        		return Py_None;
+        	}
+        	
+        	if (a->syntax->ldif_write_fn($self, mem_ctx, &old_val, &new_val) != 0) {
+        		talloc_free(mem_ctx);
+        		return Py_None;
+        	 }
+        
+		ret = PyString_FromStringAndSize((const char *)new_val.data, new_val.length);
+		
+		talloc_free(mem_ctx);
+		
+		return ret;
+        }
+
         const char *errstring();
         void set_create_perms(unsigned int perms);
         void set_modules_dir(const char *path);
@@ -633,7 +696,10 @@ typedef struct ldb_context {
         ldb_error transaction_start();
         ldb_error transaction_commit();
         ldb_error transaction_cancel();
-
+        void schema_attribute_remove(const char *name);
+        ldb_error schema_attribute_add(const char *attribute, unsigned flags, const char *syntax);
+	ldb_error setup_wellknown_attributes(void);
+	
 #ifdef SWIGPYTHON
         %typemap(in,numinputs=0,noblock=1) struct ldb_result **result_as_bool (struct ldb_result *tmp) { $1 = &tmp; }
         %typemap(argout,noblock=1) struct ldb_result **result_as_bool { $result = ((*$1)->count > 0)?Py_True:Py_False; }
diff --git a/source4/lib/ldb/ldb.py b/source4/lib/ldb/ldb.py
index ab2a68a4b3..0bcfd36779 100644
--- a/source4/lib/ldb/ldb.py
+++ b/source4/lib/ldb/ldb.py
@@ -65,6 +65,7 @@ CHANGETYPE_NONE = _ldb.CHANGETYPE_NONE
 CHANGETYPE_ADD = _ldb.CHANGETYPE_ADD
 CHANGETYPE_DELETE = _ldb.CHANGETYPE_DELETE
 CHANGETYPE_MODIFY = _ldb.CHANGETYPE_MODIFY
+ldb_val_to_py_object = _ldb.ldb_val_to_py_object
 class Dn(object):
     thisown = _swig_property(lambda x: x.this.own(), lambda x, v: x.this.own(v), doc='The membership flag')
     __repr__ = _swig_repr
@@ -218,6 +219,7 @@ Ldb.get_config_basedn = new_instancemethod(_ldb.Ldb_get_config_basedn,None,Ldb)
 Ldb.get_root_basedn = new_instancemethod(_ldb.Ldb_get_root_basedn,None,Ldb)
 Ldb.get_schema_basedn = new_instancemethod(_ldb.Ldb_get_schema_basedn,None,Ldb)
 Ldb.get_default_basedn = new_instancemethod(_ldb.Ldb_get_default_basedn,None,Ldb)
+Ldb.schema_format_value = new_instancemethod(_ldb.Ldb_schema_format_value,None,Ldb)
 Ldb.errstring = new_instancemethod(_ldb.Ldb_errstring,None,Ldb)
 Ldb.set_create_perms = new_instancemethod(_ldb.Ldb_set_create_perms,None,Ldb)
 Ldb.set_modules_dir = new_instancemethod(_ldb.Ldb_set_modules_dir,None,Ldb)
@@ -227,6 +229,9 @@ Ldb.get_opaque = new_instancemethod(_ldb.Ldb_get_opaque,None,Ldb)
 Ldb.transaction_start = new_instancemethod(_ldb.Ldb_transaction_start,None,Ldb)
 Ldb.transaction_commit = new_instancemethod(_ldb.Ldb_transaction_commit,None,Ldb)
 Ldb.transaction_cancel = new_instancemethod(_ldb.Ldb_transaction_cancel,None,Ldb)
+Ldb.schema_attribute_remove = new_instancemethod(_ldb.Ldb_schema_attribute_remove,None,Ldb)
+Ldb.schema_attribute_add = new_instancemethod(_ldb.Ldb_schema_attribute_add,None,Ldb)
+Ldb.setup_wellknown_attributes = new_instancemethod(_ldb.Ldb_setup_wellknown_attributes,None,Ldb)
 Ldb.__contains__ = new_instancemethod(_ldb.Ldb___contains__,None,Ldb)
 Ldb.parse_ldif = new_instancemethod(_ldb.Ldb_parse_ldif,None,Ldb)
 Ldb_swigregister = _ldb.Ldb_swigregister
diff --git a/source4/lib/ldb/ldb_wrap.c b/source4/lib/ldb/ldb_wrap.c
index c833246ead..51022e5930 100644
--- a/source4/lib/ldb/ldb_wrap.c
+++ b/source4/lib/ldb/ldb_wrap.c
@@ -2470,20 +2470,21 @@ SWIG_Python_MustGetPtr(PyObject *obj, swig_type_info *ty, int argnum, int flags)
 #define SWIGTYPE_p_ldb_message_element swig_types[8]
 #define SWIGTYPE_p_ldb_module_ops swig_types[9]
 #define SWIGTYPE_p_ldb_result swig_types[10]
-#define SWIGTYPE_p_long_long swig_types[11]
-#define SWIGTYPE_p_p_char swig_types[12]
-#define SWIGTYPE_p_p_ldb_control swig_types[13]
-#define SWIGTYPE_p_p_ldb_result swig_types[14]
-#define SWIGTYPE_p_short swig_types[15]
-#define SWIGTYPE_p_signed_char swig_types[16]
-#define SWIGTYPE_p_unsigned_char swig_types[17]
-#define SWIGTYPE_p_unsigned_int swig_types[18]
-#define SWIGTYPE_p_unsigned_long swig_types[19]
-#define SWIGTYPE_p_unsigned_long_long swig_types[20]
-#define SWIGTYPE_p_unsigned_short swig_types[21]
-#define SWIGTYPE_p_void swig_types[22]
-static swig_type_info *swig_types[24];
-static swig_module_info swig_module = {swig_types, 23, 0, 0, 0, 0};
+#define SWIGTYPE_p_ldb_val swig_types[11]
+#define SWIGTYPE_p_long_long swig_types[12]
+#define SWIGTYPE_p_p_char swig_types[13]
+#define SWIGTYPE_p_p_ldb_control swig_types[14]
+#define SWIGTYPE_p_p_ldb_result swig_types[15]
+#define SWIGTYPE_p_short swig_types[16]
+#define SWIGTYPE_p_signed_char swig_types[17]
+#define SWIGTYPE_p_unsigned_char swig_types[18]
+#define SWIGTYPE_p_unsigned_int swig_types[19]
+#define SWIGTYPE_p_unsigned_long swig_types[20]
+#define SWIGTYPE_p_unsigned_long_long swig_types[21]
+#define SWIGTYPE_p_unsigned_short swig_types[22]
+#define SWIGTYPE_p_void swig_types[23]
+static swig_type_info *swig_types[25];
+static swig_module_info swig_module = {swig_types, 24, 0, 0, 0, 0};
 #define SWIG_TypeQuery(name) SWIG_TypeQueryModule(&swig_module, &swig_module, name)
 #define SWIG_MangledTypeQuery(name) SWIG_MangledTypeQueryModule(&swig_module, &swig_module, name)
 
@@ -2550,6 +2551,37 @@ SWIG_From_int  (int value)
 }
 
 
+PyObject *ldb_val_to_py_object(struct ldb_context *ldb_ctx, 
+                               struct ldb_message_element *el, 
+                               struct ldb_val *val)
+{
+        const struct ldb_schema_attribute *a;
+        struct ldb_val new_val;
+        TALLOC_CTX *mem_ctx = talloc_new(NULL);
+        PyObject *ret;
+        
+        new_val = *val;
+        
+        if (ldb_ctx != NULL) {        
+        	a = ldb_schema_attribute_by_name(ldb_ctx, el->name);
+        
+        	if (a != NULL) {
+        		if (a->syntax->ldif_write_fn(ldb_ctx, mem_ctx, val, &new_val) != 0) {
+        			talloc_free(mem_ctx);
+        			return NULL;
+        		}
+        	}
+        } 
+        
+	ret = PyString_FromStringAndSize((const char *)new_val.data, new_val.length);
+	
+	talloc_free(mem_ctx);
+	
+	return ret;
+}
+
+
+
 SWIGINTERN swig_type_info*
 SWIG_pchar_descriptor(void)
 {
@@ -2719,7 +2751,8 @@ ldb_msg_element *ldb_msg_element_from_pyobject(TALLOC_CTX *mem_ctx,
     return me;
 }
 
-PyObject *ldb_msg_element_to_set(ldb_msg_element *me)
+PyObject *ldb_msg_element_to_set(struct ldb_context *ldb_ctx, 
+                                 ldb_msg_element *me)
 {
     int i;
     PyObject *result;
@@ -2729,8 +2762,7 @@ PyObject *ldb_msg_element_to_set(ldb_msg_element *me)
 
     for (i = 0; i < me->num_values; i++) {
         PyList_SetItem(result, i,
-            PyString_FromStringAndSize((const char *)me->values[i].data, 
-                                       me->values[i].length));
+            ldb_val_to_py_object(ldb_ctx, me, &me->values[i]));
     }
 
     return result;
@@ -2738,10 +2770,10 @@ PyObject *ldb_msg_element_to_set(ldb_msg_element *me)
 
 
 SWIGINTERN PyObject *ldb_msg_element___iter__(ldb_msg_element *self){
-            return PyObject_GetIter(ldb_msg_element_to_set(self));
+            return PyObject_GetIter(ldb_msg_element_to_set(NULL, self));
         }
 SWIGINTERN PyObject *ldb_msg_element___set__(ldb_msg_element *self){
-            return ldb_msg_element_to_set(self);
+            return ldb_msg_element_to_set(NULL, self);
         }
 
 #include <limits.h>
@@ -2898,9 +2930,7 @@ SWIGINTERN PyObject *ldb_msg_element_get(ldb_msg_element *self,int i){
             if (i < 0 || i >= self->num_values)
                 return Py_None;
 
-            return PyString_FromStringAndSize(
-                        (const char *)self->values[i].data, 
-                        self->values[i].length);
+            return ldb_val_to_py_object(NULL, self, &self->values[i]);
         }
 SWIGINTERN void delete_ldb_msg_element(ldb_msg_element *self){ talloc_free(self); }
 
@@ -3129,6 +3159,33 @@ SWIGINTERN ldb_error ldb_add__SWIG_1(ldb *self,PyObject *py_msg){
             fail:
             return 80;
         }
+SWIGINTERN PyObject *ldb_schema_format_value(ldb *self,char const *element_name,PyObject *val){
+        	const struct ldb_schema_attribute *a;
+        	struct ldb_val old_val;
+        	struct ldb_val new_val;
+        	TALLOC_CTX *mem_ctx = talloc_new(NULL);
+        	PyObject *ret;
+        	
+        	old_val.data = PyString_AsString(val);
+        	old_val.length = PyString_Size(val);
+                
+        	a = ldb_schema_attribute_by_name(self, element_name);
+        
+        	if (a == NULL) {
+        		return Py_None;
+        	}
+        	
+        	if (a->syntax->ldif_write_fn(self, mem_ctx, &old_val, &new_val) != 0) {
+        		talloc_free(mem_ctx);
+        		return Py_None;
+        	 }
+        
+		ret = PyString_FromStringAndSize((const char *)new_val.data, new_val.length);
+		
+		talloc_free(mem_ctx);
+		
+		return ret;
+        }
 SWIGINTERN ldb_error ldb___contains__(ldb *self,ldb_dn *dn,struct ldb_result **result_as_bool){
             return ldb_search(self, dn, LDB_SCOPE_BASE, NULL, NULL, 
                              result_as_bool);
@@ -3153,6 +3210,52 @@ static char *timestring(time_t t)
 #ifdef __cplusplus
 extern "C" {
 #endif
+SWIGINTERN PyObject *_wrap_ldb_val_to_py_object(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  struct ldb_context *arg1 = (struct ldb_context *) 0 ;
+  struct ldb_message_element *arg2 = (struct ldb_message_element *) 0 ;
+  struct ldb_val *arg3 = (struct ldb_val *) 0 ;
+  PyObject *result = 0 ;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  void *argp2 = 0 ;
+  int res2 = 0 ;
+  void *argp3 = 0 ;
+  int res3 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  PyObject * obj2 = 0 ;
+  char *  kwnames[] = {
+    (char *) "ldb_ctx",(char *) "el",(char *) "val", NULL 
+  };
+  
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OOO:ldb_val_to_py_object",kwnames,&obj0,&obj1,&obj2)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
+  if (!SWIG_IsOK(res1)) {
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "ldb_val_to_py_object" "', argument " "1"" of type '" "struct ldb_context *""'"); 
+  }
+  arg1 = (struct ldb_context *)(argp1);
+  res2 = SWIG_ConvertPtr(obj1, &argp2,SWIGTYPE_p_ldb_message_element, 0 |  0 );
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "ldb_val_to_py_object" "', argument " "2"" of type '" "struct ldb_message_element *""'"); 
+  }
+  arg2 = (struct ldb_message_element *)(argp2);
+  res3 = SWIG_ConvertPtr(obj2, &argp3,SWIGTYPE_p_ldb_val, 0 |  0 );
+  if (!SWIG_IsOK(res3)) {
+    SWIG_exception_fail(SWIG_ArgError(res3), "in method '" "ldb_val_to_py_object" "', argument " "3"" of type '" "struct ldb_val *""'"); 
+  }
+  arg3 = (struct ldb_val *)(argp3);
+  if (arg1 == NULL)
+  SWIG_exception(SWIG_ValueError, 
+    "ldb context must be non-NULL");
+  result = (PyObject *)ldb_val_to_py_object(arg1,arg2,arg3);
+  resultobj = result;
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_new_Dn(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   ldb *arg1 = (ldb *) 0 ;
@@ -4875,6 +4978,49 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_Ldb_schema_format_value(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  ldb *arg1 = (ldb *) 0 ;
+  char *arg2 = (char *) 0 ;
+  PyObject *arg3 = (PyObject *) 0 ;
+  PyObject *result = 0 ;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  int res2 ;
+  char *buf2 = 0 ;
+  int alloc2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  PyObject * obj2 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "element_name",(char *) "val", NULL 
+  };
+  
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OOO:Ldb_schema_format_value",kwnames,&obj0,&obj1,&obj2)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
+  if (!SWIG_IsOK(res1)) {
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_schema_format_value" "', argument " "1"" of type '" "ldb *""'"); 
+  }
+  arg1 = (ldb *)(argp1);
+  res2 = SWIG_AsCharPtrAndSize(obj1, &buf2, NULL, &alloc2);
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "Ldb_schema_format_value" "', argument " "2"" of type '" "char const *""'");
+  }
+  arg2 = (char *)(buf2);
+  arg3 = obj2;
+  if (arg1 == NULL)
+  SWIG_exception(SWIG_ValueError, 
+    "ldb context must be non-NULL");
+  result = (PyObject *)ldb_schema_format_value(arg1,(char const *)arg2,arg3);
+  resultobj = result;
+  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
+  return resultobj;
+fail:
+  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_Ldb_errstring(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
   PyObject *resultobj = 0;
   ldb *arg1 = (ldb *) 0 ;
@@ -5197,6 +5343,140 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_Ldb_schema_attribute_remove(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  ldb *arg1 = (ldb *) 0 ;
+  char *arg2 = (char *) 0 ;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  int res2 ;
+  char *buf2 = 0 ;
+  int alloc2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "name", NULL 
+  };
+  
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:Ldb_schema_attribute_remove",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
+  if (!SWIG_IsOK(res1)) {
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_schema_attribute_remove" "', argument " "1"" of type '" "ldb *""'"); 
+  }
+  arg1 = (ldb *)(argp1);
+  res2 = SWIG_AsCharPtrAndSize(obj1, &buf2, NULL, &alloc2);
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "Ldb_schema_attribute_remove" "', argument " "2"" of type '" "char const *""'");
+  }
+  arg2 = (char *)(buf2);
+  if (arg1 == NULL)
+  SWIG_exception(SWIG_ValueError, 
+    "ldb context must be non-NULL");
+  ldb_schema_attribute_remove(arg1,(char const *)arg2);
+  resultobj = SWIG_Py_Void();
+  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
+  return resultobj;
+fail:
+  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
+  return NULL;
+}
+
+
+SWIGINTERN PyObject *_wrap_Ldb_schema_attribute_add(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  ldb *arg1 = (ldb *) 0 ;
+  char *arg2 = (char *) 0 ;
+  unsigned int arg3 ;
+  char *arg4 = (char *) 0 ;
+  ldb_error result;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  int res2 ;
+  char *buf2 = 0 ;
+  int alloc2 = 0 ;
+  unsigned int val3 ;
+  int ecode3 = 0 ;
+  int res4 ;
+  char *buf4 = 0 ;
+  int alloc4 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  PyObject * obj2 = 0 ;
+  PyObject * obj3 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self",(char *) "attribute",(char *) "flags",(char *) "syntax", NULL 
+  };
+  
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OOOO:Ldb_schema_attribute_add",kwnames,&obj0,&obj1,&obj2,&obj3)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
+  if (!SWIG_IsOK(res1)) {
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_schema_attribute_add" "', argument " "1"" of type '" "ldb *""'"); 
+  }
+  arg1 = (ldb *)(argp1);
+  res2 = SWIG_AsCharPtrAndSize(obj1, &buf2, NULL, &alloc2);
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "Ldb_schema_attribute_add" "', argument " "2"" of type '" "char const *""'");
+  }
+  arg2 = (char *)(buf2);
+  ecode3 = SWIG_AsVal_unsigned_SS_int(obj2, &val3);
+  if (!SWIG_IsOK(ecode3)) {
+    SWIG_exception_fail(SWIG_ArgError(ecode3), "in method '" "Ldb_schema_attribute_add" "', argument " "3"" of type '" "unsigned int""'");
+  } 
+  arg3 = (unsigned int)(val3);
+  res4 = SWIG_AsCharPtrAndSize(obj3, &buf4, NULL, &alloc4);
+  if (!SWIG_IsOK(res4)) {
+    SWIG_exception_fail(SWIG_ArgError(res4), "in method '" "Ldb_schema_attribute_add" "', argument " "4"" of type '" "char const *""'");
+  }
+  arg4 = (char *)(buf4);
+  if (arg1 == NULL)
+  SWIG_exception(SWIG_ValueError, 
+    "ldb context must be non-NULL");
+  result = ldb_schema_attribute_add(arg1,(char const *)arg2,arg3,(char const *)arg4);
+  if (result != 0) {
+    PyErr_SetObject(PyExc_LdbError, Py_BuildValue((char *)"(i,s)", result, ldb_strerror(result)));
+    SWIG_fail;
+  }
+  resultobj = Py_None;
+  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
+  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
+  return resultobj;
+fail:
+  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
+  if (alloc4 == SWIG_NEWOBJ) free((char*)buf4);
+  return NULL;
+}
+
+
+SWIGINTERN PyObject *_wrap_Ldb_setup_wellknown_attributes(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
+  PyObject *resultobj = 0;
+  ldb *arg1 = (ldb *) 0 ;
+  ldb_error result;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  PyObject *swig_obj[1] ;
+  
+  if (!args) SWIG_fail;
+  swig_obj[0] = args;
+  res1 = SWIG_ConvertPtr(swig_obj[0], &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
+  if (!SWIG_IsOK(res1)) {
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "Ldb_setup_wellknown_attributes" "', argument " "1"" of type '" "ldb *""'"); 
+  }
+  arg1 = (ldb *)(argp1);
+  if (arg1 == NULL)
+  SWIG_exception(SWIG_ValueError, 
+    "ldb context must be non-NULL");
+  result = ldb_setup_wellknown_attributes(arg1);
+  if (result != 0) {
+    PyErr_SetObject(PyExc_LdbError, Py_BuildValue((char *)"(i,s)", result, ldb_strerror(result)));
+    SWIG_fail;
+  }
+  resultobj = Py_None;
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_Ldb___contains__(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   ldb *arg1 = (ldb *) 0 ;
@@ -5400,6 +5680,7 @@ fail:
 
 
 static PyMethodDef SwigMethods[] = {
+	 { (char *)"ldb_val_to_py_object", (PyCFunction) _wrap_ldb_val_to_py_object, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"new_Dn", (PyCFunction) _wrap_new_Dn, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"delete_Dn", (PyCFunction)_wrap_delete_Dn, METH_O, NULL},
 	 { (char *)"Dn_validate", (PyCFunction)_wrap_Dn_validate, METH_O, NULL},
@@ -5454,6 +5735,7 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"Ldb_get_root_basedn", (PyCFunction)_wrap_Ldb_get_root_basedn, METH_O, NULL},
 	 { (char *)"Ldb_get_schema_basedn", (PyCFunction)_wrap_Ldb_get_schema_basedn, METH_O, NULL},
 	 { (char *)"Ldb_get_default_basedn", (PyCFunction)_wrap_Ldb_get_default_basedn, METH_O, NULL},
+	 { (char *)"Ldb_schema_format_value", (PyCFunction) _wrap_Ldb_schema_format_value, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_errstring", (PyCFunction)_wrap_Ldb_errstring, METH_O, NULL},
 	 { (char *)"Ldb_set_create_perms", (PyCFunction) _wrap_Ldb_set_create_perms, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_set_modules_dir", (PyCFunction) _wrap_Ldb_set_modules_dir, METH_VARARGS | METH_KEYWORDS, NULL},
@@ -5463,6 +5745,9 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"Ldb_transaction_start", (PyCFunction)_wrap_Ldb_transaction_start, METH_O, NULL},
 	 { (char *)"Ldb_transaction_commit", (PyCFunction)_wrap_Ldb_transaction_commit, METH_O, NULL},
 	 { (char *)"Ldb_transaction_cancel", (PyCFunction)_wrap_Ldb_transaction_cancel, METH_O, NULL},
+	 { (char *)"Ldb_schema_attribute_remove", (PyCFunction) _wrap_Ldb_schema_attribute_remove, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"Ldb_schema_attribute_add", (PyCFunction) _wrap_Ldb_schema_attribute_add, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"Ldb_setup_wellknown_attributes", (PyCFunction)_wrap_Ldb_setup_wellknown_attributes, METH_O, NULL},
 	 { (char *)"Ldb___contains__", (PyCFunction) _wrap_Ldb___contains__, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_parse_ldif", (PyCFunction) _wrap_Ldb_parse_ldif, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"Ldb_swigregister", Ldb_swigregister, METH_VARARGS, NULL},
@@ -5488,6 +5773,7 @@ static swig_type_info _swigt__p_ldb_message = {"_p_ldb_message", "ldb_msg *|stru
 static swig_type_info _swigt__p_ldb_message_element = {"_p_ldb_message_element", "struct ldb_message_element *|ldb_msg_element *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_ldb_module_ops = {"_p_ldb_module_ops", "struct ldb_module_ops *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_ldb_result = {"_p_ldb_result", "struct ldb_result *", 0, 0, (void*)0, 0};
+static swig_type_info _swigt__p_ldb_val = {"_p_ldb_val", "struct ldb_val *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_long_long = {"_p_long_long", "int_least64_t *|int_fast64_t *|int64_t *|long long *|intmax_t *", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_p_char = {"_p_p_char", "char **", 0, 0, (void*)0, 0};
 static swig_type_info _swigt__p_p_ldb_control = {"_p_p_ldb_control", "struct ldb_control **", 0, 0, (void*)0, 0};
@@ -5513,6 +5799,7 @@ static swig_type_info *swig_type_initial[] = {
   &_swigt__p_ldb_message_element,
   &_swigt__p_ldb_module_ops,
   &_swigt__p_ldb_result,
+  &_swigt__p_ldb_val,
   &_swigt__p_long_long,
   &_swigt__p_p_char,
   &_swigt__p_p_ldb_control,
@@ -5538,6 +5825,7 @@ static swig_cast_info _swigc__p_ldb_message[] = {  {&_swigt__p_ldb_message, 0, 0
 static swig_cast_info _swigc__p_ldb_message_element[] = {  {&_swigt__p_ldb_message_element, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_ldb_module_ops[] = {  {&_swigt__p_ldb_module_ops, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_ldb_result[] = {  {&_swigt__p_ldb_result, 0, 0, 0},{0, 0, 0, 0}};
+static swig_cast_info _swigc__p_ldb_val[] = {  {&_swigt__p_ldb_val, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_long_long[] = {  {&_swigt__p_long_long, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_p_char[] = {  {&_swigt__p_p_char, 0, 0, 0},{0, 0, 0, 0}};
 static swig_cast_info _swigc__p_p_ldb_control[] = {  {&_swigt__p_p_ldb_control, 0, 0, 0},{0, 0, 0, 0}};
@@ -5563,6 +5851,7 @@ static swig_cast_info *swig_cast_initial[] = {
   _swigc__p_ldb_message_element,
   _swigc__p_ldb_module_ops,
   _swigc__p_ldb_result,
+  _swigc__p_ldb_val,
   _swigc__p_long_long,
   _swigc__p_p_char,
   _swigc__p_p_ldb_control,
diff --git a/source4/lib/ldb/tests/python/ldap.py b/source4/lib/ldb/tests/python/ldap.py
index 01b66a3890..f75bb8124d 100755
--- a/source4/lib/ldb/tests/python/ldap.py
+++ b/source4/lib/ldb/tests/python/ldap.py
@@ -6,20 +6,21 @@ import getopt
 import optparse
 import sys
 
-# Add path to the library for in-tree use
-sys.path.append("scripting/python")
 import samba.getopt as options
 
 from auth import system_session
 from ldb import (SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError,
                  LDB_ERR_NO_SUCH_OBJECT, LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS,
                  LDB_ERR_ENTRY_ALREADY_EXISTS, LDB_ERR_UNWILLING_TO_PERFORM,
-                 LDB_ERR_NOT_ALLOWED_ON_NON_LEAF)
+                 LDB_ERR_NOT_ALLOWED_ON_NON_LEAF, LDB_ERR_OTHER)
 from samba import Ldb
+from subunit import SubunitTestRunner
 import param
+import unittest
 
 parser = optparse.OptionParser("ldap [options] <host>")
-parser.add_option_group(options.SambaOptions(parser))
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
 parser.add_option_group(options.VersionOptions(parser))
 # use command line creds if available
 credopts = options.CredentialsOptions(parser)
@@ -33,126 +34,124 @@ if len(args) < 1:
 
 host = args[0]
 
-lp = param.LoadParm()
-if opts.configfile:
-    lp.load(opts.configfile)
+lp = sambaopts.get_loadparm()
 
-def delete_force(ldb, dn):
-    try:
-        ldb.delete(dn)
-    except LdbError, (num, _): 
-        if num != LDB_ERR_NO_SUCH_OBJECT:
-            assert False
-
-def assertEquals(a1, a2):
-    assert a1 == a2, "Expected %r == %r" % (a1, a2)
+class BasicTests(unittest.TestCase):
+    def delete_force(self, ldb, dn):
+        try:
+            ldb.delete(dn)
+        except LdbError, (num, _): 
+            self.assertEquals(num, LDB_ERR_NO_SUCH_OBJECT)
+
+    def find_basedn(self, ldb):
+        res = ldb.search(base="", expression="", scope=SCOPE_BASE, 
+                         attrs=["defaultNamingContext"])
+        self.assertEquals(len(res), 1)
+        return res[0]["defaultNamingContext"][0]
+
+    def find_configurationdn(self, ldb):
+        res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
+        self.assertEquals(len(res), 1)
+        return res[0]["configurationNamingContext"][0]
+
+    def find_schemadn(self, ldb):
+        res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
+        self.assertEquals(len(res), 1)
+        return res[0]["schemaNamingContext"][0]
+
+    def setUp(self):
+        self.ldb = ldb
+        self.gc_ldb = gc_ldb
+        self.base_dn = self.find_basedn(ldb)
+        self.configuration_dn = self.find_configurationdn(ldb)
+        self.schema_dn = self.find_schemadn(ldb)
+
+        print "baseDN: %s\n" % self.base_dn
+
+        self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
+        self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
+
+    def test_group_add_invalid_member(self):
+        """Testing group add with invalid member"""
+        try:
+            self.ldb.add({
+                "dn": "cn=ldaptestgroup,cn=uSers," + self.base_dn,
+                "objectclass": "group",
+                "member": "cn=ldaptestuser,cn=useRs," + self.base_dn})
+            self.fail()
+        except LdbError, (num, _): 
+            self.assertEquals(num, LDB_ERR_NO_SUCH_OBJECT)
 
-def basic_tests(ldb, gc_ldb, base_dn, configuration_dn, schema_dn):
-    print "Running basic tests"
+    def test_all(self):
+        """Basic tests"""
 
-    delete_force(ldb, "cn=ldaptestuser,cn=users," + base_dn)
-    delete_force(ldb, "cn=ldaptestgroup,cn=users," + base_dn)
+        self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 
-    print "Testing group add with invalid member"
-    try:
-        ldb.add({
-        "dn": "cn=ldaptestgroup,cn=uSers," + base_dn,
-        "objectclass": "group",
-        "member": "cn=ldaptestuser,cn=useRs," + base_dn})
-    except LdbError, (num, _): 
-        if num != LDB_ERR_NO_SUCH_OBJECT:
-            assert False
-    else:
-        assert False
-
-    print "Testing user add"
-    try:
+        print "Testing user add"
         ldb.add({
-        "dn": "cn=ldaptestuser,cn=uSers," + base_dn,
+        "dn": "cn=ldaptestuser,cn=uSers," + self.base_dn,
         "objectclass": ["user", "person"],
         "cN": "LDAPtestUSER",
         "givenname": "ldap",
         "sn": "testy"})
-    except LdbError:
-        ldb.delete("cn=ldaptestuser,cn=users," + base_dn)
-        ldb.add({
-            "dn": "cn=ldaptestuser,cn=uSers," + base_dn,
-            "objectclass": ["user", "person"],
-            "cN": "LDAPtestUSER",
-            "givenname": "ldap",
-            "sn": "testy"})
-
-    ldb.add({
-        "dn": "cn=ldaptestgroup,cn=uSers," + base_dn,
-        "objectclass": "group",
-        "member": "cn=ldaptestuser,cn=useRs," + base_dn})
-
-    try:
-        ldb.add({
-        "dn": "cn=ldaptestcomputer,cn=computers," + base_dn,
-        "objectclass": "computer",
-        "cN": "LDAPtestCOMPUTER"})
-    except LdbError:
-        ldb.delete("cn=ldaptestcomputer,cn=computers," + base_dn)
+
         ldb.add({
-            "dn": "cn=ldaptestcomputer,cn=computers," + base_dn,
-            "objectClass": "computer",
-            "cn": "LDAPtestCOMPUTER"})
-
-    try:
-        ldb.add({"dn": "cn=ldaptest2computer,cn=computers," + base_dn,
-        "objectClass": "computer",
-        "cn": "LDAPtest2COMPUTER",
-        "userAccountControl": "4096",
-        "displayname": "ldap testy"})
-    except LdbError:
-        ldb.delete("cn=ldaptest2computer,cn=computers," + base_dn)
+            "dn": "cn=ldaptestgroup,cn=uSers," + self.base_dn,
+            "objectclass": "group",
+            "member": "cn=ldaptestuser,cn=useRs," + self.base_dn})
+
+        self.delete_force(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
         ldb.add({
-            "dn": "cn=ldaptest2computer,cn=computers," + base_dn,
+            "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
+            "objectclass": "computer",
+            "cN": "LDAPtestCOMPUTER"})
+
+        self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
+        ldb.add({"dn": "cn=ldaptest2computer,cn=computers," + self.base_dn,
             "objectClass": "computer",
             "cn": "LDAPtest2COMPUTER",
             "userAccountControl": "4096",
             "displayname": "ldap testy"})
 
-    print "Testing attribute or value exists behaviour"
-    try:
-        ldb.modify_ldif("""
-dn: cn=ldaptest2computer,cn=computers,""" + base_dn + """
+        print "Testing attribute or value exists behaviour"
+        try:
+            ldb.modify_ldif("""
+dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
 changetype: modify
 replace: servicePrincipalName
 servicePrincipalName: host/ldaptest2computer
 servicePrincipalName: host/ldaptest2computer
 servicePrincipalName: cifs/ldaptest2computer
 """)
-    except LdbError, (num, msg):
-        assert num == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
+        except LdbError, (num, msg):
+            self.assertEquals(num, LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 
-        ldb.modify_ldif("""
-dn: cn=ldaptest2computer,cn=computers,""" + base_dn + """
+            ldb.modify_ldif("""
+dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
 changetype: modify
 replace: servicePrincipalName
 servicePrincipalName: host/ldaptest2computer
 servicePrincipalName: cifs/ldaptest2computer
 """)
-        try:
-            ldb.modify_ldif("""
-dn: cn=ldaptest2computer,cn=computers,""" + base_dn + """
+            try:
+                ldb.modify_ldif("""
+dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
 changetype: modify
 add: servicePrincipalName
 servicePrincipalName: host/ldaptest2computer
 """)
-        except LdbError, (num, msg):
-            assert num == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
-        
-        print "Testing ranged results"
-        ldb.modify_ldif("""
-dn: cn=ldaptest2computer,cn=computers,""" + base_dn + """
+            except LdbError, (num, msg):
+                self.assertEquals(num, LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS)
+            
+            print "Testing ranged results"
+            ldb.modify_ldif("""
+dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
 changetype: modify
 replace: servicePrincipalName
 """)
-        
-        ldb.modify_ldif("""
-dn: cn=ldaptest2computer,cn=computers,""" + base_dn + """
+            
+            ldb.modify_ldif("""
+dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
 changetype: modify
 add: servicePrincipalName
 servicePrincipalName: host/ldaptest2computer0
@@ -187,730 +186,685 @@ servicePrincipalName: host/ldaptest2computer28
 servicePrincipalName: host/ldaptest2computer29
 """)
 
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, 
-                         attrs=["servicePrincipalName;range=0-*"])
-        assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        #print len(res[0]["servicePrincipalName;range=0-*"])
-        assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
-
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-19"])
-        assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-#        print res[0]["servicePrincipalName;range=0-19"].length
-        assertEquals(len(res[0]["servicePrincipalName;range=0-19"]), 20)
-
-        
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-30"])
-        assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
-
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-40"])
-        assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
-
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=30-40"])
-        assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(len(res[0]["servicePrincipalName;range=30-*"]), 0)
-
-        
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=10-40"])
-        assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(len(res[0]["servicePrincipalName;range=10-*"]), 20)
-#        pos_11 = res[0]["servicePrincipalName;range=10-*"][18]
-
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-40"])
-        assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(len(res[0]["servicePrincipalName;range=11-*"]), 19)
-#        print res[0]["servicePrincipalName;range=11-*"][18]
-#        print pos_11
-#        assertEquals((res[0]["servicePrincipalName;range=11-*"][18]), pos_11)
-
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-15"])
-        assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-        assertEquals(len(res[0]["servicePrincipalName;range=11-15"]), 5)
-#        assertEquals(res[0]["servicePrincipalName;range=11-15"][4], pos_11)
-
-        res = ldb.search(base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName"])
-        assert len(res) == 1, "Could not find (cn=ldaptest2computer)"
-#        print res[0]["servicePrincipalName"][18]
-#        print pos_11
-        assertEquals(len(res[0]["servicePrincipalName"]), 30)
-#        assertEquals(res[0]["servicePrincipalName"][18], pos_11)
-
-    try:
+            res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, 
+                             attrs=["servicePrincipalName;range=0-*"])
+            self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
+            #print len(res[0]["servicePrincipalName;range=0-*"])
+            self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
+
+            res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-19"])
+            self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
+            # print res[0]["servicePrincipalName;range=0-19"].length
+            self.assertEquals(len(res[0]["servicePrincipalName;range=0-19"]), 20)
+
+            
+            res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-30"])
+            self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
+            self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
+
+            res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-40"])
+            self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
+            self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
+
+            res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=30-40"])
+            self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
+            self.assertEquals(len(res[0]["servicePrincipalName;range=30-*"]), 0)
+
+            
+            res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=10-40"])
+            self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
+            self.assertEquals(len(res[0]["servicePrincipalName;range=10-*"]), 20)
+            # pos_11 = res[0]["servicePrincipalName;range=10-*"][18]
+
+            res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-40"])
+            self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
+            self.assertEquals(len(res[0]["servicePrincipalName;range=11-*"]), 19)
+            # print res[0]["servicePrincipalName;range=11-*"][18]
+            # print pos_11
+            # self.assertEquals((res[0]["servicePrincipalName;range=11-*"][18]), pos_11)
+
+            res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-15"])
+            self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
+            self.assertEquals(len(res[0]["servicePrincipalName;range=11-15"]), 5)
+            # self.assertEquals(res[0]["servicePrincipalName;range=11-15"][4], pos_11)
+
+            res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName"])
+            self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
+            # print res[0]["servicePrincipalName"][18]
+            # print pos_11
+            self.assertEquals(len(res[0]["servicePrincipalName"]), 30)
+            # self.assertEquals(res[0]["servicePrincipalName"][18], pos_11)
+
+        self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
         ldb.add({
-        "dn": "cn=ldaptestuser2,cn=useRs," + base_dn,
-        "objectClass": ["person", "user"],
-        "cn": "LDAPtestUSER2",
-        "givenname": "testy",
-        "sn": "ldap user2"})
-    except LdbError:
-        ldb.delete("cn=ldaptestuser2,cn=users," + base_dn)
-        ldb.add({
-                "dn": "cn=ldaptestuser2,cn=useRs," + base_dn,
-                "objectClass": ["person", "user"],
-                "cn": "LDAPtestUSER2",
-                "givenname": "testy",
-                "sn": "ldap user2"})
-
-    print "Testing Ambigious Name Resolution"
-#   Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
-    res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
-    assert len(res) == 3, "Could not find (&(anr=ldap testy)(objectClass=user))"
-
-#   Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
-    res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
-    assert len(res) == 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res)
-
-#   Testing ldb.search for (&(anr=ldap)(objectClass=user))
-    res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
-    assert len(res) == 4, "Found only %d for (&(anr=ldap)(objectClass=user))" % len(res)
-
-#   Testing ldb.search for (&(anr==ldap)(objectClass=user))
-    res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(anr==ldap)(objectClass=user)). Found only %d for (&(anr=ldap)(objectClass=user))" % len(res)
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"][0], "ldaptestuser")
-    assertEquals(res[0]["name"], "ldaptestuser")
-
-#   Testing ldb.search for (&(anr=testy)(objectClass=user))
-    res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
-    assert len(res) == 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res)
-
-#   Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
-    res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
-    assert len(res) == 2, "Found only %d for (&(anr=ldap testy)(objectClass=user))" % len(res)
-
-#   Testing ldb.search for (&(anr==ldap testy)(objectClass=user))
-    res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
-    assert len(res) == 1, "Found only %d for (&(anr==ldap testy)(objectClass=user))" % len(res)
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"][0], "ldaptestuser")
-    assertEquals(res[0]["name"][0], "ldaptestuser")
-
-# Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
-    res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(anr==testy ldap)(objectClass=user))"
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"][0], "ldaptestuser")
-    assertEquals(res[0]["name"][0], "ldaptestuser")
-
-    # Testing ldb.search for (&(anr=testy ldap user)(objectClass=user))
-    res = ldb.search(expression="(&(anr=testy ldap user)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(anr=testy ldap user)(objectClass=user))"
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestuser2")
-    assertEquals(res[0]["name"], "ldaptestuser2")
-
-    # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
-    res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))"
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestuser2")
-    assertEquals(res[0]["name"], "ldaptestuser2")
-
-    # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
-    res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(anr==ldap user2)(objectClass=user))"
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestuser2")
-    assertEquals(res[0]["name"], "ldaptestuser2")
-
-    # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
-    res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
-    assert len(res) == 0, "Must not find (&(anr==not ldap user2)(objectClass=user))"
-
-    # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
-    res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
-    assert len(res) == 0, "Must not find (&(anr=not ldap user2)(objectClass=user))"
-
-    print "Testing Group Modifies"
-    ldb.modify_ldif("""
-dn: cn=ldaptestgroup,cn=users,""" + base_dn + """
+            "dn": "cn=ldaptestuser2,cn=useRs," + self.base_dn,
+            "objectClass": ["person", "user"],
+            "cn": "LDAPtestUSER2",
+            "givenname": "testy",
+            "sn": "ldap user2"})
+
+        print "Testing Ambigious Name Resolution"
+        # Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
+        res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
+        self.assertEquals(len(res), 3, "Could not find (&(anr=ldap testy)(objectClass=user))")
+
+        # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
+        res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
+        self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res))
+
+        # Testing ldb.search for (&(anr=ldap)(objectClass=user))
+        res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
+        self.assertEquals(len(res), 4, "Found only %d for (&(anr=ldap)(objectClass=user))" % len(res))
+
+        # Testing ldb.search for (&(anr==ldap)(objectClass=user))
+        res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(anr==ldap)(objectClass=user)). Found only %d for (&(anr=ldap)(objectClass=user))" % len(res))
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
+        self.assertEquals(res[0]["name"], "ldaptestuser")
+
+        # Testing ldb.search for (&(anr=testy)(objectClass=user))
+        res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
+        self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res))
+
+        # Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
+        res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
+        self.assertEquals(len(res), 2, "Found only %d for (&(anr=ldap testy)(objectClass=user))" % len(res))
+
+        # Testing ldb.search for (&(anr==ldap testy)(objectClass=user))
+        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Found only %d for (&(anr==ldap testy)(objectClass=user))" % len(res))
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
+        self.assertEquals(res[0]["name"][0], "ldaptestuser")
+
+        # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
+        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap)(objectClass=user))")
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
+        self.assertEquals(res[0]["name"][0], "ldaptestuser")
+
+        # Testing ldb.search for (&(anr=testy ldap user)(objectClass=user))
+        res = ldb.search(expression="(&(anr=testy ldap user)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(anr=testy ldap user)(objectClass=user))")
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestuser2")
+        self.assertEquals(res[0]["name"], "ldaptestuser2")
+
+        # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
+        res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))")
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestuser2")
+        self.assertEquals(res[0]["name"], "ldaptestuser2")
+
+        # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
+        res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(anr==ldap user2)(objectClass=user))")
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestuser2")
+        self.assertEquals(res[0]["name"], "ldaptestuser2")
+
+        # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
+        res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
+        self.assertEquals(len(res), 0, "Must not find (&(anr==not ldap user2)(objectClass=user))")
+
+        # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
+        res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
+        self.assertEquals(len(res), 0, "Must not find (&(anr=not ldap user2)(objectClass=user))")
+
+        print "Testing Group Modifies"
+        ldb.modify_ldif("""
+dn: cn=ldaptestgroup,cn=users,""" + self.base_dn + """
 changetype: modify
 add: member
-member: cn=ldaptestuser2,cn=users,""" + base_dn + """
-member: cn=ldaptestcomputer,cn=computers,""" + base_dn + """
+member: cn=ldaptestuser2,cn=users,""" + self.base_dn + """
+member: cn=ldaptestcomputer,cn=computers,""" + self.base_dn + """
 """)
 
-    delete_force(ldb, "cn=ldaptestuser3,cn=users," + base_dn)
+        self.delete_force(ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
 
-    print "Testing adding non-existent user to a group"
-    try:
-        ldb.modify_ldif("""
-dn: cn=ldaptestgroup,cn=users,""" + base_dn + """
+        print "Testing adding non-existent user to a group"
+        try:
+            ldb.modify_ldif("""
+dn: cn=ldaptestgroup,cn=users,""" + self.base_dn + """
 changetype: modify
 add: member
-member: cn=ldaptestuser3,cn=users,""" + base_dn + """
+member: cn=ldaptestuser3,cn=users,""" + self.base_dn + """
 """)
-    except LdbError, (num, _):
-        assert num == LDB_ERR_NO_SUCH_OBJECT
-    else:
-        assert False
-
-    print "Testing Renames"
-
-    ldb.rename("cn=ldaptestuser2,cn=users," + base_dn, "cn=ldaptestuser3,cn=users," + base_dn)
-
-    ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser3,cn=users," + base_dn)
-
-    ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestUSER3,cn=users," + base_dn)
-
-    print "Testing ldb.search for (&(cn=ldaptestuser3)(objectClass=user))"
-    res = ldb.search(expression="(&(cn=ldaptestuser3)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(cn=ldaptestuser3)(objectClass=user))"
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestUSER3")
-    assertEquals(res[0]["name"], "ldaptestUSER3")
-
-# This is a Samba special, and does not exist in real AD
-#    print "Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-#    res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")")
-#    if (res.error != 0 || len(res) != 1) {
-#        print "Could not find (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-#        assertEquals(len(res), 1)
-#    }
-#    assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + base_dn))
-#    assertEquals(res[0].cn, "ldaptestUSER3")
-#    assertEquals(res[0].name, "ldaptestUSER3")
-
-    print "Testing ldb.search for (distinguishedName=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-    res = ldb.search(expression="(distinguishedName=CN=ldaptestUSER3,CN=Users," + base_dn + ")")
-    assert len(res) == 1, "Could not find (dn=CN=ldaptestUSER3,CN=Users," + base_dn + ")"
-    assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestUSER3")
-    assertEquals(res[0]["name"], "ldaptestUSER3")
-
-    # ensure we cannot add it again
-    try:
-        ldb.add({"dn": "cn=ldaptestuser3,cn=userS," + base_dn,
-                  "objectClass": ["person", "user"],
-                  "cn": "LDAPtestUSER3"})
-    except LdbError, (num, _):
-        assert num == LDB_ERR_ENTRY_ALREADY_EXISTS
-    else:
-        assert False
-
-    # rename back
-    ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser2,cn=users," + base_dn)
-
-    # ensure we cannnot rename it twice
-    try:
-        ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser2,cn=users," + base_dn)
-    except LdbError, (num, _): 
-        assert num == LDB_ERR_NO_SUCH_OBJECT
-    else:
-        assert False
-
-    # ensure can now use that name
-    ldb.add({"dn": "cn=ldaptestuser3,cn=users," + base_dn,
-                  "objectClass": ["person", "user"],
-                  "cn": "LDAPtestUSER3"})
-    
-    # ensure we now cannnot rename
-    try:
-        ldb.rename("cn=ldaptestuser2,cn=users," + base_dn, "cn=ldaptestuser3,cn=users," + base_dn)
-    except LdbError, (num, _):
-        assert num == LDB_ERR_ENTRY_ALREADY_EXISTS
-    else:
-        assert False
-    try:
-        ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser3,cn=configuration," + base_dn)
-    except LdbError, (num, _):
-        assert num in (71, 64)
-    else:
-        assert False
-
-    ldb.rename("cn=ldaptestuser3,cn=users," + base_dn, "cn=ldaptestuser5,cn=users," + base_dn)
-
-    ldb.delete("cn=ldaptestuser5,cn=users," + base_dn)
-
-    delete_force(ldb, "cn=ldaptestgroup2,cn=users," + base_dn)
-
-    ldb.rename("cn=ldaptestgroup,cn=users," + base_dn, "cn=ldaptestgroup2,cn=users," + base_dn)
-
-    print "Testing subtree Renames"
-
-    ldb.add({"dn": "cn=ldaptestcontainer," + base_dn, 
-             "objectClass": "container"})
-    
-    try:
-        ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + base_dn, 
-             "objectClass": ["person", "user"],
-             "cn": "LDAPtestUSER4"})
-    except LdbError:
-        ldb.delete("cn=ldaptestuser4,cn=ldaptestcontainer," + base_dn)
-        ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + base_dn,
+            self.fail()
+        except LdbError, (num, _):
+            self.assertEquals(num, LDB_ERR_NO_SUCH_OBJECT)
+
+        print "Testing Renames"
+
+        ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
+
+        ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
+
+        ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestUSER3,cn=users," + self.base_dn)
+
+        print "Testing ldb.search for (&(cn=ldaptestuser3)(objectClass=user))"
+        res = ldb.search(expression="(&(cn=ldaptestuser3)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser3)(objectClass=user))")
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestUSER3")
+        self.assertEquals(res[0]["name"], "ldaptestUSER3")
+
+        # This is a Samba special, and does not exist in real AD
+        #    print "Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
+        #    res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
+        #    if (res.error != 0 || len(res) != 1) {
+        #        print "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
+        #        self.assertEquals(len(res), 1)
+        #    }
+        #    self.assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
+        #    self.assertEquals(res[0].cn, "ldaptestUSER3")
+        #    self.assertEquals(res[0].name, "ldaptestUSER3")
+
+        print "Testing ldb.search for (distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
+        res = ldb.search(expression="(distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
+        self.assertEquals(len(res), 1, "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestUSER3")
+        self.assertEquals(res[0]["name"], "ldaptestUSER3")
+
+        # ensure we cannot add it again
+        try:
+            ldb.add({"dn": "cn=ldaptestuser3,cn=userS," + self.base_dn,
                       "objectClass": ["person", "user"],
-                      "cn": "LDAPtestUSER4"})
+                      "cn": "LDAPtestUSER3"})
+            self.fail()
+        except LdbError, (num, _):
+            self.assertEquals(num, LDB_ERR_ENTRY_ALREADY_EXISTS)
+
+        # rename back
+        ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
+
+        # ensure we cannnot rename it twice
+        try:
+            ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, 
+                       "cn=ldaptestuser2,cn=users," + self.base_dn)
+            self.fail()
+        except LdbError, (num, _): 
+            self.assertEquals(num, LDB_ERR_NO_SUCH_OBJECT)
+
+        # ensure can now use that name
+        ldb.add({"dn": "cn=ldaptestuser3,cn=users," + self.base_dn,
+                      "objectClass": ["person", "user"],
+                      "cn": "LDAPtestUSER3"})
+        
+        # ensure we now cannnot rename
+        try:
+            ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
+            self.fail()
+        except LdbError, (num, _):
+            self.assertEquals(num, LDB_ERR_ENTRY_ALREADY_EXISTS)
+        try:
+            ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=configuration," + self.base_dn)
+            self.fail()
+        except LdbError, (num, _):
+            self.assertTrue(num in (71, 64))
+
+        ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser5,cn=users," + self.base_dn)
 
-    ldb.modify_ldif("""
-dn: cn=ldaptestgroup2,cn=users,""" + base_dn + """
+        ldb.delete("cn=ldaptestuser5,cn=users," + self.base_dn)
+
+        self.delete_force(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
+
+        ldb.rename("cn=ldaptestgroup,cn=users," + self.base_dn, "cn=ldaptestgroup2,cn=users," + self.base_dn)
+
+        print "Testing subtree Renames"
+
+        ldb.add({"dn": "cn=ldaptestcontainer," + self.base_dn, 
+                 "objectClass": "container"})
+        
+        self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
+        ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + self.base_dn, 
+                 "objectClass": ["person", "user"],
+                 "cn": "LDAPtestUSER4"})
+
+        ldb.modify_ldif("""
+dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
 changetype: modify
 add: member
-member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + base_dn + """
+member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + self.base_dn + """
 """)
-    
-    print "Testing ldb.rename of cn=ldaptestcontainer," + base_dn + " to cn=ldaptestcontainer2," + base_dn
-    ldb.rename("CN=ldaptestcontainer," + base_dn, "CN=ldaptestcontainer2," + base_dn)
-
-    print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user))"
-    res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user))"
-
-    print "Testing subtree ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + base_dn
-    try:
-        ldb.search("cn=ldaptestcontainer," + base_dn, 
-                expression="(&(cn=ldaptestuser4)(objectClass=user))", 
-                scope=SCOPE_SUBTREE)
-    except LdbError, (num, _):
-        assert num == LDB_ERR_NO_SUCH_OBJECT
-    else:
-        assert False
-
-    print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + base_dn
-    try:
-        res = ldb.search("cn=ldaptestcontainer," + base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
-    except LdbError, (num, _):
-        assert num == LDB_ERR_NO_SUCH_OBJECT
-    else:
-        assert False
-
-    print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in renamed container"
-    res = ldb.search("cn=ldaptestcontainer2," + base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_SUBTREE)
-    assert len(res) == 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user)) under cn=ldaptestcontainer2," + base_dn
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn))
-    assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + base_dn).upper())
-
-    print "Testing ldb.search for (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group)) to check subtree renames and linked attributes"
-    res = ldb.search(base_dn, expression="(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group))", scope=SCOPE_SUBTREE)
-    assert len(res) == 1, "Could not find (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn + ")(objectclass=group)), perhaps linked attributes are not conistant with subtree renames?"
-
-    print "Testing ldb.rename (into itself) of cn=ldaptestcontainer2," + base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer2," + base_dn
-    try:
-        ldb.rename("cn=ldaptestcontainer2," + base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + base_dn)
-    except LdbError, (num, _):
-        assert num == LDB_ERR_UNWILLING_TO_PERFORM
-    else:
-        assert False
-
-    print "Testing ldb.rename (into non-existent container) of cn=ldaptestcontainer2," + base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer3," + base_dn
-    try:
-        ldb.rename("cn=ldaptestcontainer2," + base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer3," + base_dn)
-    except LdbError, (num, _):
-        assert num in (53, 80)
-    else:
-        assert False
-
-    print "Testing delete (should fail, not a leaf node) of renamed cn=ldaptestcontainer2," + base_dn
-    try:
-        ldb.delete("cn=ldaptestcontainer2," + base_dn)
-    except LdbError, (num, _):
-        assert num == LDB_ERR_NOT_ALLOWED_ON_NON_LEAF
-    else:
-        assert False
-
-    print "Testing base ldb.search for CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn
-    res = ldb.search(expression="(objectclass=*)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), scope=SCOPE_BASE)
-    assert len(res) == 1
-    res = ldb.search(expression="(cn=ldaptestuser40)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn), scope=SCOPE_BASE)
-    assert len(res) == 0
-
-    print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + base_dn
-    res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base="cn=ldaptestcontainer2," + base_dn, scope=SCOPE_ONELEVEL)
-    # FIXME: assert len(res) == 0
-
-    print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + base_dn
-    res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base="cn=ldaptestcontainer2," + base_dn, scope=SCOPE_SUBTREE)
-    #FIXME: assert len(res) == 0
-
-    print "Testing delete of subtree renamed "+("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn)
-    ldb.delete(("CN=ldaptestuser4,CN=ldaptestcontainer2," + base_dn))
-    print "Testing delete of renamed cn=ldaptestcontainer2," + base_dn
-    ldb.delete("cn=ldaptestcontainer2," + base_dn)
-    
-    try:
-        ldb.add({"dn": "cn=ldaptestutf8user èùéìòà ,cn=users," + base_dn, "objectClass": "user"})
-    except LdbError, (num, _):
-        ldb.delete("cn=ldaptestutf8user èùéìòà ,cn=users," + base_dn)
-        ldb.add({"dn": "cn=ldaptestutf8user èùéìòà ,cn=users," + base_dn, "objectClass": "user"})
-
-    try:
-        ldb.add({"dn": "cn=ldaptestutf8user2  èùéìòà ,cn=users," + base_dn, "objectClass": "user"})
-    except LdbError, (num, _):
-        ldb.delete("cn=ldaptestutf8user2  èùéìòà ,cn=users," + base_dn)
-        ldb.add({"dn": "cn=ldaptestutf8user2  èùéìòà ,cn=users," + base_dn,
-                  "objectClass": "user"})
-
-    print "Testing ldb.search for (&(cn=ldaptestuser)(objectClass=user))"
-    res = ldb.search(expression="(&(cn=ldaptestuser)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))"
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestuser")
-    assertEquals(res[0]["name"], "ldaptestuser")
-    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
-    assert("objectGUID" in res[0])
-    assert("whenCreated" in res[0])
-    assertEquals(res[0]["objectCategory"], ("CN=Person,CN=Schema,CN=Configuration," + base_dn))
-    assertEquals(int(res[0]["sAMAccountType"][0]), 805306368)
-#    assertEquals(res[0].userAccountControl, 546)
-    assertEquals(res[0]["memberOf"][0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(len(res[0]["memberOf"]), 1)
- 
-    print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))"
-    res2 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))")
-    assert len(res2) == 1, "Could not find (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))"
-
-    assertEquals(res[0].dn, res2[0].dn)
-
-    print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon))"
-    res3 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
-    assert len(res3) == 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)): matched " + len(res3)
-
-    assertEquals(res[0].dn, res3[0].dn)
-
-    if gc_ldb is not None:
-        print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
-        res3gc = gc_ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
-        assert len(res3gc) == 1
-    
-        assertEquals(res[0].dn, res3gc[0].dn)
-
-    print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in with 'phantom root' control"
-    
-    res3control = gc_ldb.search(base_dn, expression="(&(cn=ldaptestuser)(objectCategory=PerSon))", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
-    assert len(res3control) == 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
-    
-    assertEquals(res[0].dn, res3control[0].dn)
-
-    ldb.delete(res[0].dn)
-
-    print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))"
-    res = ldb.search(expression="(&(cn=ldaptestcomputer)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))"
-
-    assertEquals(str(res[0].dn), ("CN=ldaptestcomputer,CN=Computers," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestcomputer")
-    assertEquals(res[0]["name"], "ldaptestcomputer")
-    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user", "computer"])
-    assert("objectGUID" in res[0])
-    assert("whenCreated" in res[0])
-    assertEquals(res[0]["objectCategory"], ("CN=Computer,CN=Schema,CN=Configuration," + base_dn))
-    assertEquals(int(res[0]["primaryGroupID"][0]), 513)
-#    assertEquals(res[0].sAMAccountType, 805306368)
-#    assertEquals(res[0].userAccountControl, 546)
-    assertEquals(res[0]["memberOf"][0], "CN=ldaptestgroup2,CN=Users," + base_dn)
-    assertEquals(len(res[0]["memberOf"]), 1)
-
-    print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))"
-    res2 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
-    assert len(res2) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))"
-
-    assertEquals(res[0].dn, res2[0].dn)
-
-    if gc_ldb is not None:
-        print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + ")) in Global Catlog"
-        res2gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + "))")
-        assert len(res2gc) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + base_dn + ")) in Global Catlog"
-
-        assertEquals(res[0].dn, res2gc[0].dn)
-
-    print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
-    res3 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
-    assert len(res3) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
-
-    assertEquals(res[0].dn, res3[0].dn)
-
-    if gc_ldb is not None:
-        print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
-        res3gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
-        assert len(res3gc) == 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
-
-        assertEquals(res[0].dn, res3gc[0].dn)
-
-    print "Testing ldb.search for (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
-    res4 = ldb.search(expression="(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
-    assert len(res4) == 1, "Could not find (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
-
-    assertEquals(res[0].dn, res4[0].dn)
-
-    print "Testing ldb.search for (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
-    res5 = ldb.search(expression="(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
-    assert len(res5) == 1, "Could not find (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
-
-    assertEquals(res[0].dn, res5[0].dn)
-
-    print "Testing ldb.search for (&(cn=*daptestcomputer)(objectCategory=compuTER))"
-    res6 = ldb.search(expression="(&(cn=*daptestcomputer)(objectCategory=compuTER))")
-    assert len(res6) == 1, "Could not find (&(cn=*daptestcomputer)(objectCategory=compuTER))"
-
-    assertEquals(res[0].dn, res6[0].dn)
-
-    ldb.delete(res[0].dn)
-
-    print "Testing ldb.search for (&(cn=ldaptest2computer)(objectClass=user))"
-    res = ldb.search(expression="(&(cn=ldaptest2computer)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(cn=ldaptest2computer)(objectClass=user))"
-
-    assertEquals(res[0].dn, ("CN=ldaptest2computer,CN=Computers," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptest2computer")
-    assertEquals(res[0]["name"], "ldaptest2computer")
-    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user", "computer"])
-    assert("objectGUID" in res[0])
-    assert("whenCreated" in res[0])
-    assertEquals(res[0]["objectCategory"][0], "CN=Computer,CN=Schema,CN=Configuration," + base_dn)
-    assertEquals(int(res[0]["sAMAccountType"][0]), 805306369)
-#    assertEquals(res[0].userAccountControl, 4098)
-
-    ldb.delete(res[0].dn)
-
-    attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "memberOf"]
-    print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
-    res = ldb.search(base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
-    assert len(res) == 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))"
-
-    assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestuser2")
-    assertEquals(res[0]["name"], "ldaptestuser2")
-    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
-    assert("objectGUID" in res[0])
-    assert("whenCreated" in res[0])
-    assert("nTSecurityDescriptor" in res[0])
-    assertEquals(res[0]["memberOf"][0], ("CN=ldaptestgroup2,CN=Users," + base_dn))
-
-    attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
-    print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group))"
-    res = ldb.search(base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
-    assert len(res) == 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))"
-
-    assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestgroup2")
-    assertEquals(res[0]["name"], "ldaptestgroup2")
-    assertEquals(res[0]["objectClass"], ["top", "group"])
-    assert("objectGuid" not in res[0])
-    assert("whenCreated" in res[0])
-    assert("nTSecurityDescriptor" in res[0])
-    assertEquals(res[0]["member"], ["CN=ldaptestuser2,CN=Users," + base_dn])
-
-    ldb.modify_ldif("""
-dn: cn=ldaptestgroup2,cn=users,""" + base_dn + """
+        
+        print "Testing ldb.rename of cn=ldaptestcontainer," + self.base_dn + " to cn=ldaptestcontainer2," + self.base_dn
+        ldb.rename("CN=ldaptestcontainer," + self.base_dn, "CN=ldaptestcontainer2," + self.base_dn)
+
+        print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user))"
+        res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user))")
+
+        print "Testing subtree ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
+        try:
+            ldb.search("cn=ldaptestcontainer," + self.base_dn, 
+                    expression="(&(cn=ldaptestuser4)(objectClass=user))", 
+                    scope=SCOPE_SUBTREE)
+            self.fail()
+        except LdbError, (num, _):
+            self.assertEquals(num, LDB_ERR_NO_SUCH_OBJECT)
+
+        print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
+        try:
+            res = ldb.search("cn=ldaptestcontainer," + self.base_dn, 
+                    expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
+            self.fail()
+        except LdbError, (num, _):
+            self.assertEquals(num, LDB_ERR_NO_SUCH_OBJECT)
+
+        print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in renamed container"
+        res = ldb.search("cn=ldaptestcontainer2," + self.base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_SUBTREE)
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user)) under cn=ldaptestcontainer2," + self.base_dn)
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
+        self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
+
+        print "Testing ldb.search for (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)) to check subtree renames and linked attributes"
+        res = ldb.search(self.base_dn, expression="(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group))", scope=SCOPE_SUBTREE)
+        self.assertEquals(len(res), 1, "Could not find (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)), perhaps linked attributes are not conistant with subtree renames?")
+
+        print "Testing ldb.rename (into itself) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn
+        try:
+            ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn)
+            self.fail()
+        except LdbError, (num, _):
+            self.assertEquals(num, LDB_ERR_UNWILLING_TO_PERFORM)
+
+        print "Testing ldb.rename (into non-existent container) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn
+        try:
+            ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn)
+            self.fail()
+        except LdbError, (num, _):
+            self.assertTrue(num in (LDB_ERR_UNWILLING_TO_PERFORM, LDB_ERR_OTHER))
+
+        print "Testing delete (should fail, not a leaf node) of renamed cn=ldaptestcontainer2," + self.base_dn
+        try:
+            ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
+            self.fail()
+        except LdbError, (num, _):
+            self.assertEquals(num, LDB_ERR_NOT_ALLOWED_ON_NON_LEAF)
+
+        print "Testing base ldb.search for CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn
+        res = ldb.search(expression="(objectclass=*)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
+        self.assertEquals(len(res), 1)
+        res = ldb.search(expression="(cn=ldaptestuser40)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
+        self.assertEquals(len(res), 0)
+
+        print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
+        res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_ONELEVEL)
+        # FIXME: self.assertEquals(len(res), 0)
+
+        print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
+        res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_SUBTREE)
+        # FIXME: self.assertEquals(len(res), 0)
+
+        print "Testing delete of subtree renamed "+("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn)
+        ldb.delete(("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
+        print "Testing delete of renamed cn=ldaptestcontainer2," + self.base_dn
+        ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
+        
+        self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà ,cn=users," + self.base_dn)
+        ldb.add({"dn": "cn=ldaptestutf8user èùéìòà ,cn=users," + self.base_dn, "objectClass": "user"})
+
+        self.delete_force(self.ldb, "cn=ldaptestutf8user2  èùéìòà ,cn=users," + self.base_dn)
+        ldb.add({"dn": "cn=ldaptestutf8user2  èùéìòà ,cn=users," + self.base_dn, "objectClass": "user"})
+
+        print "Testing ldb.search for (&(cn=ldaptestuser)(objectClass=user))"
+        res = ldb.search(expression="(&(cn=ldaptestuser)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestuser")
+        self.assertEquals(res[0]["name"], "ldaptestuser")
+        self.assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
+        self.assertTrue("objectGUID" in res[0])
+        self.assertTrue("whenCreated" in res[0])
+        self.assertEquals(res[0]["objectCategory"], ("CN=Person,CN=Schema,CN=Configuration," + self.base_dn))
+        self.assertEquals(int(res[0]["sAMAccountType"][0]), 805306368)
+        # self.assertEquals(res[0].userAccountControl, 546)
+        self.assertEquals(res[0]["memberOf"][0], ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
+        self.assertEquals(len(res[0]["memberOf"]), 1)
+     
+        print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))"
+        res2 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
+        self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
+
+        self.assertEquals(res[0].dn, res2[0].dn)
+
+        print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon))"
+        res3 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
+        self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)): matched %d" % len(res3))
+
+        self.assertEquals(res[0].dn, res3[0].dn)
+
+        if gc_ldb is not None:
+            print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
+            res3gc = gc_ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
+            self.assertEquals(len(res3gc), 1)
+        
+            self.assertEquals(res[0].dn, res3gc[0].dn)
+
+        print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in with 'phantom root' control"
+        
+        res3control = gc_ldb.search(self.base_dn, expression="(&(cn=ldaptestuser)(objectCategory=PerSon))", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
+        self.assertEquals(len(res3control), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog")
+        
+        self.assertEquals(res[0].dn, res3control[0].dn)
+
+        ldb.delete(res[0].dn)
+
+        print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))"
+        res = ldb.search(expression="(&(cn=ldaptestcomputer)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
+
+        self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer,CN=Computers," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestcomputer")
+        self.assertEquals(res[0]["name"], "ldaptestcomputer")
+        self.assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user", "computer"])
+        self.assertTrue("objectGUID" in res[0])
+        self.assertTrue("whenCreated" in res[0])
+        self.assertEquals(res[0]["objectCategory"], ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn))
+        self.assertEquals(int(res[0]["primaryGroupID"][0]), 513)
+        # self.assertEquals(res[0].sAMAccountType, 805306368)
+        # self.assertEquals(res[0].userAccountControl, 546)
+        self.assertEquals(res[0]["memberOf"][0], "CN=ldaptestgroup2,CN=Users," + self.base_dn)
+        self.assertEquals(len(res[0]["memberOf"]), 1)
+
+        print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))"
+        res2 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
+        self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
+
+        self.assertEquals(res[0].dn, res2[0].dn)
+
+        if gc_ldb is not None:
+            print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog"
+            res2gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
+            self.assertEquals(len(res2gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog")
+
+            self.assertEquals(res[0].dn, res2gc[0].dn)
+
+        print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
+        res3 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
+        self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER))")
+
+        self.assertEquals(res[0].dn, res3[0].dn)
+
+        if gc_ldb is not None:
+            print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
+            res3gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
+            self.assertEquals(len(res3gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog")
+
+            self.assertEquals(res[0].dn, res3gc[0].dn)
+
+        print "Testing ldb.search for (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
+        res4 = ldb.search(expression="(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
+        self.assertEquals(len(res4), 1, "Could not find (&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
+
+        self.assertEquals(res[0].dn, res4[0].dn)
+
+        print "Testing ldb.search for (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
+        res5 = ldb.search(expression="(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
+        self.assertEquals(len(res5), 1, "Could not find (&(cn=ldaptestcomput*)(objectCategory=compuTER))")
+
+        self.assertEquals(res[0].dn, res5[0].dn)
+
+        print "Testing ldb.search for (&(cn=*daptestcomputer)(objectCategory=compuTER))"
+        res6 = ldb.search(expression="(&(cn=*daptestcomputer)(objectCategory=compuTER))")
+        self.assertEquals(len(res6), 1, "Could not find (&(cn=*daptestcomputer)(objectCategory=compuTER))")
+
+        self.assertEquals(res[0].dn, res6[0].dn)
+
+        ldb.delete(res[0].dn)
+
+        print "Testing ldb.search for (&(cn=ldaptest2computer)(objectClass=user))"
+        res = ldb.search(expression="(&(cn=ldaptest2computer)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptest2computer)(objectClass=user))")
+
+        self.assertEquals(res[0].dn, ("CN=ldaptest2computer,CN=Computers," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptest2computer")
+        self.assertEquals(res[0]["name"], "ldaptest2computer")
+        self.assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user", "computer"])
+        self.assertTrue("objectGUID" in res[0])
+        self.assertTrue("whenCreated" in res[0])
+        self.assertEquals(res[0]["objectCategory"][0], "CN=Computer,CN=Schema,CN=Configuration," + self.base_dn)
+        self.assertEquals(int(res[0]["sAMAccountType"][0]), 805306369)
+    #    self.assertEquals(res[0].userAccountControl, 4098)
+
+        ldb.delete(res[0].dn)
+
+        attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "memberOf"]
+        print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
+        res = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
+
+        self.assertEquals(res[0].dn, ("CN=ldaptestuser2,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestuser2")
+        self.assertEquals(res[0]["name"], "ldaptestuser2")
+        self.assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
+        self.assertTrue("objectGUID" in res[0])
+        self.assertTrue("whenCreated" in res[0])
+        self.assertTrue("nTSecurityDescriptor" in res[0])
+        self.assertEquals(res[0]["memberOf"][0], ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
+
+        attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
+        print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group))"
+        res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
+
+        self.assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestgroup2")
+        self.assertEquals(res[0]["name"], "ldaptestgroup2")
+        self.assertEquals(res[0]["objectClass"], ["top", "group"])
+        self.assertTrue("objectGuid" not in res[0])
+        self.assertTrue("whenCreated" in res[0])
+        self.assertTrue("nTSecurityDescriptor" in res[0])
+        self.assertEquals(res[0]["member"], ["CN=ldaptestuser2,CN=Users," + self.base_dn])
+
+        ldb.modify_ldif("""
+dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
 changetype: modify
 replace: member
-member: CN=ldaptestuser2,CN=Users,""" + base_dn + """
-member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + base_dn + """
+member: CN=ldaptestuser2,CN=Users,""" + self.base_dn + """
+member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
 """)
-    
-    print "Testing Linked attribute behaviours"
-    ldb.modify_ldif("""
-dn: cn=ldaptestgroup2,cn=users,""" + base_dn + """
+        
+        print "Testing Linked attribute behaviours"
+        ldb.modify_ldif("""
+dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
 changetype: modify
 delete: member
 """)
 
-    ldb.modify_ldif("""
-dn: cn=ldaptestgroup2,cn=users,""" + base_dn + """
+        ldb.modify_ldif("""
+dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
 changetype: modify
 add: member
-member: CN=ldaptestuser2,CN=Users,""" + base_dn + """
-member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + base_dn + """
+member: CN=ldaptestuser2,CN=Users,""" + self.base_dn + """
+member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
 """)
-    
-    ldb.modify_ldif("""
-dn: cn=ldaptestgroup2,cn=users,""" + base_dn + """
+        
+        ldb.modify_ldif("""
+dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
 changetype: modify
 replace: member
 """)
-    
-    ldb.modify_ldif("""
-dn: cn=ldaptestgroup2,cn=users,""" + base_dn + """
+        
+        ldb.modify_ldif("""
+dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
 changetype: modify
 add: member
-member: CN=ldaptestuser2,CN=Users,""" + base_dn + """
-member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + base_dn + """
+member: CN=ldaptestuser2,CN=Users,""" + self.base_dn + """
+member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
 """)
-    
-    ldb.modify_ldif("""
-dn: cn=ldaptestgroup2,cn=users,""" + base_dn + """
+        
+        ldb.modify_ldif("""
+dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
 changetype: modify
 delete: member
-member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + base_dn + """
+member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
 """)
-    
-    res = ldb.search(base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
-    assert len(res) == 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))"
+        
+        res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
+
+        self.assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["member"][0], ("CN=ldaptestuser2,CN=Users," + self.base_dn))
+        self.assertEquals(len(res[0]["member"]), 1)
 
-    assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assertEquals(res[0]["member"][0], ("CN=ldaptestuser2,CN=Users," + base_dn))
-    assertEquals(len(res[0]["member"]), 1)
+        ldb.delete(("CN=ldaptestuser2,CN=Users," + self.base_dn))
 
-    ldb.delete(("CN=ldaptestuser2,CN=Users," + base_dn))
+        attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
+        print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
+        res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete")
 
-    attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
-    print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
-    res = ldb.search(base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
-    assert len(res) == 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
+        self.assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
+        self.assertTrue("member" not in res[0])
 
-    assertEquals(res[0].dn, ("CN=ldaptestgroup2,CN=Users," + base_dn))
-    assert("member" not in res[0])
+        print "Testing ldb.search for (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
+        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
 
-    print "Testing ldb.search for (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
-    res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
+        self.assertEquals(res[0].dn, ("CN=ldaptestutf8user èùéìòà,CN=Users," + self.base_dn))
+        self.assertEquals(res[0]["cn"], "ldaptestutf8user èùéìòà")
+        self.assertEquals(res[0]["name"], "ldaptestutf8user èùéìòà")
+        self.assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
+        self.assertTrue("objectGUID" in res[0])
+        self.assertTrue("whenCreated" in res[0])
 
-    assertEquals(res[0].dn, ("CN=ldaptestutf8user èùéìòà,CN=Users," + base_dn))
-    assertEquals(res[0]["cn"], "ldaptestutf8user èùéìòà")
-    assertEquals(res[0]["name"], "ldaptestutf8user èùéìòà")
-    assertEquals(res[0]["objectClass"], ["top", "person", "organizationalPerson", "user"])
-    assert("objectGUID" in res[0])
-    assert("whenCreated" in res[0])
+        ldb.delete(res[0].dn)
 
-    ldb.delete(res[0].dn)
+        print "Testing ldb.search for (&(cn=ldaptestutf8user2*)(objectClass=user))"
+        res = ldb.search(expression="(&(cn=ldaptestutf8user2*)(objectClass=user))")
+        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user2*)(objectClass=user))")
 
-    print "Testing ldb.search for (&(cn=ldaptestutf8user2*)(objectClass=user))"
-    res = ldb.search(expression="(&(cn=ldaptestutf8user2*)(objectClass=user))")
-    assert len(res) == 1, "Could not find (&(cn=ldaptestutf8user2*)(objectClass=user))"
+        ldb.delete(res[0].dn)
 
-    ldb.delete(res[0].dn)
+        ldb.delete(("CN=ldaptestgroup2,CN=Users," + self.base_dn))
 
-    ldb.delete(("CN=ldaptestgroup2,CN=Users," + base_dn))
+        print "Testing ldb.search for (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
+        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
 
-    print "Testing ldb.search for (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
-    res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
+        #FIXME: self.assert len(res) == 1, "Could not find (expect space collapse, win2k3 fails) (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
 
-    #FIXME: assert len(res) == 1, "Could not find (expect space collapse, win2k3 fails) (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
+        print "Testing that we can't get at the configuration DN from the main search base"
+        res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
+        self.assertEquals(len(res), 0)
 
-    print "Testing that we can't get at the configuration DN from the main search base"
-    res = ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
-    assert len(res) == 0, "Got configuration DN " + res[0].dn + " which should not be able to be seen from main search base"
-    assertEquals(len(res), 0)
+        print "Testing that we can get at the configuration DN from the main search base on the LDAP port with the 'phantom root' search_options control"
+        res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
+        self.assertTrue(len(res) > 0)
 
-    print "Testing that we can get at the configuration DN from the main search base on the LDAP port with the 'phantom root' search_options control"
-    res = ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
-    assert(len(res) > 0)
+        if gc_ldb is not None:
+            print "Testing that we can get at the configuration DN from the main search base on the GC port with the search_options control == 0"
+            
+            res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:0"])
+            self.assertTrue(len(res) > 0)
 
-    if gc_ldb is not None:
-        print "Testing that we can get at the configuration DN from the main search base on the GC port with the search_options control == 0"
+            print "Testing that we do find configuration elements in the global catlog"
+            res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
+            self.assertTrue(len(res) > 0)
+        
+            print "Testing that we do find configuration elements and user elements at the same time"
+            res = gc_ldb.search(self.base_dn, expression="(|(objectClass=crossRef)(objectClass=person))", scope=SCOPE_SUBTREE, attrs=["cn"])
+            self.assertTrue(len(res) > 0)
+
+            print "Testing that we do find configuration elements in the global catlog, with the configuration basedn"
+            res = gc_ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
+            self.assertTrue(len(res) > 0)
+
+        print "Testing that we can get at the configuration DN on the main LDAP port"
+        res = ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
+        self.assertTrue(len(res) > 0)
+
+        print "Testing objectCategory canonacolisation"
+        res = ldb.search(self.configuration_dn, expression="objectCategory=ntDsDSA", scope=SCOPE_SUBTREE, attrs=["cn"])
+        self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=ntDsDSA")
+        self.assertTrue(len(res) != 0)
         
-        res = gc_ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:0"])
-        assert(len(res) > 0)
-
-        print "Testing that we do find configuration elements in the global catlog"
-        res = gc_ldb.search(base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
-        assert (len(res) > 0)
-    
-        print "Testing that we do find configuration elements and user elements at the same time"
-        res = gc_ldb.search(base_dn, expression="(|(objectClass=crossRef)(objectClass=person))", scope=SCOPE_SUBTREE, attrs=["cn"])
-        assert (len(res) > 0)
-
-        print "Testing that we do find configuration elements in the global catlog, with the configuration basedn"
-        res = gc_ldb.search(configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
-        assert (len(res) > 0)
-
-    print "Testing that we can get at the configuration DN on the main LDAP port"
-    res = ldb.search(configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
-    assert (len(res) > 0)
-
-    print "Testing objectCategory canonacolisation"
-    res = ldb.search(configuration_dn, expression="objectCategory=ntDsDSA", scope=SCOPE_SUBTREE, attrs=["cn"])
-    assert len(res) > 0, "Didn't find any records with objectCategory=ntDsDSA"
-    assert(len(res) != 0)
-    
-    res = ldb.search(configuration_dn, expression="objectCategory=CN=ntDs-DSA," + schema_dn, scope=SCOPE_SUBTREE, attrs=["cn"])
-    assert len(res) > 0, "Didn't find any records with objectCategory=CN=ntDs-DSA," + schema_dn
-    assert(len(res) != 0)
-    
-    print "Testing objectClass attribute order on "+ base_dn
-    res = ldb.search(expression="objectClass=domain", base=base_dn, 
-                     scope=SCOPE_BASE, attrs=["objectClass"])
-    assertEquals(len(res), 1)
-
-    assertEquals(res[0]["objectClass"], ["top", "domain", "domainDNS"])
-
-#  check enumeration
-
-    print "Testing ldb.search for objectCategory=person"
-    res = ldb.search(base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"])
-    assert(len(res) > 0)
-
-    print "Testing ldb.search for objectCategory=person with domain scope control"
-    res = ldb.search(base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
-    assert(len(res) > 0)
- 
-    print "Testing ldb.search for objectCategory=user"
-    res = ldb.search(base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"])
-    assert(len(res) > 0)
-
-    
-    print "Testing ldb.search for objectCategory=user with domain scope control"
-    res = ldb.search(base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
-    assert(len(res) > 0)
-    
-    print "Testing ldb.search for objectCategory=group"
-    res = ldb.search(base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"])
-    assert(len(res) > 0)
-
-    print "Testing ldb.search for objectCategory=group with domain scope control"
-    res = ldb.search(base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
-    assert(len(res) > 0)
-
-def basedn_tests(ldb, gc_ldb):
-    print "Testing for all rootDSE attributes"
-    res = ldb.search(scope=SCOPE_BASE, attrs=[])
-    assertEquals(len(res), 1)
-
-    print "Testing for highestCommittedUSN"
-    res = ldb.search("", scope=SCOPE_BASE, attrs=["highestCommittedUSN"])
-    assertEquals(len(res), 1)
-    assert(int(res[0]["highestCommittedUSN"][0]) != 0)
-
-    print "Testing for netlogon via LDAP"
-    res = ldb.search("", scope=SCOPE_BASE, attrs=["netlogon"])
-    assertEquals(len(res), 0)
-
-    print "Testing for netlogon and highestCommittedUSN via LDAP"
-    res = ldb.search("", scope=SCOPE_BASE, 
-            attrs=["netlogon", "highestCommittedUSN"])
-    assertEquals(len(res), 0)
-
-
-def find_basedn(ldb):
-    res = ldb.search(base="", expression="", scope=SCOPE_BASE, 
-                     attrs=["defaultNamingContext"])
-    assertEquals(len(res), 1)
-    return res[0]["defaultNamingContext"][0]
-
-
-def find_configurationdn(ldb):
-    res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
-    assertEquals(len(res), 1)
-    return res[0]["configurationNamingContext"][0]
-
-
-def find_schemadn(ldb):
-    res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
-    assertEquals(len(res), 1)
-    return res[0]["schemaNamingContext"][0]
+        res = ldb.search(self.configuration_dn, expression="objectCategory=CN=ntDs-DSA," + self.schema_dn, scope=SCOPE_SUBTREE, attrs=["cn"])
+        self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=CN=ntDs-DSA," + self.schema_dn)
+        self.assertTrue(len(res) != 0)
+        
+        print "Testing objectClass attribute order on "+ self.base_dn
+        res = ldb.search(expression="objectClass=domain", base=self.base_dn, 
+                         scope=SCOPE_BASE, attrs=["objectClass"])
+        self.assertEquals(len(res), 1)
+
+        self.assertEquals(res[0]["objectClass"], ["top", "domain", "domainDNS"])
+
+    #  check enumeration
+
+        print "Testing ldb.search for objectCategory=person"
+        res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"])
+        self.assertTrue(len(res) > 0)
+
+        print "Testing ldb.search for objectCategory=person with domain scope control"
+        res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
+        self.assertTrue(len(res) > 0)
+     
+        print "Testing ldb.search for objectCategory=user"
+        res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"])
+        self.assertTrue(len(res) > 0)
+        
+        print "Testing ldb.search for objectCategory=user with domain scope control"
+        res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
+        self.assertTrue(len(res) > 0)
+        
+        print "Testing ldb.search for objectCategory=group"
+        res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"])
+        self.assertTrue(len(res) > 0)
+
+        print "Testing ldb.search for objectCategory=group with domain scope control"
+        res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
+        self.assertTrue(len(res) > 0)
+
+
+class BaseDnTests(unittest.TestCase):
+    def setUp(self):
+        self.ldb = ldb
+
+    def test_rootdse_attrs(self):
+        """Testing for all rootDSE attributes"""
+        res = self.ldb.search(scope=SCOPE_BASE, attrs=[])
+        self.assertEquals(len(res), 1)
+
+    def test_highestcommittedusn(self):
+        """Testing for highestCommittedUSN"""
+        res = self.ldb.search("", scope=SCOPE_BASE, attrs=["highestCommittedUSN"])
+        self.assertEquals(len(res), 1)
+        self.assertTrue(int(res[0]["highestCommittedUSN"][0]) != 0)
+
+    def test_netlogon(self):
+        """Testing for netlogon via LDAP"""
+        res = self.ldb.search("", scope=SCOPE_BASE, attrs=["netlogon"])
+        self.assertEquals(len(res), 0)
+
+    def test_netlogon_highestcommitted_usn(self):
+        """Testing for netlogon and highestCommittedUSN via LDAP"""
+        res = self.ldb.search("", scope=SCOPE_BASE, 
+                attrs=["netlogon", "highestCommittedUSN"])
+        self.assertEquals(len(res), 0)
+
 
 if not "://" in host:
     host = "ldap://%s" % host
 
 ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
-base_dn = find_basedn(ldb)
-configuration_dn = find_configurationdn(ldb)
-schema_dn = find_schemadn(ldb)
-
-print "baseDN: %s\n" % base_dn
-
 gc_ldb = Ldb("%s:3268" % host, credentials=creds, 
              session_info=system_session(), lp=lp)
 
-basic_tests(ldb, gc_ldb, base_dn, configuration_dn, schema_dn)
-basedn_tests(ldb, gc_ldb)
+runner = SubunitTestRunner()
+runner.run(unittest.makeSuite(BaseDnTests))
+runner.run(unittest.makeSuite(BasicTests))
diff --git a/source4/lib/messaging/messaging.c b/source4/lib/messaging/messaging.c
index 811d5a85bf..6a879ab962 100644
--- a/source4/lib/messaging/messaging.c
+++ b/source4/lib/messaging/messaging.c
@@ -121,8 +121,8 @@ static NTSTATUS irpc_uptime(struct irpc_message *msg,
 */
 static char *messaging_path(struct messaging_context *msg, struct server_id server_id)
 {
-	return talloc_asprintf(msg, "%s/msg.%u.%u", msg->base_path, 
-			       (unsigned)server_id.node, (unsigned)server_id.id);
+	return talloc_asprintf(msg, "%s/msg.%s", msg->base_path, 
+			       cluster_id_string(msg, server_id));
 }
 
 /*
@@ -263,8 +263,10 @@ static void messaging_send_handler(struct messaging_context *msg)
 		}
 		rec->retries = 0;
 		if (!NT_STATUS_IS_OK(status)) {
-			DEBUG(1,("messaging: Lost message from %u to %u of type %u - %s\n", 
-				 rec->header->from.id, rec->header->to.id, rec->header->msg_type, 
+			DEBUG(1,("messaging: Lost message from %s to %s of type %u - %s\n", 
+				 cluster_id_string(debug_ctx(), rec->header->from), 
+				 cluster_id_string(debug_ctx(), rec->header->to), 
+				 rec->header->msg_type, 
 				 nt_errstr(status)));
 		}
 		DLIST_REMOVE(msg->pending, rec);
@@ -1051,7 +1053,7 @@ struct server_id *irpc_servers_byname(struct messaging_context *msg_ctx,
 	for (i=0;i<count;i++) {
 		ret[i] = ((struct server_id *)rec.dptr)[i];
 	}
-	ret[i] = cluster_id(0);
+	ret[i] = cluster_id(0, 0);
 	free(rec.dptr);
 	tdb_unlock_bystring(t->tdb, name);
 	talloc_free(t);
diff --git a/source4/lib/messaging/tests/irpc.c b/source4/lib/messaging/tests/irpc.c
index a2995fc983..d9b0548643 100644
--- a/source4/lib/messaging/tests/irpc.c
+++ b/source4/lib/messaging/tests/irpc.c
@@ -93,7 +93,7 @@ static bool test_addone(struct torture_context *test, const void *_data,
 	r.in.in_data = value;
 
 	test_debug = true;
-	status = IRPC_CALL(data->msg_ctx1, cluster_id(MSG_ID2), 
+	status = IRPC_CALL(data->msg_ctx1, cluster_id(0, MSG_ID2), 
 			   rpcecho, ECHO_ADDONE, &r, test);
 	test_debug = false;
 	torture_assert_ntstatus_ok(test, status, "AddOne failed");
@@ -122,7 +122,7 @@ static bool test_echodata(struct torture_context *tctx,
 	r.in.in_data = (unsigned char *)talloc_strdup(mem_ctx, "0123456789");
 	r.in.len = strlen((char *)r.in.in_data);
 
-	status = IRPC_CALL(data->msg_ctx1, cluster_id(MSG_ID2), 
+	status = IRPC_CALL(data->msg_ctx1, cluster_id(0, MSG_ID2), 
 			   rpcecho, ECHO_ECHODATA, &r, 
 			   mem_ctx);
 	torture_assert_ntstatus_ok(tctx, status, "EchoData failed");
@@ -180,7 +180,7 @@ static bool test_speed(struct torture_context *tctx,
 	while (timeval_elapsed(&tv) < timelimit) {
 		struct irpc_request *irpc;
 
-		irpc = IRPC_CALL_SEND(data->msg_ctx1, cluster_id(MSG_ID2), 
+		irpc = IRPC_CALL_SEND(data->msg_ctx1, cluster_id(0, MSG_ID2), 
 				      rpcecho, ECHO_ADDONE, 
 				      &r, mem_ctx);
 		torture_assert(tctx, irpc != NULL, "AddOne send failed");
@@ -221,7 +221,7 @@ static bool irpc_setup(struct torture_context *tctx, void **_data)
 	torture_assert(tctx, data->msg_ctx1 = 
 		       messaging_init(tctx, 
 				      lp_messaging_path(tctx, tctx->lp_ctx), 
-				      cluster_id(MSG_ID1),
+				      cluster_id(0, MSG_ID1),
 				      lp_iconv_convenience(tctx->lp_ctx),
 				      data->ev),
 		       "Failed to init first messaging context");
@@ -229,7 +229,7 @@ static bool irpc_setup(struct torture_context *tctx, void **_data)
 	torture_assert(tctx, data->msg_ctx2 = 
 		       messaging_init(tctx, 
 				      lp_messaging_path(tctx, tctx->lp_ctx),
-				      cluster_id(MSG_ID2), 
+				      cluster_id(0, MSG_ID2), 
 				      lp_iconv_convenience(tctx->lp_ctx),
 				      data->ev),
 		       "Failed to init second messaging context");
diff --git a/source4/lib/messaging/tests/messaging.c b/source4/lib/messaging/tests/messaging.c
index 0df04bce2b..45b573518c 100644
--- a/source4/lib/messaging/tests/messaging.c
+++ b/source4/lib/messaging/tests/messaging.c
@@ -73,7 +73,7 @@ static bool test_ping_speed(struct torture_context *tctx)
 
 	msg_server_ctx = messaging_init(tctx, 
 					lp_messaging_path(tctx, tctx->lp_ctx), 
-					cluster_id(1), 
+					cluster_id(0, 1), 
 				        lp_iconv_convenience(tctx->lp_ctx),
 					ev);
 	
@@ -84,7 +84,7 @@ static bool test_ping_speed(struct torture_context *tctx)
 
 	msg_client_ctx = messaging_init(tctx, 
 					lp_messaging_path(tctx, tctx->lp_ctx), 
-					cluster_id(2), 
+					cluster_id(0, 2), 
 				        lp_iconv_convenience(tctx->lp_ctx),
 					ev);
 
@@ -103,8 +103,8 @@ static bool test_ping_speed(struct torture_context *tctx)
 		data.data = discard_const_p(uint8_t, "testing");
 		data.length = strlen((const char *)data.data);
 
-		status1 = messaging_send(msg_client_ctx, cluster_id(1), msg_ping, &data);
-		status2 = messaging_send(msg_client_ctx, cluster_id(1), msg_ping, NULL);
+		status1 = messaging_send(msg_client_ctx, cluster_id(0, 1), msg_ping, &data);
+		status2 = messaging_send(msg_client_ctx, cluster_id(0, 1), msg_ping, NULL);
 
 		torture_assert_ntstatus_ok(tctx, status1, "msg1 failed");
 		ping_count++;
@@ -124,7 +124,7 @@ static bool test_ping_speed(struct torture_context *tctx)
 	}
 
 	torture_comment(tctx, "sending exit\n");
-	messaging_send(msg_client_ctx, cluster_id(1), msg_exit, NULL);
+	messaging_send(msg_client_ctx, cluster_id(0, 1), msg_exit, NULL);
 
 	torture_assert_int_equal(tctx, ping_count, pong_count, "ping test failed");
 
diff --git a/source4/lib/registry/config.mk b/source4/lib/registry/config.mk
index f1f50479cb..7a9c8fcff1 100644
--- a/source4/lib/registry/config.mk
+++ b/source4/lib/registry/config.mk
@@ -18,8 +18,8 @@ clean::
 # Start SUBSYSTEM registry
 [LIBRARY::registry]
 VERSION = 0.0.1
+PC_FILE = registry.pc
 SO_VERSION = 0
-DESCRIPTION = Windows-style registry library
 OBJ_FILES = \
 		interface.o \
 		util.o \
diff --git a/source4/lib/registry/ldb.c b/source4/lib/registry/ldb.c
index 262859f64b..0c8a55396e 100644
--- a/source4/lib/registry/ldb.c
+++ b/source4/lib/registry/ldb.c
@@ -400,7 +400,7 @@ static WERROR ldb_add_key(TALLOC_CTX *mem_ctx, const struct hive_key *parent,
 			  struct security_descriptor *sd,
 			  struct hive_key **newkey)
 {
-	struct ldb_key_data *parentkd = (const struct ldb_key_data *)parent;
+	struct ldb_key_data *parentkd = discard_const_p(struct ldb_key_data, parent);
 	struct ldb_message *msg;
 	struct ldb_key_data *newkd;
 	int ret;
diff --git a/source4/lib/registry/registry.pc.in b/source4/lib/registry/registry.pc.in
new file mode 100644
index 0000000000..98943a0736
--- /dev/null
+++ b/source4/lib/registry/registry.pc.in
@@ -0,0 +1,12 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: registry
+Description: Windows-style registry library
+Requires: ldb
+Requires.private: 
+Version: 0.0.1
+Libs: -L${libdir} -lregistry 
+Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/lib/talloc/config.mk b/source4/lib/talloc/config.mk
index 942ced6b86..16b5063f87 100644
--- a/source4/lib/talloc/config.mk
+++ b/source4/lib/talloc/config.mk
@@ -2,7 +2,7 @@
 VERSION = 1.0.0
 SO_VERSION = 1
 OBJ_FILES = talloc.o
+PC_FILE = talloc.pc
 MANPAGE = talloc.3
 CFLAGS = -Ilib/talloc
 PUBLIC_HEADERS = talloc.h
-DESCRIPTION = A hierarchical pool based memory system with destructors
diff --git a/source4/lib/tdb/common/tdb.c b/source4/lib/tdb/common/tdb.c
index ea5d9ccc60..767452c9b3 100644
--- a/source4/lib/tdb/common/tdb.c
+++ b/source4/lib/tdb/common/tdb.c
@@ -687,20 +687,66 @@ void tdb_enable_seqnum(struct tdb_context *tdb)
 
 
 /*
+  add a region of the file to the freelist. Length is the size of the region in bytes, 
+  which includes the free list header that needs to be added
+ */
+static int tdb_free_region(struct tdb_context *tdb, tdb_off_t offset, ssize_t length)
+{
+	struct list_struct rec;
+	if (length <= sizeof(rec)) {
+		/* the region is not worth adding */
+		return 0;
+	}
+	if (length + offset > tdb->map_size) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_free_region: adding region beyond end of file\n"));
+		return -1;		
+	}
+	memset(&rec,'\0',sizeof(rec));
+	rec.rec_len = length - sizeof(rec);
+	if (tdb_free(tdb, offset, &rec) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_free_region: failed to add free record\n"));
+		return -1;
+	}
+	return 0;
+}
+
+/*
   wipe the entire database, deleting all records. This can be done
   very fast by using a global lock. The entire data portion of the
   file becomes a single entry in the freelist.
+
+  This code carefully steps around the recovery area, leaving it alone
  */
 int tdb_wipe_all(struct tdb_context *tdb)
 {
 	int i;
 	tdb_off_t offset = 0;
 	ssize_t data_len;
+	tdb_off_t recovery_head;
+	tdb_len_t recovery_size = 0;
 
 	if (tdb_lockall(tdb) != 0) {
 		return -1;
 	}
 
+	/* see if the tdb has a recovery area, and remember its size
+	   if so. We don't want to lose this as otherwise each
+	   tdb_wipe_all() in a transaction will increase the size of
+	   the tdb by the size of the recovery area */
+	if (tdb_ofs_read(tdb, TDB_RECOVERY_HEAD, &recovery_head) == -1) {
+		TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_wipe_all: failed to read recovery head\n"));
+		goto failed;
+	}
+
+	if (recovery_head != 0) {
+		struct list_struct rec;
+		if (tdb->methods->tdb_read(tdb, recovery_head, &rec, sizeof(rec), DOCONV()) == -1) {
+			TDB_LOG((tdb, TDB_DEBUG_FATAL, "tdb_wipe_all: failed to read recovery record\n"));
+			return -1;
+		}	
+		recovery_size = rec.rec_len + sizeof(rec);
+	}
+
 	/* wipe the hashes */
 	for (i=0;i<tdb->header.hash_size;i++) {
 		if (tdb_ofs_write(tdb, TDB_HASH_TOP(i), &offset) == -1) {
@@ -715,19 +761,30 @@ int tdb_wipe_all(struct tdb_context *tdb)
 		goto failed;
 	}
 
-	if (tdb_ofs_write(tdb, TDB_RECOVERY_HEAD, &offset) == -1) {
-		TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to write recovery head\n"));
-		goto failed;		
-	}
-
-	/* add all the rest of the file to the freelist */
-	data_len = (tdb->map_size - TDB_DATA_START(tdb->header.hash_size)) - sizeof(struct list_struct);
-	if (data_len > 0) {
-		struct list_struct rec;
-		memset(&rec,'\0',sizeof(rec));
-		rec.rec_len = data_len;
-		if (tdb_free(tdb, TDB_DATA_START(tdb->header.hash_size), &rec) == -1) {
-			TDB_LOG((tdb, TDB_DEBUG_FATAL,"tdb_wipe_all: failed to add free record\n"));
+	/* add all the rest of the file to the freelist, possibly leaving a gap 
+	   for the recovery area */
+	if (recovery_size == 0) {
+		/* the simple case - the whole file can be used as a freelist */
+		data_len = (tdb->map_size - TDB_DATA_START(tdb->header.hash_size));
+		if (tdb_free_region(tdb, TDB_DATA_START(tdb->header.hash_size), data_len) != 0) {
+			goto failed;
+		}
+	} else {
+		/* we need to add two freelist entries - one on either
+		   side of the recovery area 
+
+		   Note that we cannot shift the recovery area during
+		   this operation. Only the transaction.c code may
+		   move the recovery area or we risk subtle data
+		   corruption
+		*/
+		data_len = (recovery_head - TDB_DATA_START(tdb->header.hash_size));
+		if (tdb_free_region(tdb, TDB_DATA_START(tdb->header.hash_size), data_len) != 0) {
+			goto failed;
+		}
+		/* and the 2nd free list entry after the recovery area - if any */
+		data_len = tdb->map_size - (recovery_head+recovery_size);
+		if (tdb_free_region(tdb, recovery_head+recovery_size, data_len) != 0) {
 			goto failed;
 		}
 	}
diff --git a/source4/lib/tdb/common/transaction.c b/source4/lib/tdb/common/transaction.c
index c3e7a4e2c0..4e2127be64 100644
--- a/source4/lib/tdb/common/transaction.c
+++ b/source4/lib/tdb/common/transaction.c
@@ -321,6 +321,9 @@ static int transaction_write_existing(struct tdb_context *tdb, tdb_off_t off,
 
 	if (blk == tdb->transaction->num_blocks-1 &&
 	    off + len > tdb->transaction->last_block_size) {
+		if (off >= tdb->transaction->last_block_size) {
+			return 0;
+		}
 		len = tdb->transaction->last_block_size - off;
 	}
 
diff --git a/source4/lib/tdb/config.mk b/source4/lib/tdb/config.mk
index c9e5a67d7b..820c55e363 100644
--- a/source4/lib/tdb/config.mk
+++ b/source4/lib/tdb/config.mk
@@ -3,7 +3,7 @@
 [LIBRARY::LIBTDB]
 VERSION = 0.0.1
 SO_VERSION = 0
-DESCRIPTION = Trivial Database Library
+PC_FILE = tdb.pc
 OBJ_FILES = \
 	common/tdb.o common/dump.o common/io.o common/lock.o \
 	common/open.o common/traverse.o common/freelist.o \
diff --git a/source4/lib/tdb/tdb.pc.in b/source4/lib/tdb/tdb.pc.in
index bb440f9cf5..6f8f553736 100644
--- a/source4/lib/tdb/tdb.pc.in
+++ b/source4/lib/tdb/tdb.pc.in
@@ -8,3 +8,4 @@ Description: A trivial database
 Version: @PACKAGE_VERSION@
 Libs: -L${libdir} -ltdb
 Cflags: -I${includedir} 
+URL: http://tdb.samba.org/
diff --git a/source4/lib/util/config.mk b/source4/lib/util/config.mk
index 53a55bf7af..f3e6cd7acf 100644
--- a/source4/lib/util/config.mk
+++ b/source4/lib/util/config.mk
@@ -1,7 +1,6 @@
 [SUBSYSTEM::LIBSAMBA-UTIL]
 #VERSION = 0.0.1
 #SO_VERSION = 0
-#DESCRIPTION = Generic utility functions
 PUBLIC_HEADERS = util.h \
 				 attr.h \
 				 byteorder.h \
diff --git a/source4/lib/util/debug.h b/source4/lib/util/debug.h
index 1895ed53ad..605628174a 100644
--- a/source4/lib/util/debug.h
+++ b/source4/lib/util/debug.h
@@ -41,13 +41,17 @@ struct debug_ops {
 
 extern int DEBUGLEVEL;
 
+#define debug_ctx() (_debug_ctx?_debug_ctx:(_debug_ctx=talloc_new(NULL)))
+
 #define DEBUGLVL(level) ((level) <= DEBUGLEVEL)
 #define _DEBUG(level, body, header) do { \
 	if (DEBUGLVL(level)) { \
+		void* _debug_ctx=NULL; \
 		if (header) { \
 			do_debug_header(level, __location__, __FUNCTION__); \
 		} \
 		do_debug body; \
+		talloc_free(_debug_ctx); \
 	} \
 } while (0)
 /** 
diff --git a/source4/lib/util/time.c b/source4/lib/util/time.c
index fc51498009..a181885806 100644
--- a/source4/lib/util/time.c
+++ b/source4/lib/util/time.c
@@ -612,3 +612,11 @@ _PUBLIC_ int get_time_zone(time_t t)
 		return 0;
 	return tm_diff(&tm_utc,tm);
 }
+
+/**
+  check if 2 NTTIMEs are equal.
+*/
+bool nt_time_equal(NTTIME *t1, NTTIME *t2)
+{
+	return *t1 == *t2;
+}
diff --git a/source4/lib/util/time.h b/source4/lib/util/time.h
index 557c5d4eab..1ab976ca78 100644
--- a/source4/lib/util/time.h
+++ b/source4/lib/util/time.h
@@ -224,6 +224,9 @@ _PUBLIC_ void nttime_to_timeval(struct timeval *tv, NTTIME t);
  */
 _PUBLIC_ int get_time_zone(time_t t);
 
-
+/**
+  check if 2 NTTIMEs are equal.
+*/
+bool nt_time_equal(NTTIME *t1, NTTIME *t2);
 
 #endif /* _SAMBA_TIME_H_ */
diff --git a/source4/libcli/config.mk b/source4/libcli/config.mk
index a538d607bb..cf87e6c045 100644
--- a/source4/libcli/config.mk
+++ b/source4/libcli/config.mk
@@ -39,7 +39,6 @@ OBJ_FILES = nbt/nbtname.o
 [SUBSYSTEM::LIBCLI_NBT]
 #VERSION = 0.0.1
 #SO_VERSION = 0
-#DESCRIPTION = NetBios over TCP/IP client library
 PRIVATE_PROTO_HEADER = nbt/nbt_proto.h
 OBJ_FILES = \
 	nbt/nbtsocket.o \
diff --git a/source4/libnet/libnet_become_dc.c b/source4/libnet/libnet_become_dc.c
index 862631ffa9..c9185c749b 100644
--- a/source4/libnet/libnet_become_dc.c
+++ b/source4/libnet/libnet_become_dc.c
@@ -1514,10 +1514,10 @@ static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
 
 	if (!drsuapi->binding) {
 		if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc", "print", false)) {
-			binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[krb5,print,seal]", s->source_dsa.dns_name);
+			binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[print,seal]", s->source_dsa.dns_name);
 			if (composite_nomem(binding_str, c)) return;
 		} else {
-			binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[krb5,seal]", s->source_dsa.dns_name);
+			binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[seal]", s->source_dsa.dns_name);
 			if (composite_nomem(binding_str, c)) return;
 		}
 		c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
@@ -1687,6 +1687,7 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 	struct drsuapi_DsReplicaObjectIdentifier *identifier;
 	uint32_t num_attrs, i = 0;
 	struct drsuapi_DsReplicaAttribute *attrs;
+	struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(s->libnet->lp_ctx);
 	enum ndr_err_code ndr_err;
 	bool w2k3;
 
@@ -1785,7 +1786,7 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 					       NULL);
 		if (composite_nomem(v, c)) return;
 
-		ndr_err = ndr_push_struct_blob(&vd[0], vd, NULL, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
 			if (!composite_is_ok(c)) return;
@@ -1844,7 +1845,7 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 							  s->forest.schema_dn_str);
 		if (composite_nomem(v[0].dn, c)) return;
 
-		ndr_err = ndr_push_struct_blob(&vd[0], vd, NULL, &v[0], 
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0], 
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
@@ -1874,7 +1875,7 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 
 		v = &s->dest_dsa.invocation_id;
 
-		ndr_err = ndr_push_struct_blob(&vd[0], vd, NULL, v, (ndr_push_flags_fn_t)ndr_push_GUID);
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v, (ndr_push_flags_fn_t)ndr_push_GUID);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
 			if (!composite_is_ok(c)) return;
@@ -1913,21 +1914,21 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[2].sid		= s->zero_sid;
 		v[2].dn			= s->forest.schema_dn_str;
 
-		ndr_err = ndr_push_struct_blob(&vd[0], vd, NULL, &v[0],
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
 			if (!composite_is_ok(c)) return;
 		}
 
-		ndr_err = ndr_push_struct_blob(&vd[1], vd, NULL, &v[1],
+		ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
 			if (!composite_is_ok(c)) return;
 		}
 
-		ndr_err = ndr_push_struct_blob(&vd[2], vd, NULL, &v[2],
+		ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
@@ -1969,21 +1970,21 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[2].sid		= s->zero_sid;
 		v[2].dn			= s->forest.schema_dn_str;
 
-		ndr_err = ndr_push_struct_blob(&vd[0], vd, NULL, &v[0],
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
 			if (!composite_is_ok(c)) return;
 		}
 
-		ndr_err = ndr_push_struct_blob(&vd[1], vd, NULL, &v[1],
+		ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
 			if (!composite_is_ok(c)) return;
 		}
 
-		ndr_err = ndr_push_struct_blob(&vd[2], vd, NULL, &v[2],
+		ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
@@ -2017,7 +2018,7 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[0].sid		= s->zero_sid;
 		v[0].dn			= s->forest.schema_dn_str;
 
-		ndr_err = ndr_push_struct_blob(&vd[0], vd, NULL, &v[0],
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
@@ -2049,7 +2050,7 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[0].sid		= s->zero_sid;
 		v[0].dn			= s->domain.dn_str;
 
-		ndr_err = ndr_push_struct_blob(&vd[0], vd, NULL, &v[0],
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
@@ -2131,7 +2132,7 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[0].sid		= s->zero_sid;
 		v[0].dn			= s->dest_dsa.computer_dn_str;
 
-		ndr_err = ndr_push_struct_blob(&vd[0], vd, NULL, &v[0],
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
 					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
 		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			c->status = ndr_map_error2ntstatus(ndr_err);
diff --git a/source4/librpc/config.mk b/source4/librpc/config.mk
index 4d4167ba04..0f5a65121c 100644
--- a/source4/librpc/config.mk
+++ b/source4/librpc/config.mk
@@ -3,7 +3,7 @@
 [LIBRARY::LIBNDR]
 VERSION = 0.0.1
 SO_VERSION = 0
-DESCRIPTION = Network Data Representation Core Library
+PC_FILE = ndr.pc
 PUBLIC_HEADERS = ndr/libndr.h
 PUBLIC_PROTO_HEADER = ndr/libndr_proto.h
 OBJ_FILES = \
@@ -345,10 +345,10 @@ PUBLIC_DEPENDENCIES = dcerpc NDR_UNIXINFO
 
 [LIBRARY::dcerpc_samr]
 OBJ_FILES = gen_ndr/ndr_samr_c.o
+PC_FILE = dcerpc_samr.pc
 PUBLIC_DEPENDENCIES = dcerpc NDR_SAMR 
 VERSION = 0.0.1
 SO_VERSION = 0
-DESCRIPTION = DCE/RPC client library - SAMR
 
 [SUBSYSTEM::RPC_NDR_SPOOLSS]
 OBJ_FILES = gen_ndr/ndr_spoolss_c.o
@@ -458,7 +458,7 @@ PUBLIC_HEADERS = gen_ndr/dcerpc.h gen_ndr/ndr_dcerpc.h
 [LIBRARY::dcerpc]
 VERSION = 0.0.1
 SO_VERSION = 0
-DESCRIPTION = DCE/RPC client library
+PC_FILE = dcerpc.pc
 PUBLIC_HEADERS = rpc/dcerpc.h \
 			gen_ndr/mgmt.h gen_ndr/ndr_mgmt.h gen_ndr/ndr_mgmt_c.h \
 			gen_ndr/epmapper.h gen_ndr/ndr_epmapper.h gen_ndr/ndr_epmapper_c.h
diff --git a/source4/librpc/dcerpc.pc.in b/source4/librpc/dcerpc.pc.in
new file mode 100644
index 0000000000..3960f2a583
--- /dev/null
+++ b/source4/librpc/dcerpc.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: dcerpc
+Description: DCE/RPC client library
+Requires: ndr
+Version: 0.0.1
+Libs: -L${libdir} -ldcerpc 
+Cflags: -I${includedir} -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/librpc/dcerpc_samr.pc.in b/source4/librpc/dcerpc_samr.pc.in
new file mode 100644
index 0000000000..c4102237d3
--- /dev/null
+++ b/source4/librpc/dcerpc_samr.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: dcerpc_samr
+Description: DCE/RPC client library - SAMR
+Requires.private: dcerpc ndr
+Version: 0.0.1
+Libs: -L${libdir} -ldcerpc_samr 
+Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/librpc/idl/misc.idl b/source4/librpc/idl/misc.idl
index 0861758187..8331977398 100644
--- a/source4/librpc/idl/misc.idl
+++ b/source4/librpc/idl/misc.idl
@@ -51,7 +51,8 @@ interface misc
 
 	/* id used to identify a endpoint, possibly in a cluster */
 	typedef [public] struct {
-		uint32 id;
+		hyper id;
+		uint32 id2;
 		uint32 node;
 	} server_id;
 }
diff --git a/source4/librpc/idl/netlogon.idl b/source4/librpc/idl/netlogon.idl
index dcbb647ba0..d06c2acdd4 100644
--- a/source4/librpc/idl/netlogon.idl
+++ b/source4/librpc/idl/netlogon.idl
@@ -12,13 +12,13 @@ import "lsa.idl", "samr.idl", "security.idl", "nbt.idl";
   uuid("12345678-1234-abcd-ef00-01234567cffb"),
   version(1.0),
   endpoint("ncacn_np:[\\pipe\\netlogon]","ncacn_ip_tcp:","ncalrpc:"),
-  pointer_default(unique),
-  pointer_default_top(unique)
+  pointer_default(unique)
 ]
 
 interface netlogon
 {
 	typedef bitmap samr_AcctFlags samr_AcctFlags;
+	typedef bitmap samr_GroupAttrs samr_GroupAttrs;
 
 	/*****************/
 	/* Function 0x00 */
@@ -43,10 +43,10 @@ interface netlogon
 	} netr_UasInfo;
 
 	WERROR netr_LogonUasLogon(
-		[in]   [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in]   [string,charset(UTF16)] uint16 account_name[],
 		[in]   [string,charset(UTF16)] uint16 workstation[],
-		[out]  netr_UasInfo *info
+		[out,unique] netr_UasInfo *info
 		);
 
 
@@ -59,7 +59,7 @@ interface netlogon
 	} netr_UasLogoffInfo;
 
 	WERROR netr_LogonUasLogoff(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in] [string,charset(UTF16)] uint16 account_name[],
 		[in] [string,charset(UTF16)] uint16 workstation[],
 		[out] netr_UasLogoffInfo info
@@ -86,13 +86,18 @@ interface netlogon
 		[size_is(size/2),length_is(length/2)] uint16 *bindata;
 	} netr_AcctLockStr;
 
-	const int MSV1_0_CLEARTEXT_PASSWORD_ALLOWED = 0x002;
-	const int MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT = 0x020;
-	const int MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT = 0x800;
+	typedef [public,bitmap32bit] bitmap {
+		MSV1_0_CLEARTEXT_PASSWORD_ALLOWED	= 0x00000002,
+		MSV1_0_UPDATE_LOGON_STATISTICS		= 0x00000004,
+		MSV1_0_RETURN_USER_PARAMETERS		= 0x00000008,
+		MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT	= 0x00000020,
+		MSV1_0_RETURN_PROFILE_PATH		= 0x00000200,
+		MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT	= 0x00000800
+	} netr_LogonParameterControl;
 
 	typedef struct {
 		lsa_String  domain_name;
-		uint32      parameter_control; /* see MSV1_0_* */
+		netr_LogonParameterControl parameter_control; /* see MSV1_0_* */
 		uint32      logon_id_low;
 		uint32      logon_id_high;
 		lsa_String  account_name;
@@ -126,11 +131,6 @@ interface netlogon
 		[case(6)] netr_NetworkInfo  *network;
 	} netr_LogonLevel;
 
-	typedef [public] struct {
-		uint32 rid;
-		uint32 attributes;
-	} netr_GroupMembership;
-
 	typedef [public,flag(NDR_PAHEX)] struct {
 		uint8 key[16];
 	} netr_UserSessionKey;
@@ -187,7 +187,7 @@ interface netlogon
 
 	typedef struct {
 		dom_sid2 *sid;
-		uint32 attribute;
+		samr_GroupAttrs attributes;
 	} netr_SidAttr;
 
 	typedef [public] struct {
@@ -239,10 +239,10 @@ interface netlogon
 	} netr_Authenticator;
 
 	NTSTATUS netr_LogonSamLogon(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *computer_name,
-		[in] netr_Authenticator *credential,
-		[in][out] netr_Authenticator *return_authenticator,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *computer_name,
+		[in,unique] netr_Authenticator *credential,
+		[in,out,unique] netr_Authenticator *return_authenticator,
 		[in]  uint16 logon_level,
 		[in]  [switch_is(logon_level)] netr_LogonLevel logon,
 		[in]  uint16 validation_level,
@@ -255,10 +255,10 @@ interface netlogon
 	/* Function 0x03 */
 
 	NTSTATUS netr_LogonSamLogoff(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *computer_name,
-		[in]      netr_Authenticator *credential,
-		[in][out] netr_Authenticator *return_authenticator,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *computer_name,
+		[in,unique] netr_Authenticator *credential,
+		[in,out,unique] netr_Authenticator *return_authenticator,
 		[in] uint16 logon_level,
 		[in] [switch_is(logon_level)] netr_LogonLevel logon
 		);
@@ -269,7 +269,7 @@ interface netlogon
 	/* Function 0x04 */
 
 	[public] NTSTATUS netr_ServerReqChallenge(
-		[in,string,charset(UTF16)] uint16 *server_name,
+		[in,unique,string,charset(UTF16)] uint16 *server_name,
 		[in,string,charset(UTF16)] uint16 computer_name[],
 		[in,out,ref] netr_Credential *credentials
 		);
@@ -281,7 +281,7 @@ interface netlogon
 	typedef enum netr_SchannelType netr_SchannelType;
 
 	NTSTATUS netr_ServerAuthenticate(
-		[in,string,charset(UTF16)] uint16 *server_name,
+		[in,unique,string,charset(UTF16)] uint16 *server_name,
 		[in,string,charset(UTF16)] uint16 account_name[],
 		[in]                       netr_SchannelType secure_channel_type,
 		[in,string,charset(UTF16)] uint16 computer_name[],
@@ -293,7 +293,7 @@ interface netlogon
 	/* Function 0x06 */
 
 	NTSTATUS netr_ServerPasswordSet(
-		[in]  [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in]  [string,charset(UTF16)] uint16 account_name[],
 		[in]  netr_SchannelType secure_channel_type,
 		[in]  [string,charset(UTF16)] uint16 computer_name[],
@@ -684,7 +684,7 @@ interface netlogon
 		[in]      netr_SamDatabaseID database_id,
 		[in,out]  udlong sequence_num,
 		[in]      uint32 preferredmaximumlength,
-		[out]     netr_DELTA_ENUM_ARRAY *delta_enum_array
+		[out,unique] netr_DELTA_ENUM_ARRAY *delta_enum_array
 		);
 
 
@@ -699,7 +699,7 @@ interface netlogon
 		[in]     netr_SamDatabaseID database_id,
 		[in,out] uint32 sync_context,
 		[in]     uint32 preferredmaximumlength,
-		[out]    netr_DELTA_ENUM_ARRAY *delta_enum_array
+		[out,unique] netr_DELTA_ENUM_ARRAY *delta_enum_array
 		);
 
 
@@ -719,7 +719,7 @@ interface netlogon
 	} netr_AccountBuffer;
 
 	NTSTATUS netr_AccountDeltas(
-		[in]     [string,charset(UTF16)] uint16 *logon_server,
+		[in,unique] [string,charset(UTF16)] uint16 *logon_server,
 		[in]     [string,charset(UTF16)] uint16 computername[],
 		[in]     netr_Authenticator credential,
 		[in,out] netr_Authenticator return_authenticator,
@@ -738,7 +738,7 @@ interface netlogon
 	/* Function 0x0A */
 
 	NTSTATUS netr_AccountSync(
-		[in]      [string,charset(UTF16)] uint16 *logon_server,
+		[in,unique] [string,charset(UTF16)] uint16 *logon_server,
 		[in]      [string,charset(UTF16)] uint16 computername[],
 		[in]      netr_Authenticator credential,
 		[in,out]  netr_Authenticator return_authenticator,
@@ -758,8 +758,8 @@ interface netlogon
 
 	WERROR netr_GetDcName(
 		[in]  [string,charset(UTF16)] uint16 logon_server[],
-		[in]  [string,charset(UTF16)] uint16 *domainname,
-		[out] [string,charset(UTF16)] uint16 *dcname
+		[in,unique] [string,charset(UTF16)] uint16 *domainname,
+		[out,unique] [string,charset(UTF16)] uint16 *dcname
 		);
 
 	/*****************/
@@ -802,7 +802,7 @@ interface netlogon
 	} netr_LogonControlCode;
 
 	WERROR netr_LogonControl(
-		[in]   [string,charset(UTF16)] uint16 *logon_server,
+		[in,unique] [string,charset(UTF16)] uint16 *logon_server,
 		[in]   netr_LogonControlCode function_code,
 		[in]   uint32 level,
 		[out,switch_is(level)]  netr_CONTROL_QUERY_INFORMATION info
@@ -813,9 +813,9 @@ interface netlogon
 	/* Function 0x0D */
 
 	WERROR netr_GetAnyDCName(
-		[in]  [string,charset(UTF16)] uint16 *logon_server,
-		[in]  [string,charset(UTF16)] uint16 *domainname,
-		[out] [string,charset(UTF16)] uint16 *dcname
+		[in,unique] [string,charset(UTF16)] uint16 *logon_server,
+		[in,unique] [string,charset(UTF16)] uint16 *domainname,
+		[out,unique] [string,charset(UTF16)] uint16 *dcname
 		);
 
 
@@ -830,7 +830,7 @@ interface netlogon
 	} netr_CONTROL_DATA_INFORMATION;
 
 	WERROR netr_LogonControl2(
-		[in]    [string,charset(UTF16)] uint16 *logon_server,
+		[in,unique] [string,charset(UTF16)] uint16 *logon_server,
 		[in]    uint32 function_code,
 		[in]    uint32 level,
 		[in][switch_is(function_code)] netr_CONTROL_DATA_INFORMATION  data,
@@ -849,7 +849,7 @@ interface netlogon
 	/* Function 0x0F */
 
 	NTSTATUS netr_ServerAuthenticate2(
-		[in]         [string,charset(UTF16)] uint16 *server_name,
+		[in,unique]  [string,charset(UTF16)] uint16 *server_name,
 		[in]         [string,charset(UTF16)] uint16 account_name[],
 		[in]         netr_SchannelType secure_channel_type,
 		[in]         [string,charset(UTF16)] uint16 computer_name[],
@@ -870,7 +870,7 @@ interface netlogon
 		[in]     uint16 restart_state,
 		[in,out] uint32 sync_context,
 		[in]     uint32 preferredmaximumlength,
-		[out]    netr_DELTA_ENUM_ARRAY *delta_enum_array
+		[out,unique] netr_DELTA_ENUM_ARRAY *delta_enum_array
 		);
 
 
@@ -884,9 +884,9 @@ interface netlogon
 		[in]     [string,charset(UTF16)] uint16 computername[],
 		[in]     netr_Authenticator credential,
 		[in,out] netr_Authenticator return_authenticator,
-		[in][size_is(change_log_entry_size)] uint8 *change_log_entry,
+		[in,unique][size_is(change_log_entry_size)] uint8 *change_log_entry,
 		[in]     uint32 change_log_entry_size,
-		[out]    netr_DELTA_ENUM_ARRAY *delta_enum_array
+		[out,unique]    netr_DELTA_ENUM_ARRAY *delta_enum_array
 		);
 
 
@@ -894,7 +894,7 @@ interface netlogon
 	/* Function 0x12 */
 
 	WERROR netr_LogonControl2Ex(
-		[in]   [string,charset(UTF16)] uint16 *logon_server,
+		[in,unique] [string,charset(UTF16)] uint16 *logon_server,
 		[in]   uint32 function_code,
 		[in]   uint32 level,
 		[in][switch_is(function_code)] netr_CONTROL_DATA_INFORMATION  data,
@@ -909,7 +909,7 @@ interface netlogon
 	} netr_Blob;
 
 	WERROR netr_NetrEnumerateTrustedDomains(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[out,ref] netr_Blob *trusted_domains_blob
 		);
 
@@ -973,12 +973,12 @@ interface netlogon
 	} netr_DsRGetDCNameInfo;
 
 	WERROR netr_DsRGetDCName(
-		[in] [string,charset(UTF16)] uint16 *server_unc,
-		[in] [string,charset(UTF16)] uint16 *domain_name,
-		[in] GUID *domain_guid,
-		[in] GUID *site_guid,
+		[in,unique] [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique] [string,charset(UTF16)] uint16 *domain_name,
+		[in,unique] GUID *domain_guid,
+		[in,unique] GUID *site_guid,
 		[in] netr_DsRGetDCName_flags flags,
-		[out] netr_DsRGetDCNameInfo *info
+		[out,unique] netr_DsRGetDCNameInfo *info
 		);
 
 	/*****************/
@@ -991,7 +991,11 @@ interface netlogon
 
 	/****************/
 	/* Function 0x17 */
-	WERROR netr_NETRLOGONGETTRUSTRID();
+	WERROR netr_LogonGetTrustRid(
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *domain_name,
+		[out,ref] uint32 *rid
+	);
 
 	/****************/
 	/* Function 0x18 */
@@ -1004,7 +1008,7 @@ interface netlogon
 	/****************/
 	/* Function 0x1a */
 	[public] NTSTATUS netr_ServerAuthenticate3(
-		[in]         [string,charset(UTF16)] uint16 *server_name,
+		[in,unique]         [string,charset(UTF16)] uint16 *server_name,
 		[in]         [string,charset(UTF16)] uint16 account_name[],
 		[in]         netr_SchannelType secure_channel_type,
 		[in]         [string,charset(UTF16)] uint16 computer_name[],
@@ -1017,19 +1021,19 @@ interface netlogon
 	/* Function 0x1b */
 
 	WERROR netr_DsRGetDCNameEx(
-		[in] [string,charset(UTF16)] uint16 *server_unc,
-		[in] [string,charset(UTF16)] uint16 *domain_name,
-		[in] GUID *domain_guid,
-		[in] [string,charset(UTF16)] uint16 *site_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique] [string,charset(UTF16)] uint16 *domain_name,
+		[in,unique] GUID *domain_guid,
+		[in,unique] [string,charset(UTF16)] uint16 *site_name,
 		[in] netr_DsRGetDCName_flags flags,
-		[out] netr_DsRGetDCNameInfo *info
+		[out,unique] netr_DsRGetDCNameInfo *info
 		);
 
 	/****************/
 	/* Function 0x1c */
 	WERROR netr_DsRGetSiteName(
-		[in] [string,charset(UTF16)] uint16 *computer_name,
-		[out] [string,charset(UTF16)] uint16 *site
+		[in,unique] [string,charset(UTF16)] uint16 *computer_name,
+		[out,unique] [string,charset(UTF16)] uint16 *site
 		);
 
 	/****************/
@@ -1085,7 +1089,7 @@ interface netlogon
 	
 	NTSTATUS netr_LogonGetDomainInfo(
 		[in]         [string,charset(UTF16)] uint16 server_name[],
-		[in]         [string,charset(UTF16)] uint16 *computer_name,
+		[in,unique]  [string,charset(UTF16)] uint16 *computer_name,
 		[in,ref]     netr_Authenticator *credential,
 		[in,out,ref] netr_Authenticator *return_authenticator,
 		[in]	     uint32 level,
@@ -1101,7 +1105,7 @@ interface netlogon
 	/*****************/
 	/* Function 0x1e */
 	NTSTATUS netr_ServerPasswordSet2(
-		[in]  [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in]  [string,charset(UTF16)] uint16 account_name[],
 		[in]  netr_SchannelType secure_channel_type,
 		[in]  [string,charset(UTF16)] uint16 computer_name[],
@@ -1113,7 +1117,7 @@ interface netlogon
 	/****************/
 	/* Function 0x1f */
 	WERROR netr_ServerPasswordGet(
-		[in]  [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in]  [string,charset(UTF16)] uint16 account_name[],
 		[in]  netr_SchannelType secure_channel_type,
 		[in]  [string,charset(UTF16)] uint16 computer_name[],
@@ -1139,7 +1143,7 @@ interface netlogon
 	} netr_DsRAddress;
 
 	WERROR netr_DsRAddressToSitenamesW(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in] [range(0,32000)] uint32 count,
 		[in] [size_is(count)] [ref] netr_DsRAddress *addresses,
 		[out] [ref] netr_DsRAddressToSitenamesWCtr **ctr
@@ -1148,14 +1152,14 @@ interface netlogon
 	/****************/
 	/* Function 0x22 */
 	WERROR netr_DsRGetDCNameEx2(
-		[in] [string,charset(UTF16)] uint16 *server_unc,
-		[in] [string,charset(UTF16)] uint16 *client_account,
+		[in,unique] [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique] [string,charset(UTF16)] uint16 *client_account,
 		[in] samr_AcctFlags mask,
-		[in] [string,charset(UTF16)] uint16 *domain_name,
-		[in] GUID *domain_guid,
-		[in] [string,charset(UTF16)] uint16 *site_name,
+		[in,unique] [string,charset(UTF16)] uint16 *domain_name,
+		[in,unique] GUID *domain_guid,
+		[in,unique] [string,charset(UTF16)] uint16 *site_name,
 		[in] netr_DsRGetDCName_flags flags,
-		[out] netr_DsRGetDCNameInfo *info
+		[out,unique] netr_DsRGetDCNameInfo *info
 		);
 
 	/****************/
@@ -1207,7 +1211,7 @@ interface netlogon
         } netr_DomainTrustList;
 
 	WERROR netr_NetrEnumerateTrustedDomainsEx(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[out,ref] netr_DomainTrustList *dom_trust_list
 	);
 
@@ -1220,7 +1224,7 @@ interface netlogon
 	} netr_DsRAddressToSitenamesExWCtr;
 
 	WERROR netr_DsRAddressToSitenamesExW(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in] [range(0,32000)] uint32 count,
 		[in] [size_is(count)] [ref] netr_DsRAddress *addresses,
 		[out] [ref] netr_DsRAddressToSitenamesExWCtr **ctr
@@ -1235,15 +1239,15 @@ interface netlogon
 	} DcSitesCtr;
 
 	WERROR netr_DsrGetDcSiteCoverageW(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[out] DcSitesCtr *ctr
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[out,unique] DcSitesCtr *ctr
 		);
 
 	/****************/
 	/* Function 0x27 */
 	NTSTATUS netr_LogonSamLogonEx(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *computer_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *computer_name,
 		[in]  uint16 logon_level,
 		[in]  [switch_is(logon_level)] netr_LogonLevel logon,
 		[in]  uint16 validation_level,
@@ -1256,21 +1260,27 @@ interface netlogon
 	/* Function 0x28 */
 
 	WERROR netr_DsrEnumerateDomainTrusts(
-		[in]                 [string,charset(UTF16)] uint16           *server_name,
+		[in,unique]          [string,charset(UTF16)] uint16           *server_name,
 		[in]                 netr_TrustFlags  trust_flags,
 		[out]                uint32           count,
-		[out,size_is(count)] netr_DomainTrust *trusts
+		[out,unique,size_is(count)] netr_DomainTrust *trusts
 		);
 
 
 	/****************/
 	/* Function 0x29 */
-	WERROR netr_DSRDEREGISTERDNSHOSTRECORDS();
+	WERROR netr_DsrDeregisterDNSHostRecords(
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *domain,
+		[in,unique] GUID *domain_guid,
+		[in,unique] GUID *dsa_guid,
+		[in,ref] [string,charset(UTF16)] uint16 *dns_host
+		);
 
 	/****************/
 	/* Function 0x2a */
 	NTSTATUS netr_ServerTrustPasswordsGet(
-		[in]  [string,charset(UTF16)] uint16 *server_name,
+		[in,unique]  [string,charset(UTF16)] uint16 *server_name,
 		[in]  [string,charset(UTF16)] uint16 account_name[],
 		[in]  netr_SchannelType secure_channel_type,
 		[in]  [string,charset(UTF16)] uint16 computer_name[],
@@ -1286,8 +1296,8 @@ interface netlogon
 	const int DS_GFTI_UPDATE_TDO = 0x1;
 
 	WERROR netr_DsRGetForestTrustInformation(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *trusted_domain_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *trusted_domain_name,
 		[in] uint32 flags,
 		[out,ref] lsa_ForestTrustInformation **forest_trust_info
 		);
@@ -1295,7 +1305,7 @@ interface netlogon
 	/****************/
 	/* Function 0x2c */
 	WERROR netr_GetForestTrustInformation(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,ref] [string,charset(UTF16)] uint16 *trusted_domain_name,
 		[in,ref] netr_Authenticator *credential,
 		[out,ref] netr_Authenticator *return_authenticator,
@@ -1308,10 +1318,10 @@ interface netlogon
 
 	/* this is the ADS varient. I don't yet know what the "flags" are for */
 	NTSTATUS netr_LogonSamLogonWithFlags(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *computer_name,
-		[in] netr_Authenticator *credential,
-		[in][out] netr_Authenticator *return_authenticator,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *computer_name,
+		[in,unique] netr_Authenticator *credential,
+		[in,out,unique] netr_Authenticator *return_authenticator,
 		[in]  uint16 logon_level,
 		[in]  [switch_is(logon_level)] netr_LogonLevel logon,
 		[in]  uint16 validation_level,
diff --git a/source4/librpc/idl/samr.idl b/source4/librpc/idl/samr.idl
index b6d2b9f941..2dc33fa9b9 100644
--- a/source4/librpc/idl/samr.idl
+++ b/source4/librpc/idl/samr.idl
@@ -12,8 +12,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 [ uuid("12345778-1234-abcd-ef00-0123456789ac"),
   version(1.0),
   endpoint("ncacn_np:[\\pipe\\samr]","ncacn_ip_tcp:", "ncalrpc:"),
-  pointer_default(unique),
-  pointer_default_top(unique)
+  pointer_default(unique)
 ] interface samr
 {
 	typedef bitmap security_secinfo security_secinfo;
@@ -51,54 +50,54 @@ import "misc.idl", "lsa.idl", "security.idl";
 	} samr_ConnectAccessMask;
 
 	typedef [bitmap32bit] bitmap {
-		USER_ACCESS_GET_NAME_ETC             = 0x00000001,
-		USER_ACCESS_GET_LOCALE               = 0x00000002,
-		USER_ACCESS_SET_LOC_COM              = 0x00000004,
-		USER_ACCESS_GET_LOGONINFO            = 0x00000008,
-		USER_ACCESS_GET_ATTRIBUTES           = 0x00000010,
-		USER_ACCESS_SET_ATTRIBUTES           = 0x00000020,
-		USER_ACCESS_CHANGE_PASSWORD          = 0x00000040,
-		USER_ACCESS_SET_PASSWORD             = 0x00000080,
-		USER_ACCESS_GET_GROUPS               = 0x00000100,
-		USER_ACCESS_GET_GROUP_MEMBERSHIP     = 0x00000200,
-		USER_ACCESS_CHANGE_GROUP_MEMBERSHIP  = 0x00000400
+		SAMR_USER_ACCESS_GET_NAME_ETC             = 0x00000001,
+		SAMR_USER_ACCESS_GET_LOCALE               = 0x00000002,
+		SAMR_USER_ACCESS_SET_LOC_COM              = 0x00000004,
+		SAMR_USER_ACCESS_GET_LOGONINFO            = 0x00000008,
+		SAMR_USER_ACCESS_GET_ATTRIBUTES           = 0x00000010,
+		SAMR_USER_ACCESS_SET_ATTRIBUTES           = 0x00000020,
+		SAMR_USER_ACCESS_CHANGE_PASSWORD          = 0x00000040,
+		SAMR_USER_ACCESS_SET_PASSWORD             = 0x00000080,
+		SAMR_USER_ACCESS_GET_GROUPS               = 0x00000100,
+		SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP     = 0x00000200,
+		SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP  = 0x00000400
 	} samr_UserAccessMask;
 
 	typedef [bitmap32bit] bitmap {
-		DOMAIN_ACCESS_LOOKUP_INFO_1  = 0x00000001,
-		DOMAIN_ACCESS_SET_INFO_1     = 0x00000002,
-		DOMAIN_ACCESS_LOOKUP_INFO_2  = 0x00000004,
-		DOMAIN_ACCESS_SET_INFO_2     = 0x00000008,
-		DOMAIN_ACCESS_CREATE_USER    = 0x00000010,
-		DOMAIN_ACCESS_CREATE_GROUP   = 0x00000020,
-		DOMAIN_ACCESS_CREATE_ALIAS   = 0x00000040,
-		DOMAIN_ACCESS_LOOKUP_ALIAS   = 0x00000080,
-		DOMAIN_ACCESS_ENUM_ACCOUNTS  = 0x00000100,
-		DOMAIN_ACCESS_OPEN_ACCOUNT   = 0x00000200,
-		DOMAIN_ACCESS_SET_INFO_3     = 0x00000400
+		SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1  = 0x00000001,
+		SAMR_DOMAIN_ACCESS_SET_INFO_1     = 0x00000002,
+		SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2  = 0x00000004,
+		SAMR_DOMAIN_ACCESS_SET_INFO_2     = 0x00000008,
+		SAMR_DOMAIN_ACCESS_CREATE_USER    = 0x00000010,
+		SAMR_DOMAIN_ACCESS_CREATE_GROUP   = 0x00000020,
+		SAMR_DOMAIN_ACCESS_CREATE_ALIAS   = 0x00000040,
+		SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS   = 0x00000080,
+		SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS  = 0x00000100,
+		SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT   = 0x00000200,
+		SAMR_DOMAIN_ACCESS_SET_INFO_3     = 0x00000400
 	} samr_DomainAccessMask;
 
 	typedef [bitmap32bit] bitmap {
-		GROUP_ACCESS_LOOKUP_INFO     = 0x00000001,
-		GROUP_ACCESS_SET_INFO        = 0x00000002,
-		GROUP_ACCESS_ADD_MEMBER      = 0x00000004,
-		GROUP_ACCESS_REMOVE_MEMBER   = 0x00000008,
-		GROUP_ACCESS_GET_MEMBERS     = 0x00000010
+		SAMR_GROUP_ACCESS_LOOKUP_INFO     = 0x00000001,
+		SAMR_GROUP_ACCESS_SET_INFO        = 0x00000002,
+		SAMR_GROUP_ACCESS_ADD_MEMBER      = 0x00000004,
+		SAMR_GROUP_ACCESS_REMOVE_MEMBER   = 0x00000008,
+		SAMR_GROUP_ACCESS_GET_MEMBERS     = 0x00000010
 	} samr_GroupAccessMask;
 
 	typedef [bitmap32bit] bitmap {
-		ALIAS_ACCESS_ADD_MEMBER      = 0x00000001,
-		ALIAS_ACCESS_REMOVE_MEMBER   = 0x00000002,
-		ALIAS_ACCESS_GET_MEMBERS     = 0x00000004,
-		ALIAS_ACCESS_LOOKUP_INFO     = 0x00000008,
-		ALIAS_ACCESS_SET_INFO        = 0x00000010
+		SAMR_ALIAS_ACCESS_ADD_MEMBER      = 0x00000001,
+		SAMR_ALIAS_ACCESS_REMOVE_MEMBER   = 0x00000002,
+		SAMR_ALIAS_ACCESS_GET_MEMBERS     = 0x00000004,
+		SAMR_ALIAS_ACCESS_LOOKUP_INFO     = 0x00000008,
+		SAMR_ALIAS_ACCESS_SET_INFO        = 0x00000010
 	} samr_AliasAccessMask;
 
 	/******************/
 	/* Function: 0x00 */
 	NTSTATUS samr_Connect (
 		/* notice the lack of [string] */
-		[in]       uint16 *system_name,
+		[in,unique] uint16 *system_name,
 		[in]       samr_ConnectAccessMask access_mask,
 		[out,ref]  policy_handle *connect_handle
 		);
@@ -125,7 +124,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_QuerySecurity (
 		[in,ref]          policy_handle *handle,
 		[in]              security_secinfo sec_info,
-		[out]             sec_desc_buf *sdbuf
+		[out,unique]      sec_desc_buf *sdbuf
 		);
 
 	/******************/
@@ -143,7 +142,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_LookupDomain (
 		[in,ref]  policy_handle *connect_handle,		
 		[in,ref]  lsa_String *domain_name,
-		[out]     dom_sid2 *sid
+		[out,unique] dom_sid2 *sid
 		);
 
 
@@ -164,7 +163,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 		[in,ref]      policy_handle *connect_handle,
 		[in,out,ref]  uint32 *resume_handle,
 		[in]          uint32 buf_size,
-		[out]         samr_SamArray *sam,
+		[out,unique]  samr_SamArray *sam,
 		[out]         uint32 num_entries
 		);
 
@@ -288,7 +287,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_QueryDomainInfo(
 		[in,ref]      policy_handle *domain_handle,
 		[in]          uint16 level,
-		[out,switch_is(level)] samr_DomainInfo *info
+		[out,switch_is(level),unique] samr_DomainInfo *info
 		);
 
 	/************************/
@@ -321,7 +320,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 		[in,ref]      policy_handle *domain_handle,
 		[in,out,ref]  uint32 *resume_handle,
 		[in]          uint32 max_size,
-		[out]         samr_SamArray *sam,
+		[out,unique]  samr_SamArray *sam,
 		[out]         uint32 num_entries
 		);
 
@@ -349,7 +348,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 		[in,out,ref]  uint32 *resume_handle,
 		[in]          samr_AcctFlags acct_flags,
 		[in]          uint32 max_size,
-		[out]         samr_SamArray *sam,
+		[out,unique]  samr_SamArray *sam,
 		[out]         uint32 num_entries
 		);
 
@@ -369,7 +368,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 		[in,ref]      policy_handle *domain_handle,
 		[in,out,ref]  uint32 *resume_handle,
 		[in]          samr_AcctFlags acct_flags,
-		[out]         samr_SamArray *sam,
+		[out,unique]  samr_SamArray *sam,
 		[out]         uint32 num_entries
 		);
 
@@ -466,7 +465,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_QueryGroupInfo(
 		[in,ref]                  policy_handle *group_handle,
 		[in]                      samr_GroupInfoEnum level,
-		[out,switch_is(level)]    samr_GroupInfo *info
+		[out,switch_is(level),unique] samr_GroupInfo *info
 		);
 
 	/************************/
@@ -509,7 +508,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 
 	NTSTATUS samr_QueryGroupMember(
 		[in,ref]  policy_handle *group_handle,
-		[out]     samr_RidTypeArray *rids
+		[out,unique] samr_RidTypeArray *rids
 		);
 
 
@@ -563,7 +562,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_QueryAliasInfo(
 		[in,ref]                  policy_handle  *alias_handle,
 		[in]                      samr_AliasInfoEnum      level,
-		[out,switch_is(level)]    samr_AliasInfo *info
+		[out,switch_is(level),unique] samr_AliasInfo *info
 		);
 
 	/************************/
@@ -862,7 +861,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	[public] NTSTATUS samr_QueryUserInfo(
 		[in,ref]                  policy_handle *user_handle,
 		[in]                      uint16 level,
-		[out,switch_is(level)]    samr_UserInfo *info
+		[out,unique,switch_is(level)] samr_UserInfo *info
 		);
 
 
@@ -887,15 +886,15 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_ChangePasswordUser(
 		[in,ref]    policy_handle *user_handle,
 		[in]        boolean8 lm_present,
-		[in]        samr_Password *old_lm_crypted,
-		[in]        samr_Password *new_lm_crypted,
+		[in,unique] samr_Password *old_lm_crypted,
+		[in,unique] samr_Password *new_lm_crypted,
 		[in]        boolean8 nt_present,
-		[in]        samr_Password *old_nt_crypted,
-		[in]        samr_Password *new_nt_crypted,
+		[in,unique] samr_Password *old_nt_crypted,
+		[in,unique] samr_Password *new_nt_crypted,
 		[in]        boolean8 cross1_present,
-		[in]        samr_Password *nt_cross,
+		[in,unique] samr_Password *nt_cross,
 		[in]        boolean8 cross2_present,
-		[in]        samr_Password *lm_cross
+		[in,unique] samr_Password *lm_cross
 		);
 
 	/************************/
@@ -913,7 +912,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 
 	NTSTATUS samr_GetGroupsForUser(
 		[in,ref]   policy_handle *user_handle,
-		[out]      samr_RidWithAttributeArray  *rids
+		[out,unique] samr_RidWithAttributeArray  *rids
 		);
 
 	/************************/
@@ -1061,7 +1060,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_QueryDomainInfo2(
 		[in,ref]      policy_handle *domain_handle,
 		[in]          uint16 level,
-		[out,switch_is(level)] samr_DomainInfo *info
+		[out,unique,switch_is(level)] samr_DomainInfo *info
 		);
 
 	/************************/
@@ -1073,7 +1072,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_QueryUserInfo2(
 		[in,ref]                  policy_handle *user_handle,
 		[in]                      uint16 level,
-		[out,switch_is(level)]    samr_UserInfo *info
+		[out,unique,switch_is(level)]    samr_UserInfo *info
 		);
 
 	/************************/
@@ -1155,35 +1154,35 @@ import "misc.idl", "lsa.idl", "security.idl";
 	/* Function    0x36     */
 
 	NTSTATUS samr_OemChangePasswordUser2(
-		[in]              lsa_AsciiString *server,
+		[in,unique]       lsa_AsciiString *server,
 		[in,ref]          lsa_AsciiString *account,
-		[in]              samr_CryptPassword *password,
-		[in]              samr_Password *hash
+		[in,unique]       samr_CryptPassword *password,
+		[in,unique]       samr_Password *hash
 		);
 
 	/************************/
 	/* Function    0x37     */
 	NTSTATUS samr_ChangePasswordUser2(
-		[in]              lsa_String *server,
+		[in,unique]       lsa_String *server,
 		[in,ref]          lsa_String *account,
-		[in]              samr_CryptPassword *nt_password,
-		[in]              samr_Password *nt_verifier,
+		[in,unique]       samr_CryptPassword *nt_password,
+		[in,unique]       samr_Password *nt_verifier,
 		[in]              boolean8 lm_change,
-		[in]              samr_CryptPassword *lm_password,
-		[in]              samr_Password *lm_verifier
+		[in,unique]       samr_CryptPassword *lm_password,
+		[in,unique]       samr_Password *lm_verifier
 		);
 
 	/************************/
 	/* Function    0x38     */
 	NTSTATUS samr_GetDomPwInfo(
-		[in]        lsa_String *domain_name,
+		[in,unique] lsa_String *domain_name,
 		[out]       samr_PwInfo info
 		);
 
 	/************************/
 	/* Function    0x39     */
 	NTSTATUS samr_Connect2(
-		[in,string,charset(UTF16)] uint16 *system_name,
+		[in,unique,string,charset(UTF16)] uint16 *system_name,
 		[in] samr_ConnectAccessMask access_mask,
 		[out,ref]  policy_handle *connect_handle
 		);
@@ -1221,7 +1220,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	/************************/
 	/* Function    0x3d     */
 	NTSTATUS samr_Connect3(
-		[in,string,charset(UTF16)] uint16 *system_name,
+		[in,unique,string,charset(UTF16)] uint16 *system_name,
 		/* this unknown value seems to be completely ignored by w2k3 */
 		[in] uint32 unknown,
 		[in] samr_ConnectAccessMask access_mask,
@@ -1231,7 +1230,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	/************************/
 	/* Function    0x3e     */
 	NTSTATUS samr_Connect4(
-		[in,string,charset(UTF16)] uint16 *system_name,
+		[in,unique,string,charset(UTF16)] uint16 *system_name,
 		[in] uint32 unknown,
 		[in] samr_ConnectAccessMask access_mask,
 		[out,ref]  policy_handle *connect_handle
@@ -1249,16 +1248,16 @@ import "misc.idl", "lsa.idl", "security.idl";
 	} samr_ChangeReject;
 
 	NTSTATUS samr_ChangePasswordUser3(
-		[in]              lsa_String *server,
+		[in,unique]       lsa_String *server,
 		[in,ref]          lsa_String *account,
-		[in]              samr_CryptPassword *nt_password,
-		[in]              samr_Password *nt_verifier,
+		[in,unique]       samr_CryptPassword *nt_password,
+		[in,unique]       samr_Password *nt_verifier,
 		[in]              boolean8 lm_change,
-		[in]              samr_CryptPassword *lm_password,
-		[in]              samr_Password *lm_verifier,
-		[in]              samr_CryptPassword *password3,
-		[out]             samr_DomInfo1 *dominfo,
-		[out]             samr_ChangeReject *reject
+		[in,unique]       samr_CryptPassword *lm_password,
+		[in,unique]       samr_Password *lm_verifier,
+		[in,unique]       samr_CryptPassword *password3,
+		[out,unique]      samr_DomInfo1 *dominfo,
+		[out,unique]      samr_ChangeReject *reject
 		);
 
 	/************************/
@@ -1274,7 +1273,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	} samr_ConnectInfo;
 
 	[public] NTSTATUS samr_Connect5(
-		[in,string,charset(UTF16)] uint16 *system_name,
+		[in,unique,string,charset(UTF16)] uint16 *system_name,
 		[in]       samr_ConnectAccessMask  access_mask,
 		[in,out]   uint32             level,
 		[in,out,switch_is(level),ref] samr_ConnectInfo *info,
@@ -1286,7 +1285,7 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_RidToSid(
 		[in,ref]    policy_handle *domain_handle,
 		[in]        uint32        rid,
-		[out]       dom_sid2      *sid
+		[out,unique] dom_sid2      *sid
 		);
 
 
@@ -1300,9 +1299,9 @@ import "misc.idl", "lsa.idl", "security.idl";
 	*/
 
 	NTSTATUS samr_SetDsrmPassword(
-		[in]       lsa_String *name,
+		[in,unique] lsa_String *name,
 		[in]       uint32 unknown,
-		[in]       samr_Password *hash
+		[in,unique] samr_Password *hash
 		);
 
 
@@ -1401,6 +1400,6 @@ import "misc.idl", "lsa.idl", "security.idl";
 	NTSTATUS samr_ValidatePassword(
 		[in] samr_ValidatePasswordLevel level,
 		[in,switch_is(level)] samr_ValidatePasswordReq req,
-		[out,switch_is(level)] samr_ValidatePasswordRep *rep
+		[out,unique,switch_is(level)] samr_ValidatePasswordRep *rep
 		);
 }
diff --git a/source4/librpc/idl/spoolss.idl b/source4/librpc/idl/spoolss.idl
index 7d40861a52..114c06a00d 100644
--- a/source4/librpc/idl/spoolss.idl
+++ b/source4/librpc/idl/spoolss.idl
@@ -9,7 +9,6 @@ import "security.idl", "winreg.idl";
   version(1.0),
   endpoint("ncacn_np:[\\pipe\\spoolss]"),
   pointer_default(unique),
-  pointer_default_top(unique),
   helpstring("Spooler SubSystem"),
   helper("librpc/ndr/ndr_spoolss_buf.h")
 ] interface spoolss
@@ -254,11 +253,11 @@ import "security.idl", "winreg.idl";
 	/* we are using this as internal parsing code */
 	[public,noopnum,noprint] WERROR _spoolss_EnumPrinters(
 		[in] spoolss_EnumPrinterFlags flags,
-		[in] [string,charset(UTF16)] uint16 *server,
+		[in,unique] [string,charset(UTF16)] uint16 *server,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out] DATA_BLOB *info,
+		[out,unique] DATA_BLOB *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -269,14 +268,14 @@ import "security.idl", "winreg.idl";
 	);
 	[nopull,nopush] WERROR spoolss_EnumPrinters(
 		[in] spoolss_EnumPrinterFlags flags,
-		[in] [string,charset(UTF16)] uint16 *server,
+		[in,unique] [string,charset(UTF16)] uint16 *server,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
 		/* what we have here is a subcontext containing an array of no discriminant unions
 		 * and the array has no size in front
 		 */
-		[out,switch_is(level),size_is(count)] spoolss_PrinterInfo *info,
+		[out,unique,switch_is(level),size_is(count)] spoolss_PrinterInfo *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -289,8 +288,8 @@ import "security.idl", "winreg.idl";
 	} spoolss_DevmodeContainer;
 
 	[public] WERROR spoolss_OpenPrinter(
-		[in] [string,charset(UTF16)] uint16 *printername,
-		[in] [string,charset(UTF16)] uint16 *datatype,
+		[in,unique] [string,charset(UTF16)] uint16 *printername,
+		[in,unique] [string,charset(UTF16)] uint16 *datatype,
 		[in] spoolss_DevmodeContainer devmode_ctr,
 		[in] uint32 access_mask,
 		[out,ref] policy_handle *handle
@@ -339,7 +338,7 @@ import "security.idl", "winreg.idl";
 	WERROR spoolss_SetJob(
 		[in,ref] policy_handle *handle,
 		[in] uint32 job_id,
-		[in] spoolss_JobInfoContainer *ctr,
+		[in,unique] spoolss_JobInfoContainer *ctr,
 		[in] spoolss_JobControl command
 	);
 
@@ -349,9 +348,9 @@ import "security.idl", "winreg.idl";
 		[in,ref] policy_handle *handle,
 		[in] 	 uint32 job_id,
 		[in] 	 uint32 level,
-		[in] 	 DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] 	 uint32 offered,
-		[out,subcontext(4),subcontext_size(offered),switch_is(level)] spoolss_JobInfo *info,
+		[out,unique,subcontext(4),subcontext_size(offered),switch_is(level)] spoolss_JobInfo *info,
 		[out] 	 uint32 needed
 	);
 
@@ -362,9 +361,9 @@ import "security.idl", "winreg.idl";
 		[in] 	 uint32 firstjob,
 		[in] 	 uint32 numjobs,
 		[in] 	 uint32 level,
-		[in] 	 DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] 	 uint32 offered,
-		[out] 	 DATA_BLOB *info,
+		[out,unique] DATA_BLOB *info,
 		[out] 	 uint32 needed,
 		[out] 	 uint32 count
 	);
@@ -378,9 +377,9 @@ import "security.idl", "winreg.idl";
 		[in]	 uint32 firstjob,
 		[in]	 uint32 numjobs,
 		[in]	 uint32 level,
-		[in]     DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] 	 uint32 offered,
-		[out,switch_is(level),size_is(count)] spoolss_JobInfo *info,
+		[out,unique,switch_is(level),size_is(count)] spoolss_JobInfo *info,
 		[out] 	 uint32 needed,
 		[out]	 uint32 count
 	);
@@ -435,9 +434,9 @@ import "security.idl", "winreg.idl";
 	[public] WERROR spoolss_GetPrinter(
 		[in,ref] policy_handle *handle,
 		[in] 	 uint32 level,
-		[in] 	 DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] 	 uint32 offered,
-		[out,subcontext(4),subcontext_size(offered),switch_is(level)] spoolss_PrinterInfo *info,
+		[out,unique,subcontext(4),subcontext_size(offered),switch_is(level)] spoolss_PrinterInfo *info,
 		[out] 	 uint32 needed
 	);
 
@@ -538,12 +537,12 @@ import "security.idl", "winreg.idl";
 	/******************/
 	/* Function: 0x0a */
 	[public,noopnum,noprint] WERROR _spoolss_EnumPrinterDrivers(
-		[in] [string,charset(UTF16)] uint16 *server,
-		[in] [string,charset(UTF16)] uint16 *environment,
+		[in,unique] [string,charset(UTF16)] uint16 *server,
+		[in,unique] [string,charset(UTF16)] uint16 *environment,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out] DATA_BLOB *info,
+		[out,unique] DATA_BLOB *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -553,12 +552,12 @@ import "security.idl", "winreg.idl";
 		[out,switch_is(level)] spoolss_DriverInfo info[count]
 	);
 	[nopull,nopush] WERROR spoolss_EnumPrinterDrivers(
-		[in] [string,charset(UTF16)] uint16 *server,
-		[in] [string,charset(UTF16)] uint16 *environment,
+		[in,unique] [string,charset(UTF16)] uint16 *server,
+		[in,unique] [string,charset(UTF16)] uint16 *environment,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out,switch_is(level),size_is(count)] spoolss_DriverInfo *info,
+		[out,unique,switch_is(level),size_is(count)] spoolss_DriverInfo *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -583,12 +582,12 @@ import "security.idl", "winreg.idl";
 	} spoolss_DriverDirectoryInfo;
 
 	[public] WERROR spoolss_GetPrinterDriverDirectory(
-		[in] [string,charset(UTF16)] uint16 *server,
-		[in] [string,charset(UTF16)] uint16 *environment,
+		[in,unique] [string,charset(UTF16)] uint16 *server,
+		[in,unique] [string,charset(UTF16)] uint16 *environment,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out,subcontext(4),subcontext_size(offered),switch_is(level)] spoolss_DriverDirectoryInfo *info,
+		[out,unique,subcontext(4),subcontext_size(offered),switch_is(level)] spoolss_DriverDirectoryInfo *info,
 		[out] uint32 needed
 	);
 
@@ -596,7 +595,7 @@ import "security.idl", "winreg.idl";
 	/* Function: 0x0d */
 	WERROR spoolss_DeletePrinterDriver(
 		[in,ref] policy_handle *handle,
-		[in] [string,charset(UTF16)] uint16 *server,
+		[in,unique] [string,charset(UTF16)] uint16 *server,
 		[in] [string,charset(UTF16)] uint16 architecture[],
 		[in] [string,charset(UTF16)] uint16 driver[]
 	);
@@ -618,12 +617,12 @@ import "security.idl", "winreg.idl";
 	} spoolss_PrintProcessorInfo;
 
 	[public,noopnum,noprint] WERROR _spoolss_EnumPrintProcessors(
-		[in] [string,charset(UTF16)] uint16 *servername,
-		[in] [string,charset(UTF16)] uint16 *environment,
+		[in,unique] [string,charset(UTF16)] uint16 *servername,
+		[in,unique] [string,charset(UTF16)] uint16 *environment,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out] DATA_BLOB *info,
+		[out,unique] DATA_BLOB *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -633,12 +632,12 @@ import "security.idl", "winreg.idl";
 		[out,switch_is(level)] spoolss_PrintProcessorInfo info[count]
 	);
 	[nopull,nopush] WERROR spoolss_EnumPrintProcessors(
-		[in] [string,charset(UTF16)] uint16 *servername,
-		[in] [string,charset(UTF16)] uint16 *environment,
+		[in,unique] [string,charset(UTF16)] uint16 *servername,
+		[in,unique] [string,charset(UTF16)] uint16 *environment,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out,switch_is(level),size_is(count)] spoolss_PrintProcessorInfo *info,
+		[out,unique,switch_is(level),size_is(count)] spoolss_PrintProcessorInfo *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -878,9 +877,9 @@ import "security.idl", "winreg.idl";
 		[in,ref] policy_handle *handle,
 		[in] [string,charset(UTF16)] uint16 form_name[],
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out,subcontext(4),subcontext_size(offered),switch_is(level)] spoolss_FormInfo *info,
+		[out,unique,subcontext(4),subcontext_size(offered),switch_is(level)] spoolss_FormInfo *info,
 		[out] uint32 needed
 	);
 
@@ -898,9 +897,9 @@ import "security.idl", "winreg.idl";
 	[public,noopnum,noprint] WERROR _spoolss_EnumForms(
 		[in,ref] policy_handle *handle,
 		[in] 	 uint32 level,
-		[in] 	 DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] 	 uint32 offered,
-		[out]	 DATA_BLOB *info,
+		[out,unique] DATA_BLOB *info,
 		[out]	 uint32 needed,
 		[out]	 uint32 count
 	);
@@ -912,9 +911,9 @@ import "security.idl", "winreg.idl";
 	[nopull,nopush] WERROR spoolss_EnumForms(
 		[in,ref] policy_handle *handle,
 		[in] 	 uint32 level,
-		[in] 	 DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] 	 uint32 offered,
-		[out,switch_is(level),size_is(count)] spoolss_FormInfo *info,
+		[out,unique,switch_is(level),size_is(count)] spoolss_FormInfo *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -948,11 +947,11 @@ import "security.idl", "winreg.idl";
 	/******************/
 	/* Function: 0x23 */
 	[public,noopnum,noprint] WERROR _spoolss_EnumPorts(
-		[in] [string,charset(UTF16)] uint16 *servername,
+		[in,unique] [string,charset(UTF16)] uint16 *servername,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out] DATA_BLOB *info,
+		[out,unique] DATA_BLOB *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -962,11 +961,11 @@ import "security.idl", "winreg.idl";
 		[out,switch_is(level)] spoolss_PortInfo info[count]
 	);
 	[nopull,nopush] WERROR spoolss_EnumPorts(
-		[in] [string,charset(UTF16)] uint16 *servername,
+		[in,unique] [string,charset(UTF16)] uint16 *servername,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out,switch_is(level),size_is(count)] spoolss_PortInfo *info,
+		[out,unique,switch_is(level),size_is(count)] spoolss_PortInfo *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -990,11 +989,11 @@ import "security.idl", "winreg.idl";
 	} spoolss_MonitorInfo;
 
 	[public,noopnum,noprint] WERROR _spoolss_EnumMonitors(
-		[in] [string,charset(UTF16)] uint16 *servername,
+		[in,unique] [string,charset(UTF16)] uint16 *servername,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out] DATA_BLOB *info,
+		[out,unique] DATA_BLOB *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -1004,11 +1003,11 @@ import "security.idl", "winreg.idl";
 		[out,switch_is(level)] spoolss_MonitorInfo info[count]
 	);
 	[nopull,nopush] WERROR spoolss_EnumMonitors(
-		[in] [string,charset(UTF16)] uint16 *servername,
+		[in,unique] [string,charset(UTF16)] uint16 *servername,
 		[in] uint32 level,
-		[in] DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] uint32 offered,
-		[out,switch_is(level),size_is(count)] spoolss_MonitorInfo *info,
+		[out,unique,switch_is(level),size_is(count)] spoolss_MonitorInfo *info,
 		[out] uint32 needed,
 		[out] uint32 count
 	);
@@ -1016,7 +1015,7 @@ import "security.idl", "winreg.idl";
 	/******************/
 	/* Function: 0x25 */
 	WERROR spoolss_AddPort(
-	       [in] [string,charset(UTF16)] uint16 *server_name,
+	       [in,unique] [string,charset(UTF16)] uint16 *server_name,
 	       [in] uint32 unknown,
 	       [in] [string,charset(UTF16)] uint16 monitor_name[]
 	);
@@ -1102,13 +1101,13 @@ import "security.idl", "winreg.idl";
 	/* Function: 0x35 */
 	WERROR spoolss_GetPrinterDriver2(
 		[in,ref] policy_handle *handle,
-		[in] 	 [string,charset(UTF16)] uint16 *architecture,
+		[in,unique] [string,charset(UTF16)] uint16 *architecture,
 		[in] 	 uint32 level,
-		[in] 	 DATA_BLOB *buffer,
+		[in,unique] DATA_BLOB *buffer,
 		[in] 	 uint32 offered,
 		[in] 	 uint32 client_major_version,
 		[in] 	 uint32 client_minor_version,
-		[out] 	 DATA_BLOB *info,
+		[out,unique] DATA_BLOB *info,
 		[out] 	 uint32 needed,
 		[out] 	 uint32 server_major_version,
 		[out] 	 uint32 server_minor_version
@@ -1233,9 +1232,9 @@ import "security.idl", "winreg.idl";
 		[in,ref] policy_handle *handle,
 		[in] uint32 flags,
 		[in] uint32 options,
-		[in] [string,charset(UTF16)] uint16 *str,
+		[in,unique] [string,charset(UTF16)] uint16 *str,
 		[in] uint32 printer_local,
-		[in] spoolss_NotifyOptionsContainer *t1
+		[in,unique] spoolss_NotifyOptionsContainer *t1
 	);
 
 	/******************/
@@ -1377,8 +1376,8 @@ import "security.idl", "winreg.idl";
 	/******************/
 	/* Function: 0x45 */
 	[public] WERROR spoolss_OpenPrinterEx(
-		[in]                  [string,charset(UTF16)] uint16 *printername,
-		[in]                  [string,charset(UTF16)] uint16 *datatype,
+		[in,unique]           [string,charset(UTF16)] uint16 *printername,
+		[in,unique]           [string,charset(UTF16)] uint16 *datatype,
 		[in]	              spoolss_DevmodeContainer devmode_ctr,
 		[in]	              uint32 access_mask,
 		[in]	              uint32 level,
@@ -1389,11 +1388,11 @@ import "security.idl", "winreg.idl";
 	/******************/
 	/* Function: 0x46 */
 	WERROR spoolss_AddPrinterEx(
-		[in] [string,charset(UTF16)] uint16 *server,
+		[in,unique] [string,charset(UTF16)] uint16 *server,
 		[in] uint32 level,
-		[in,switch_is(level)] spoolss_PrinterInfo *info,
+		[in,unique,switch_is(level)] spoolss_PrinterInfo *info,
 		[in] spoolss_DevmodeContainer devmode_ctr,
-		[in] security_descriptor *secdesc,
+		[in,unique] security_descriptor *secdesc,
 		[in] uint32 ulevel,
 		[in,switch_is(ulevel)] spoolss_UserLevel userlevel
 	);
diff --git a/source4/librpc/idl/srvsvc.idl b/source4/librpc/idl/srvsvc.idl
index c3f0bd51a7..66c52fa43f 100644
--- a/source4/librpc/idl/srvsvc.idl
+++ b/source4/librpc/idl/srvsvc.idl
@@ -9,7 +9,6 @@ import "security.idl", "svcctl.idl";
   version(3.0),
   endpoint("ncacn_np:[\\pipe\\srvsvc]", "ncacn_ip_tcp:", "ncalrpc:"),
   pointer_default(unique),
-  pointer_default_top(unique),
   helpstring("Server Service")
 ] interface srvsvc
 {
@@ -55,18 +54,18 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x00 */
 	WERROR srvsvc_NetCharDevEnum(
-		[in]   [string,charset(UTF16)] uint16 *server_unc, 
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in,out]   uint32 level,
 		[in,out,switch_is(level)]   srvsvc_NetCharDevCtr ctr,
 		[in]   uint32 max_buffer,
 		[out]   uint32 totalentries,
-		[in,out]   uint32 *resume_handle
+		[in,out,unique]   uint32 *resume_handle
 		);
 
 	/******************/
 	/* Function: 0x01 */
 	WERROR srvsvc_NetCharDevGetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 device_name[],
 		[in]   uint32 level,
 		[out,switch_is(level)]   srvsvc_NetCharDevInfo info
@@ -75,7 +74,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x02 */
 	WERROR srvsvc_NetCharDevControl(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 device_name[],
 		[in]   uint32 opcode
 		);
@@ -120,19 +119,19 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x03 */
 	WERROR srvsvc_NetCharDevQEnum(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
-		[in]   [string,charset(UTF16)] uint16 *user,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *user,
 		[in,out]   uint32 level,
 		[in,out,switch_is(level)]   srvsvc_NetCharDevQCtr ctr,
 		[in]   uint32 max_buffer,
 		[out]   uint32 totalentries,
-		[in,out]   uint32 *resume_handle
+		[in,out,unique]   uint32 *resume_handle
 		);
 
 	/******************/
 	/* Function: 0x04 */
 	WERROR srvsvc_NetCharDevQGetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 queue_name[],
 		[in]   [string,charset(UTF16)] uint16 user[],
 		[in]   uint32 level,
@@ -142,24 +141,24 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x05 */
 	WERROR srvsvc_NetCharDevQSetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 queue_name[],
 		[in]   uint32 level,
 		[in,switch_is(level)]   srvsvc_NetCharDevQInfo info,
-		[in,out]   uint32 *parm_error
+		[in,out,unique]   uint32 *parm_error
 		);
 
 	/******************/
 	/* Function: 0x06 */
 	WERROR srvsvc_NetCharDevQPurge(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 queue_name[]
 		);
 
 	/******************/
 	/* Function: 0x07 */
 	WERROR srvsvc_NetCharDevQPurgeSelf(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 queue_name[],
 		[in]   [string,charset(UTF16)] uint16 computer_name[]
 		);
@@ -200,13 +199,13 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x08 */
 	WERROR srvsvc_NetConnEnum(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
-		[in]   [string,charset(UTF16)] uint16 *path,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *path,
 		[in,out]   uint32 level,
 		[in,out,switch_is(level)]   srvsvc_NetConnCtr ctr,
 		[in]   uint32 max_buffer,
 		[out]   uint32 totalentries,
-		[in,out]   uint32 *resume_handle
+		[in,out,unique]   uint32 *resume_handle
 		);
 
 /**************************/
@@ -249,20 +248,20 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x09 */
 	WERROR srvsvc_NetFileEnum(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
-		[in]   [string,charset(UTF16)] uint16 *path,
-		[in]   [string,charset(UTF16)] uint16 *user,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *path,
+		[in,unique]   [string,charset(UTF16)] uint16 *user,
 		[in,out]   uint32 level,
 		[in,out,switch_is(level)]   srvsvc_NetFileCtr ctr,
 		[in]   uint32 max_buffer,
 		[out]   uint32 totalentries,
-		[in,out]   uint32 *resume_handle
+		[in,out,unique]   uint32 *resume_handle
 		);
 
 	/******************/
 	/* Function: 0x0a */
 	WERROR srvsvc_NetFileGetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   uint32 fid,
 		[in]   uint32 level,
 		[out,switch_is(level)]   srvsvc_NetFileInfo info
@@ -271,7 +270,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x0b */
 	WERROR srvsvc_NetFileClose(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   uint32 fid	
 		);
 
@@ -356,22 +355,22 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x0c */
 	WERROR srvsvc_NetSessEnum(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
-		[in]   [string,charset(UTF16)] uint16 *client,
-		[in]   [string,charset(UTF16)] uint16 *user,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *client,
+		[in,unique]   [string,charset(UTF16)] uint16 *user,
 		[in,out]   uint32 level,
 		[in,out,switch_is(level)]   srvsvc_NetSessCtr ctr,
 		[in]   uint32 max_buffer,
 		[out]   uint32 totalentries,
-		[in,out]   uint32 *resume_handle
+		[in,out,unique]   uint32 *resume_handle
 		);
 
 	/******************/
 	/* Function: 0x0d */
 	WERROR srvsvc_NetSessDel(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
-		[in]   [string,charset(UTF16)] uint16 *client,
-		[in]   [string,charset(UTF16)] uint16 *user
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *client,
+		[in,unique]   [string,charset(UTF16)] uint16 *user
 		);
 
 /**************************/
@@ -545,27 +544,27 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x0e */
 	WERROR srvsvc_NetShareAdd(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   uint32 level,
 		[in,switch_is(level)] srvsvc_NetShareInfo info,
-		[in,out]   uint32 *parm_error
+		[in,out,unique]   uint32 *parm_error
 		);
 
 	/******************/
 	/* Function: 0x0f */
 	WERROR srvsvc_NetShareEnumAll (
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in,out]   uint32 level,
 		[in,out,switch_is(level)] srvsvc_NetShareCtr ctr,
 		[in]   uint32 max_buffer,
 		[out]  uint32 totalentries,
-		[in,out]   uint32 *resume_handle
+		[in,out,unique]   uint32 *resume_handle
 		);
 
 	/******************/
 	/* Function: 0x10 */
 	WERROR srvsvc_NetShareGetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 share_name[],
 		[in]   uint32 level,
 		[out,switch_is(level)] srvsvc_NetShareInfo info
@@ -574,17 +573,17 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x11 */
 	WERROR srvsvc_NetShareSetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 share_name[],
 		[in]   uint32 level,
 		[in,switch_is(level)] srvsvc_NetShareInfo info,
-		[in,out]   uint32 *parm_error
+		[in,out,unique]   uint32 *parm_error
 		);
 
 	/******************/
 	/* Function: 0x12 */
 	WERROR srvsvc_NetShareDel(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 share_name[],
 		[in]   uint32 reserved
 		);
@@ -592,7 +591,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x13 */
 	WERROR srvsvc_NetShareDelSticky(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 share_name[],
 		[in]   uint32 reserved
 		);
@@ -600,7 +599,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x14 */
 	WERROR srvsvc_NetShareCheck(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 device_name[],
 		[out]  srvsvc_ShareType type
 		);
@@ -1110,7 +1109,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x15 */
 	WERROR srvsvc_NetSrvGetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   uint32 level,
 		[out,switch_is(level)] srvsvc_NetSrvInfo info
 		);
@@ -1118,10 +1117,10 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x16 */
 	WERROR srvsvc_NetSrvSetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   uint32 level,
 		[in,switch_is(level)] srvsvc_NetSrvInfo info,
-		[in,out]   uint32 *parm_error
+		[in,out,unique]   uint32 *parm_error
 		);
 
 /**************************/
@@ -1139,12 +1138,12 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x17 */
 	WERROR srvsvc_NetDiskEnum(
-		[in]      [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]      [string,charset(UTF16)] uint16 *server_unc,
 		[in]      uint32 level,
 		[in,out]  srvsvc_NetDiskInfo info,
 		[in]      uint32 maxlen,
 		[out]     uint32 totalentries,
-		[in,out]  uint32 *resume_handle
+		[in,out,unique]  uint32 *resume_handle
 		);
 
 /**************************/
@@ -1173,8 +1172,8 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x18 */
 	WERROR srvsvc_NetServerStatisticsGet(
-		[in]      [string,charset(UTF16)] uint16 *server_unc,
-		[in]      [string,charset(UTF16)] uint16 *service,
+		[in,unique]      [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]      [string,charset(UTF16)] uint16 *service,
 		[in]      uint32 level,
 		[in]      uint32 options,
 		[out]     srvsvc_Statistics stat
@@ -1194,7 +1193,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x19 */
 	WERROR srvsvc_NetTransportAdd(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in] uint32 level,
 		[in,switch_is(level)]   srvsvc_NetTransportInfo info
 		);
@@ -1261,18 +1260,18 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x1a */
 	WERROR srvsvc_NetTransportEnum(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in,out] uint32 level,
 		[in,out,switch_is(level)]   srvsvc_NetTransportCtr transports,
 		[in]   uint32 max_buffer,
 		[out]   uint32 totalentries,
-		[in,out]   uint32 *resume_handle
+		[in,out,unique]   uint32 *resume_handle
 		);
 
 	/******************/
 	/* Function: 0x1b */
 	WERROR srvsvc_NetTransportDel(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]	uint32 level,
 		[in,switch_is(level)]   srvsvc_NetTransportInfo info
 		);
@@ -1298,8 +1297,8 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x1c */
 	WERROR srvsvc_NetRemoteTOD(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
-		[out]   srvsvc_NetRemoteTODInfo *info
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
+		[out,unique]   srvsvc_NetRemoteTODInfo *info
 		);
 
 /**************************/
@@ -1308,8 +1307,8 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x1d */
 	WERROR srvsvc_NetSetServiceBits(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
-		[in]   [string,charset(UTF16)] uint16 *transport,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *transport,
 		[in]   uint32 servicebits,
 		[in]   uint32 updateimmediately
 		);
@@ -1320,7 +1319,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x1e */
 	WERROR srvsvc_NetPathType(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 path[],
 		[in]   uint32 pathflags,
 		[out]   uint32 pathtype
@@ -1329,7 +1328,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x1f */
 	WERROR srvsvc_NetPathCanonicalize(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 path[],
 		[out]  [size_is(maxbuf)] uint8 can_path[],
 		[in]   uint32 maxbuf,
@@ -1341,7 +1340,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x20 */
 	WERROR srvsvc_NetPathCompare(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 path1[],
 		[in]   [string,charset(UTF16)] uint16 path2[],
 		[in]    uint32 pathtype,
@@ -1354,7 +1353,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x21 */
 	WERROR srvsvc_NetNameValidate(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 name[],
 		[in]    uint32 name_type,
 		[in]    uint32 flags
@@ -1368,7 +1367,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x23 */
 	WERROR srvsvc_NetPRNameCompare(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in]   [string,charset(UTF16)] uint16 name1[],
 		[in]   [string,charset(UTF16)] uint16 name2[],
 		[in]    uint32 name_type,
@@ -1383,44 +1382,44 @@ import "security.idl", "svcctl.idl";
 	/* Note, there must be some way to return entries read vs 
 	   total entries ... */
 	WERROR srvsvc_NetShareEnum(
-		[in]       [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]       [string,charset(UTF16)] uint16 *server_unc,
 	 	[in,out]   uint32 level,
 		[in,out,switch_is(level)]   srvsvc_NetShareCtr ctr,
 		[in]       uint32 max_buffer,
 		[out]      uint32 totalentries,
-		[in,out]   uint32 *resume_handle
+		[in,out,unique]   uint32 *resume_handle
 		);
 
 	/******************/
 	/* Function: 0x25 */
 	WERROR srvsvc_NetShareDelStart(
-		[in]       [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]       [string,charset(UTF16)] uint16 *server_unc,
 		[in]       [string,charset(UTF16)] uint16 share[],
 		[in]       uint32 reserved,
-		[out] policy_handle *hnd
+		[out,unique] policy_handle *hnd
 		);
 
 	/******************/
 	/* Function: 0x26 */
 	WERROR srvsvc_NetShareDelCommit(
-		[in, out] policy_handle *hnd
+		[in, out,unique] policy_handle *hnd
 		);
 
 	/******************/
 	/* Function: 0x27 */
 	WERROR srvsvc_NetGetFileSecurity(
-		[in]       [string,charset(UTF16)] uint16 *server_unc,
-		[in]       [string,charset(UTF16)] uint16 *share,
+		[in,unique]       [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]       [string,charset(UTF16)] uint16 *share,
 		[in]       [string,charset(UTF16)] uint16 file[],
 		[in]       security_secinfo securityinformation,
-		[out]	   sec_desc_buf *sd_buf
+		[out,unique]	   sec_desc_buf *sd_buf
 		);
 
 	/******************/
 	/* Function: 0x28 */
 	WERROR srvsvc_NetSetFileSecurity(
-		[in]       [string,charset(UTF16)] uint16 *server_unc,
-		[in]       [string,charset(UTF16)] uint16 *share,
+		[in,unique]       [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]       [string,charset(UTF16)] uint16 *share,
 		[in]       [string,charset(UTF16)] uint16 file[],
 		[in]       security_secinfo securityinformation,
 		[in]	   sec_desc_buf sd_buf
@@ -1438,7 +1437,7 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x29 */
 	WERROR srvsvc_NetServerTransportAddEx(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
 		[in] uint32 level,
 		[in,switch_is(level)]   srvsvc_NetTransportInfo info
 		);
@@ -1446,9 +1445,9 @@ import "security.idl", "svcctl.idl";
 	/******************/
 	/* Function: 0x2a */
 	WERROR srvsvc_NetServerSetServiceBitsEx(
-		[in]   [string,charset(UTF16)] uint16 *server_unc,
-		[in]   [string,charset(UTF16)] uint16 *emulated_server_unc,
-		[in]   [string,charset(UTF16)] uint16 *transport,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *emulated_server_unc,
+		[in,unique]   [string,charset(UTF16)] uint16 *transport,
 		[in]   uint32 servicebitsofinterest,
 		[in]   uint32 servicebits,
 		[in]   uint32 updateimmediately
diff --git a/source4/librpc/idl/svcctl.idl b/source4/librpc/idl/svcctl.idl
index d9f8233a0e..8f368ef878 100644
--- a/source4/librpc/idl/svcctl.idl
+++ b/source4/librpc/idl/svcctl.idl
@@ -8,7 +8,6 @@ import "misc.idl";
 [ uuid("367abb81-9844-35f1-ad32-98f038001003"),
   version(2.0),
   pointer_default(unique),
-  pointer_default_top(unique),
   endpoint("ncacn_np:[\\pipe\\svcctl]", "ncalrpc:"),
   helpstring("Service Control")
 ] interface svcctl
@@ -163,13 +162,13 @@ import "misc.idl";
 		[in] uint32 type,
 		[in] uint32 start,
 		[in] uint32 error,
-		[in] [string,charset(UTF16)] uint16 *binary_path,
-		[in] [string,charset(UTF16)] uint16 *load_order_group,
+		[in,unique] [string,charset(UTF16)] uint16 *binary_path,
+		[in,unique] [string,charset(UTF16)] uint16 *load_order_group,
 		[out,ref] uint32 *tag_id,
-		[in] [string,charset(UTF16)] uint16 *dependencies,
-		[in] [string,charset(UTF16)] uint16 *service_start_name,
-		[in] [string,charset(UTF16)] uint16 *password,
-		[in] [string,charset(UTF16)] uint16 *display_name
+		[in,unique] [string,charset(UTF16)] uint16 *dependencies,
+		[in,unique] [string,charset(UTF16)] uint16 *service_start_name,
+		[in,unique] [string,charset(UTF16)] uint16 *password,
+		[in,unique] [string,charset(UTF16)] uint16 *display_name
 	);
 
 	/*****************/
@@ -177,18 +176,18 @@ import "misc.idl";
 	WERROR svcctl_CreateServiceW(
 		[in,ref] policy_handle *scmanager_handle,
 		[in] [string,charset(UTF16)] uint16 ServiceName[],
-		[in] [string,charset(UTF16)] uint16 *DisplayName,
+		[in,unique] [string,charset(UTF16)] uint16 *DisplayName,
 		[in] uint32 desired_access,
 		[in] uint32 type,
 		[in] uint32 start_type,
 		[in] uint32 error_control,
 		[in] [string,charset(UTF16)] uint16 binary_path[],
-		[in] [string,charset(UTF16)] uint16 *LoadOrderGroupKey,
-  		[in,out] uint32 *TagId,
-		[in,size_is(dependencies_size)] uint8 *dependencies,
+		[in,unique] [string,charset(UTF16)] uint16 *LoadOrderGroupKey,
+		[in,out,unique] uint32 *TagId,
+		[in,unique,size_is(dependencies_size)] uint8 *dependencies,
 		[in] uint32 dependencies_size,
-		[in] [string,charset(UTF16)] uint16 *service_start_name,
-		[in,size_is(password_size)] uint8 *password,
+		[in,unique] [string,charset(UTF16)] uint16 *service_start_name,
+		[in,unique,size_is(password_size)] uint8 *password,
 		[in] uint32 password_size,
 		[out,ref] policy_handle *handle
 	);
@@ -198,7 +197,7 @@ import "misc.idl";
 	WERROR svcctl_EnumDependentServicesW(
 		[in,ref] policy_handle *service,
 		[in] uint32 state,
-		[out] ENUM_SERVICE_STATUS *service_status,
+		[out,unique] ENUM_SERVICE_STATUS *service_status,
 		[in] uint32 buf_size,
 		[out,ref] uint32 *bytes_needed,
 		[out,ref] uint32 *services_returned
@@ -214,14 +213,14 @@ import "misc.idl";
 		[out,size_is(buf_size)] uint8 service[*],
 		[out,ref] uint32 *bytes_needed,
 		[out,ref] uint32 *services_returned,
-		[in,out] uint32 *resume_handle
+		[in,out,unique] uint32 *resume_handle
 	);
 
 	/*****************/
 	/* Function 0x0f */
 	WERROR svcctl_OpenSCManagerW(
-		[in] [string,charset(UTF16)] uint16 *MachineName,
-		[in] [string,charset(UTF16)] uint16 *DatabaseName,
+		[in,unique] [string,charset(UTF16)] uint16 *MachineName,
+		[in,unique] [string,charset(UTF16)] uint16 *DatabaseName,
 		[in] uint32 access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -258,25 +257,25 @@ import "misc.idl";
 	WERROR svcctl_StartServiceW(
 		[in,ref] policy_handle *handle,
 		[in] uint32 NumArgs,
-		[in/*FIXME:,length_is(NumArgs)*/] [string,charset(UTF16)] uint16 *Arguments
+		[in,unique/*FIXME:,length_is(NumArgs)*/] [string,charset(UTF16)] uint16 *Arguments
 	);
 
 	/*****************/
 	/* Function 0x14 */
 	WERROR svcctl_GetServiceDisplayNameW(
 		[in,ref] policy_handle *handle,
-		[in] [string,charset(UTF16)] uint16 *service_name,
+		[in,unique] [string,charset(UTF16)] uint16 *service_name,
 		[out,ref] [string,charset(UTF16)] uint16 **display_name,
-		[in,out] uint32 *display_name_length
+		[in,out,unique] uint32 *display_name_length
 	); 
 
 	/*****************/
 	/* Function 0x15 */
 	WERROR svcctl_GetServiceKeyNameW(
 		[in,ref] policy_handle *handle,
-		[in] [string,charset(UTF16)] uint16 *service_name,
+		[in,unique] [string,charset(UTF16)] uint16 *service_name,
 		[out,ref] [string,charset(UTF16)] uint16 **key_name,
-		[in,out] uint32 *display_name_length
+		[in,out,unique] uint32 *display_name_length
 	);
 
 	/*****************/
@@ -295,31 +294,31 @@ import "misc.idl";
 		[in] uint32 type,
 		[in] uint32 start,
 		[in] uint32 error,
-		[in] [string,charset(UTF16)] uint16 *binary_path,
-		[in] [string,charset(UTF16)] uint16 *load_order_group,
+		[in,unique] [string,charset(UTF16)] uint16 *binary_path,
+		[in,unique] [string,charset(UTF16)] uint16 *load_order_group,
 		[out,ref] uint32 *tag_id,
-		[in] [string,charset(UTF16)] uint16 *dependencies,
-		[in] [string,charset(UTF16)] uint16 *service_start_name,
-		[in] [string,charset(UTF16)] uint16 *password,
-		[in] [string,charset(UTF16)] uint16 *display_name
+		[in,unique] [string,charset(UTF16)] uint16 *dependencies,
+		[in,unique] [string,charset(UTF16)] uint16 *service_start_name,
+		[in,unique] [string,charset(UTF16)] uint16 *password,
+		[in,unique] [string,charset(UTF16)] uint16 *display_name
 	);
 
 	/*****************/
 	/* Function 0x18 */
 	WERROR svcctl_CreateServiceA(
 		[in,ref] policy_handle *handle,
-		[in] [string,charset(UTF16)] uint16 *ServiceName,
-		[in] [string,charset(UTF16)] uint16 *DisplayName,
+		[in,unique] [string,charset(UTF16)] uint16 *ServiceName,
+		[in,unique] [string,charset(UTF16)] uint16 *DisplayName,
 		[in] uint32 desired_access,
 		[in] uint32 type,
 		[in] uint32 start_type,
 		[in] uint32 error_control,
-		[in] [string,charset(UTF16)] uint16 *binary_path,
-		[in] [string,charset(UTF16)] uint16 *LoadOrderGroupKey,
-  		[out] uint32 *TagId,
-		[in] [string,charset(UTF16)] uint16 *dependencies,
-		[in] [string,charset(UTF16)] uint16 *service_start_name,
-		[in] [string,charset(UTF16)] uint16 *password
+		[in,unique] [string,charset(UTF16)] uint16 *binary_path,
+		[in,unique] [string,charset(UTF16)] uint16 *LoadOrderGroupKey,
+		[out,unique] uint32 *TagId,
+		[in,unique] [string,charset(UTF16)] uint16 *dependencies,
+		[in,unique] [string,charset(UTF16)] uint16 *service_start_name,
+		[in,unique] [string,charset(UTF16)] uint16 *password
 	);
 
 	/*****************/
@@ -327,7 +326,7 @@ import "misc.idl";
 	WERROR svcctl_EnumDependentServicesA(
 		[in,ref] policy_handle *service,
 		[in] uint32 state,
-		[out] ENUM_SERVICE_STATUS *service_status,
+		[out,unique] ENUM_SERVICE_STATUS *service_status,
 		[in] uint32 buf_size,
 		[out,ref] uint32 *bytes_needed,
 		[out,ref] uint32 *services_returned
@@ -343,14 +342,14 @@ import "misc.idl";
 		[out,size_is(buf_size)] uint8 service[*],
 		[out,ref] uint32 *bytes_needed,
 		[out,ref] uint32 *services_returned,
-		[in,out] uint32 *resume_handle
+		[in,out,unique] uint32 *resume_handle
 	);
 	
 	/*****************/
 	/* Function 0x1b */
 	WERROR svcctl_OpenSCManagerA(
-		[in] [string,charset(UTF16)] uint16 *MachineName,
-		[in] [string,charset(UTF16)] uint16 *DatabaseName,
+		[in,unique] [string,charset(UTF16)] uint16 *MachineName,
+		[in,unique] [string,charset(UTF16)] uint16 *DatabaseName,
 		[in] uint32 access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -359,7 +358,7 @@ import "misc.idl";
 	/* Function 0x1c */
 	WERROR svcctl_OpenServiceA(
 		[in,ref] policy_handle *scmanager_handle,
-		[in] [string,charset(UTF16)] uint16 *ServiceName,
+		[in,unique] [string,charset(UTF16)] uint16 *ServiceName,
 		[in] uint32 access_mask
 	);
 
@@ -386,25 +385,25 @@ import "misc.idl";
 	WERROR svcctl_StartServiceA(
 		[in,ref] policy_handle *handle,
 		[in] uint32 NumArgs,
-		[in/*FIXME:,length_is(NumArgs)*/] [string,charset(UTF16)] uint16 *Arguments
+		[in,unique/*FIXME:,length_is(NumArgs)*/] [string,charset(UTF16)] uint16 *Arguments
 	);
 
 	/*****************/
 	/* Function 0x20 */
 	WERROR svcctl_GetServiceDisplayNameA(
 		[in,ref] policy_handle *handle,
-		[in] [string,charset(UTF16)] uint16 *service_name,
+		[in,unique] [string,charset(UTF16)] uint16 *service_name,
 		[out,ref] [string,charset(UTF16)] uint16 **display_name,
-		[in,out] uint32 *display_name_length
+		[in,out,unique] uint32 *display_name_length
 	); 
 
 	/*****************/
 	/* Function 0x21 */
 	WERROR svcctl_GetServiceKeyNameA(
 		[in,ref] policy_handle *handle,
-		[in] [string,charset(UTF16)] uint16 *service_name,
+		[in,unique] [string,charset(UTF16)] uint16 *service_name,
 		[out,ref] [string,charset(UTF16)] uint16 **key_name,
-		[in,out] uint32 *display_name_length
+		[in,out,unique] uint32 *display_name_length
 	);
 
 	/*****************/
@@ -422,7 +421,7 @@ import "misc.idl";
 	WERROR svcctl_ChangeServiceConfig2A(
 		[in,ref] policy_handle *handle,
 		[in] uint32 info_level,
-		[in] uint8 *info
+		[in,unique] uint8 *info
 	);
 
 	/*****************/
@@ -430,7 +429,7 @@ import "misc.idl";
 	WERROR svcctl_ChangeServiceConfig2W(
 		[in,ref] policy_handle *handle,
 		[in] uint32 info_level,
-		[in] uint8 *info
+		[in,unique] uint8 *info
 	);
 
 	/*****************/
@@ -474,7 +473,7 @@ import "misc.idl";
 		[in] uint32 buf_size,
 		[out,ref] uint32 *bytes_needed,
 		[out,ref] uint32 *service_returned,
-		[in,out] uint32 *resume_handle, 
+		[in,out,unique] uint32 *resume_handle,
 		[out,ref] [string,charset(UTF16)] uint16 **group_name
 	);
 
@@ -489,7 +488,7 @@ import "misc.idl";
 		[in] uint32 buf_size,
 		[out,ref] uint32 *bytes_needed,
 		[out,ref] uint32 *service_returned,
-		[in,out] uint32 *resume_handle, 
+		[in,out,unique] uint32 *resume_handle,
 		[out,ref] [string,charset(UTF16)] uint16 **group_name
 	);
 
diff --git a/source4/librpc/idl/winreg.idl b/source4/librpc/idl/winreg.idl
index fc734b7403..b489e86c38 100644
--- a/source4/librpc/idl/winreg.idl
+++ b/source4/librpc/idl/winreg.idl
@@ -9,7 +9,6 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
   version(1.0),
   endpoint("ncacn_np:[\\pipe\\winreg]","ncacn_ip_tcp:","ncalrpc:"),
   pointer_default(unique),
-  pointer_default_top(unique),
   helpstring("Remote Registry Service")
 ] interface winreg
 {
@@ -50,7 +49,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x00 */
 	WERROR winreg_OpenHKCR(
-		[in]      uint16 *system_name,
+		[in,unique] uint16 *system_name,
 		[in]      winreg_AccessMask access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -58,7 +57,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x01 */
 	WERROR winreg_OpenHKCU(
-	        [in]      uint16 *system_name,
+	        [in,unique] uint16 *system_name,
 		[in]      winreg_AccessMask access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -66,7 +65,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x02 */
 	[public] WERROR winreg_OpenHKLM(
-		[in]      uint16 *system_name,
+		[in,unique] uint16 *system_name,
 		[in]      winreg_AccessMask access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -74,7 +73,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x03 */
 	WERROR winreg_OpenHKPD(
-		[in]      uint16 *system_name,
+		[in,unique] uint16 *system_name,
 		[in]      winreg_AccessMask access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -82,7 +81,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x04 */
 	WERROR winreg_OpenHKU(
-		[in]      uint16 *system_name,
+		[in,unique] uint16 *system_name,
 		[in]      winreg_AccessMask access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -189,8 +188,8 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/* Function: 0x0d */
 	WERROR winreg_LoadKey(
 		[in,ref] policy_handle *handle,
-		[in] winreg_String *keyname,
-		[in] winreg_String *filename
+		[in,unique] winreg_String *keyname,
+		[in,unique] winreg_String *filename
 	);
 
 	/******************/
@@ -242,10 +241,10 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	[public] WERROR winreg_QueryValue(
 		[in,ref] policy_handle *handle,
 		[in] winreg_String value_name,
-		[in,out] winreg_Type *type,
-		[in,out,size_is(*size),length_is(*length)] uint8 *data,
-		[in,out] uint32 *size,
-		[in,out] uint32 *length
+		[in,out,unique] winreg_Type *type,
+		[in,out,unique,size_is(*size),length_is(*length)] uint8 *data,
+		[in,out,unique] uint32 *size,
+		[in,out,unique] uint32 *length
 	);
 
 	/******************/
@@ -302,8 +301,8 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x18 */
 	WERROR winreg_InitiateSystemShutdown(
-		[in]	uint16 *hostname,
-		[in]	initshutdown_String *message,
+		[in,unique] uint16 *hostname,
+		[in,unique] initshutdown_String *message,
 		[in]	uint32 timeout,
 		[in]	uint8 force_apps,
 		[in]	uint8 reboot
@@ -312,7 +311,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x19 */
 	WERROR winreg_AbortSystemShutdown(
-		[in]	uint16 *server
+		[in,unique] uint16 *server
 	);
 
 	/******************/
@@ -325,7 +324,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x1b */
 	WERROR winreg_OpenHKCC(
-		[in]      uint16 *system_name,
+		[in,unique] uint16 *system_name,
 		[in]      winreg_AccessMask access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -333,7 +332,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x1c */
 	WERROR winreg_OpenHKDD(
-		[in]      uint16 *system_name,
+		[in,unique] uint16 *system_name,
 		[in]      winreg_AccessMask access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -351,15 +350,15 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 		[in,ref] policy_handle *key_handle, 
 		[in,out,ref,size_is(num_values),length_is(num_values)] QueryMultipleValue *values,
 		[in] uint32 num_values,
-		[in,out,size_is(*buffer_size),length_is(*buffer_size)] uint8 *buffer,
+		[in,out,unique,size_is(*buffer_size),length_is(*buffer_size)] uint8 *buffer,
 		[in,out,ref] uint32 *buffer_size
 	);
 
 	/******************/
 	/* Function: 0x1e */
 	WERROR winreg_InitiateSystemShutdownEx(
-		[in] uint16 *hostname,
-		[in] initshutdown_String *message,
+		[in,unique] uint16 *hostname,
+		[in,unique] initshutdown_String *message,
 		[in] uint32 timeout,
 		[in] uint8 force_apps,
 		[in] uint8 reboot,
@@ -374,7 +373,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x20 */
 	WERROR winreg_OpenHKPT(
-		[in]      uint16 *system_name,
+		[in,unique] uint16 *system_name,
 		[in]      winreg_AccessMask access_mask,
 		[out,ref] policy_handle *handle
 	);
@@ -382,7 +381,7 @@ import "lsa.idl", "initshutdown.idl", "security.idl";
 	/******************/
 	/* Function: 0x21 */
 	WERROR winreg_OpenHKPN(
-		[in]      uint16 *system_name,
+		[in,unique] uint16 *system_name,
 		[in]      winreg_AccessMask access_mask,
 		[out,ref] policy_handle *handle
 	);
diff --git a/source4/librpc/idl/wkssvc.idl b/source4/librpc/idl/wkssvc.idl
index 9829379eef..023ce59ad9 100644
--- a/source4/librpc/idl/wkssvc.idl
+++ b/source4/librpc/idl/wkssvc.idl
@@ -9,7 +9,6 @@ import "srvsvc.idl", "lsa.idl";
 [ uuid("6bffd098-a112-3610-9833-46c3f87e345a"),
   version(1.0),
   pointer_default(unique),
-  pointer_default_top(unique),
   helpstring("Workstation Service"),
   endpoint("ncacn_np:[\\pipe\\wkssvc]","ncacn_ip_tcp:","ncalrpc:")
 ] interface wkssvc
@@ -259,7 +258,7 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_NetWkstaInfo;
 
 	WERROR wkssvc_NetWkstaGetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_name,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_name,
 		[in]   uint32 level,
 		[out,switch_is(level),ref]  wkssvc_NetWkstaInfo *info
 		);
@@ -268,7 +267,7 @@ import "srvsvc.idl", "lsa.idl";
 	/******************/
 	/* Function: 0x01 */
 	WERROR wkssvc_NetWkstaSetInfo(
-		[in]   [string,charset(UTF16)] uint16 *server_name,
+		[in,unique]   [string,charset(UTF16)] uint16 *server_name,
 		[in]   uint32 level,
 		[in,switch_is(level),ref]  wkssvc_NetWkstaInfo *info,
 		[in,out,ref]   uint32 *parm_error
@@ -309,11 +308,11 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_NetWkstaEnumUsersInfo;
 
 	WERROR wkssvc_NetWkstaEnumUsers(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,out,ref] wkssvc_NetWkstaEnumUsersInfo *info,
 		[in] uint32 prefmaxlen,
 		[out,ref] uint32 *entries_read,
-		[in,out] uint32 *resume_handle
+		[in,out,unique] uint32 *resume_handle
 		);
 
 	/*****************************/
@@ -329,7 +328,7 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_NetrWkstaUserInfo;
 
 	WERROR wkssvc_NetrWkstaUserGetInfo(
-		[in] [string,charset(UTF16)] uint16 *unknown,
+		[in,unique] [string,charset(UTF16)] uint16 *unknown,
 		[in] uint32 level,
 		[out,ref] [switch_is(level)] wkssvc_NetrWkstaUserInfo *info
 		);
@@ -337,10 +336,10 @@ import "srvsvc.idl", "lsa.idl";
 	/*****************************/
 	/* Function        0x04      */
 	WERROR wkssvc_NetrWkstaUserSetInfo(
-		[in] [string,charset(UTF16)] uint16 *unknown,
+		[in,unique] [string,charset(UTF16)] uint16 *unknown,
 		[in] uint32 level,
 		[in,ref] [switch_is(level)] wkssvc_NetrWkstaUserInfo *info,
-		[in,out] uint32 *parm_err
+		[in,out,unique] uint32 *parm_err
 		);
 
 	/*****************************/
@@ -369,29 +368,29 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_NetWkstaTransportInfo;
 
 	WERROR wkssvc_NetWkstaTransportEnum (
-		[in]         [string,charset(UTF16)] uint16 *server_name,
+		[in,unique]         [string,charset(UTF16)] uint16 *server_name,
 		[in,out,ref] wkssvc_NetWkstaTransportInfo *info,
 		[in]         uint32 max_buffer,
 		[out,ref]    uint32 *total_entries,
-		[in,out]     uint32 *resume_handle
+		[in,out,unique]     uint32 *resume_handle
 		);
 
 	/*****************************/
 	/* Function        0x06      */
 	/* only supported on NT */
 	WERROR wkssvc_NetrWkstaTransportAdd(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in] uint32 level, /* must be 0 */
 		[in,ref] wkssvc_NetWkstaTransportInfo0 *info0,
-		[in,out] uint32 *parm_err
+		[in,out,unique] uint32 *parm_err
                 );
 
 	/*****************************/
 	/* Function        0x07      */
 	/* only supported on NT */
 	WERROR wkssvc_NetrWkstaTransportDel(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *transport_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *transport_name,
 		[in] uint32 unknown3
 		);
 
@@ -437,16 +436,16 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_NetrUseGetInfoCtr;
 
 	WERROR wkssvc_NetrUseAdd(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in] uint32 level,
 		[in,ref] [switch_is(level)] wkssvc_NetrUseGetInfoCtr *ctr,
-		[in,out] uint32 *parm_err
+		[in,out,unique] uint32 *parm_err
 		);
 
 	/*****************************/
 	/* Function        0x09      */
 	WERROR wkssvc_NetrUseGetInfo(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,ref] [string,charset(UTF16)] uint16 *use_name,
 		[in] uint32 level,
 		[out,ref] [switch_is(level)] wkssvc_NetrUseGetInfoCtr *ctr
@@ -455,7 +454,7 @@ import "srvsvc.idl", "lsa.idl";
 	/*****************************/
 	/* Function        0x0a      */
 	WERROR wkssvc_NetrUseDel(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,ref] [string,charset(UTF16)] uint16 *use_name,
 		[in] uint32 force_cond
 		);
@@ -489,19 +488,19 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_NetrUseEnumInfo;
 
 	WERROR wkssvc_NetrUseEnum(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,out,ref] wkssvc_NetrUseEnumInfo *info,
 		[in] uint32 prefmaxlen,
 		[out,ref] uint32 *entries_read,
-		[in,out] uint32 *resume_handle
+		[in,out,unique] uint32 *resume_handle
 		);
 
 	/*****************************/
 	/* Function        0x0c      */
 	WERROR wkssvc_NetrMessageBufferSend(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,ref] [string,charset(UTF16)] uint16 *message_name,
-		[in] [string,charset(UTF16)] uint16 *message_sender_name,
+		[in,unique] [string,charset(UTF16)] uint16 *message_sender_name,
 		[in,ref] [size_is(message_size)] uint8 *message_buffer,
 		[in] uint32 message_size
 		);
@@ -552,8 +551,8 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_NetrWorkstationStatistics;
 
 	WERROR wkssvc_NetrWorkstationStatisticsGet(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *unknown2,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *unknown2,
 		[in] uint32 unknown3,
 		[in] uint32 unknown4,
 		[out,ref] wkssvc_NetrWorkstationStatistics **info
@@ -574,20 +573,20 @@ import "srvsvc.idl", "lsa.idl";
 	/*****************************/
 	/* Function        0x10      */
 	WERROR wkssvc_NetrJoinDomain(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,ref] [string,charset(UTF16)] uint16 *domain_name,
-		[in] [string,charset(UTF16)] uint16 *account_ou,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] [string,charset(UTF16)] uint16 *password,
+		[in,unique] [string,charset(UTF16)] uint16 *account_ou,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] [string,charset(UTF16)] uint16 *password,
 		[in] wkssvc_joinflags join_flags
 		);
 
 	/*****************************/
 	/* Function        0x11      */
 	WERROR wkssvc_NetrUnjoinDomain(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] [string,charset(UTF16)] uint16 *password,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] [string,charset(UTF16)] uint16 *password,
 		[in] wkssvc_joinflags unjoin_flags
 		);
 
@@ -599,10 +598,10 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_renameflags;
 
 	WERROR wkssvc_NetrRenameMachineInDomain(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *NewMachineName,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] [string,charset(UTF16)] uint16 *password,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *NewMachineName,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] [string,charset(UTF16)] uint16 *password,
 		[in] wkssvc_renameflags RenameOptions
 		);
 
@@ -618,10 +617,10 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_NetValidateNameType;
 
 	WERROR wkssvc_NetrValidateName(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,ref] [string,charset(UTF16)] uint16 *name,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] [string,charset(UTF16)] uint16 *Password,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] [string,charset(UTF16)] uint16 *Password,
 		[in] wkssvc_NetValidateNameType name_type
 		);
 
@@ -635,7 +634,7 @@ import "srvsvc.idl", "lsa.idl";
 	} wkssvc_NetJoinStatus;
 
 	WERROR wkssvc_NetrGetJoinInformation(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,out,ref] [string,charset(UTF16)] uint16 **name_buffer,
 		[out,ref] wkssvc_NetJoinStatus *name_type
 		);
@@ -643,12 +642,16 @@ import "srvsvc.idl", "lsa.idl";
 	/*****************************/
 	/* Function        0x15      */
 	WERROR wkssvc_NetrGetJoinableOus(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,ref] [string,charset(UTF16)] uint16 *domain_name,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] [string,charset(UTF16)] uint16 *unknown,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] [string,charset(UTF16)] uint16 *unknown,
 		[in,out,ref] uint32 *num_ous,
-		[out,ref] [size_is(*num_ous)] [string,charset(UTF16)] uint16 ***ous
+		/*
+		 * this is a [ref] pointer to a [unique] pointer to an
+		 * array of [unique] pointers to a string array
+		 */
+		[out,ref] [size_is(,*num_ous)] [string,charset(UTF16)] uint16 ***ous
 		);
 
 	typedef [flag(NDR_PAHEX)] struct {
@@ -687,81 +690,85 @@ import "srvsvc.idl", "lsa.idl";
 	/*****************************/
 	/* Function        0x16      */
 	WERROR wkssvc_NetrJoinDomain2 (
-		[in]         [string,charset(UTF16)] uint16 *server_name,
+		[in,unique]  [string,charset(UTF16)] uint16 *server_name,
 		[in,ref]     [string,charset(UTF16)] uint16 *domain_name,
-		[in]         [string,charset(UTF16)] uint16 *account_ou,
-		[in]         [string,charset(UTF16)] uint16 *admin_account,
-		[in]         wkssvc_PasswordBuffer *encrypted_password,
+		[in,unique]  [string,charset(UTF16)] uint16 *account_ou,
+		[in,unique]  [string,charset(UTF16)] uint16 *admin_account,
+		[in,unique]  wkssvc_PasswordBuffer *encrypted_password,
 		[in]         wkssvc_joinflags join_flags
 		);
 
 	/*****************************/
 	/* Function        0x17      */
 	WERROR wkssvc_NetrUnjoinDomain2 (
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *account,
-		[in] wkssvc_PasswordBuffer *encrypted_password,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *account,
+		[in,unique] wkssvc_PasswordBuffer *encrypted_password,
 		[in] wkssvc_joinflags unjoin_flags
 		);
 
 	/*****************************/
 	/* Function        0x18      */
 	WERROR wkssvc_NetrRenameMachineInDomain2(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *NewMachineName,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] wkssvc_PasswordBuffer *EncryptedPassword,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *NewMachineName,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] wkssvc_PasswordBuffer *EncryptedPassword,
 		[in] wkssvc_renameflags RenameOptions
 		);
 
 	/*****************************/
 	/* Function        0x19      */
 	WERROR wkssvc_NetrValidateName2(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,ref] [string,charset(UTF16)] uint16 *name,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] wkssvc_PasswordBuffer *EncryptedPassword,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] wkssvc_PasswordBuffer *EncryptedPassword,
 		[in] wkssvc_NetValidateNameType name_type
 		);
 
 	/*****************************/
 	/* Function        0x1a      */
 	WERROR wkssvc_NetrGetJoinableOus2(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in,ref] [string,charset(UTF16)] uint16 *domain_name,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] wkssvc_PasswordBuffer *EncryptedPassword,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] wkssvc_PasswordBuffer *EncryptedPassword,
 		[in,out,ref] uint32 *num_ous,
-		[out,ref] [size_is(*num_ous)] [string,charset(UTF16)] uint16 ***ous
+		/*
+		 * this is a [ref] pointer to a [unique] pointer to an
+		 * array of [unique] pointers to a string array
+		 */
+		[out,ref] [size_is(,*num_ous)] [string,charset(UTF16)] uint16 ***ous
 		);
 
 	/*****************************/
 	/* Function        0x1b      */
 	WERROR wkssvc_NetrAddAlternateComputerName(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *NewAlternateMachineName,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] wkssvc_PasswordBuffer *EncryptedPassword,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *NewAlternateMachineName,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] wkssvc_PasswordBuffer *EncryptedPassword,
 		[in] uint32 Reserved
 		);
 
 	/*****************************/
 	/* Function        0x1c      */
 	WERROR wkssvc_NetrRemoveAlternateComputerName(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *AlternateMachineNameToRemove,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] wkssvc_PasswordBuffer *EncryptedPassword,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *AlternateMachineNameToRemove,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] wkssvc_PasswordBuffer *EncryptedPassword,
 		[in] uint32 Reserved
 		);
 
 	/*****************************/
 	/* Function        0x1d      */
 	WERROR wkssvc_NetrSetPrimaryComputername(
-		[in] [string,charset(UTF16)] uint16 *server_name,
-		[in] [string,charset(UTF16)] uint16 *primary_name,
-		[in] [string,charset(UTF16)] uint16 *Account,
-		[in] wkssvc_PasswordBuffer *EncryptedPassword,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *primary_name,
+		[in,unique] [string,charset(UTF16)] uint16 *Account,
+		[in,unique] wkssvc_PasswordBuffer *EncryptedPassword,
 		[in] uint32 Reserved
 		);
 
@@ -780,7 +787,7 @@ import "srvsvc.idl", "lsa.idl";
         } wkssvc_ComputerNamesCtr;
 
 	WERROR wkssvc_NetrEnumerateComputerNames(
-		[in] [string,charset(UTF16)] uint16 *server_name,
+		[in,unique] [string,charset(UTF16)] uint16 *server_name,
 		[in] wkssvc_ComputerNameType name_type,
 		[in] uint32 Reserved,
 		[out,ref] wkssvc_ComputerNamesCtr **ctr
diff --git a/source4/librpc/ndr.pc.in b/source4/librpc/ndr.pc.in
new file mode 100644
index 0000000000..ed4c459214
--- /dev/null
+++ b/source4/librpc/ndr.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: ndr
+Description: Network Data Representation Core Library
+Requires: samba-config talloc
+Version: 0.0.1
+Libs: -L${libdir} -lndr 
+Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/main.mk b/source4/main.mk
index 7be6032256..769cc4f1e4 100644
--- a/source4/main.mk
+++ b/source4/main.mk
@@ -35,13 +35,13 @@ include kdc/config.mk
 DEFAULT_HEADERS = $(srcdir)/lib/util/dlinklist.h \
 		  $(srcdir)/version.h
 
-binaries: $(BINARIES)
-libraries: $(STATIC_LIBS) $(SHARED_LIBS)
-modules: $(SHARED_MODULES)
-headers: $(PUBLIC_HEADERS) $(DEFAULT_HEADERS)
-manpages: $(MANPAGES)
-all: showflags $(ALL_PREDEP) bin/asn1_compile bin/compile_et binaries modules pythonmods
-everything: all libraries headers
+binaries:: $(BINARIES)
+libraries:: $(STATIC_LIBS) $(SHARED_LIBS)
+modules:: $(SHARED_MODULES)
+headers:: $(PUBLIC_HEADERS) $(DEFAULT_HEADERS)
+manpages:: $(MANPAGES)
+all:: showflags $(ALL_PREDEP) bin/asn1_compile bin/compile_et binaries modules pythonmods
+everything:: all libraries headers
 
 LD_LIBPATH_OVERRIDE = $(LIB_PATH_VAR)=$(builddir)/bin/shared
 
@@ -49,9 +49,9 @@ LD_LIBPATH_OVERRIDE = $(LIB_PATH_VAR)=$(builddir)/bin/shared
 # needed by samba3's 'make test' and the build-farm
 # scripts use that it as fallback in case
 # 'make everything' fails
-testsuite: bin/smbclient bin/cifsdd bin/smbtorture bin/nmblookup
+testsuite:: bin/smbclient bin/cifsdd bin/smbtorture bin/nmblookup
 
-showlayout: 
+showlayout:: 
 	@echo 'Samba will be installed into:'
 	@echo '  basedir:     $(BASEDIR)'
 	@echo '  bindir:      $(BINDIR)'
@@ -72,30 +72,14 @@ showlayout:
 	@echo '  datadir:     $(DATADIR)'
 	@echo '  winbindd_socket_dir:  $(WINBINDD_SOCKET_DIR)'
 
-showflags:
-	@echo 'Samba will be compiled with flags:'
-	@echo '  CPP        = $(CPP)'
-	@echo '  CPPFLAGS   = $(CPPFLAGS)'
-	@echo '  CC         = $(CC)'
-	@echo '  CFLAGS     = $(CFLAGS)'
-	@echo '  PICFLAG    = $(PICFLAG)'
-	@echo '  BNLD       = $(BNLD)'
-	@echo '  BNLD_FLAGS = $(BNLD_FLAGS)'
-	@echo '  STLD       = $(STLD)'
-	@echo '  STLD_FLAGS = $(STLD_FLAGS)'
-	@echo '  SHLD       = $(SHLD)'
-	@echo '  SHLD_FLAGS = $(SHLD_FLAGS)'
-	@echo '  MDLD       = $(MDLD)'
-	@echo '  MDLD_FLAGS = $(MDLD_FLAGS)'
-	@echo '  SHLIBEXT   = $(SHLIBEXT)'
+showflags::
 	@echo '  srcdir     = $(srcdir)'
 	@echo '  builddir   = $(builddir)'
-	@echo '  pwd        = '`/bin/pwd`
 
 # The permissions to give the executables
 INSTALLPERMS = 0755
 
-install: showlayout everything installbin installdat installswat installmisc installlib \
+install:: showlayout everything installbin installdat installswat installmisc installlib \
 	installheader installpc installplugins
 
 # DESTDIR is used here to prevent packagers wasting their time
@@ -106,7 +90,7 @@ install: showlayout everything installbin installdat installswat installmisc ins
 # the removal of DESTDIR. Do not remove it even though you think it
 # is not used.
 
-installdirs:
+installdirs::
 	@$(SHELL) $(srcdir)/script/installdirs.sh \
 		$(DESTDIR)$(BASEDIR) \
 		$(DESTDIR)$(BINDIR) \
@@ -126,7 +110,7 @@ installdirs:
 		$(DESTDIR)$(PKGCONFIGDIR) \
 		$(DESTDIR)$(CONFIGDIR) \
 
-installbin: $(SBIN_PROGS) $(BIN_PROGS) $(TORTURE_PROGS) installdirs
+installbin:: $(SBIN_PROGS) $(BIN_PROGS) $(TORTURE_PROGS) installdirs
 	@$(SHELL) $(srcdir)/script/installbin.sh \
 		$(INSTALLPERMS) \
 		$(DESTDIR)$(BASEDIR) \
@@ -146,58 +130,52 @@ installbin: $(SBIN_PROGS) $(BIN_PROGS) $(TORTURE_PROGS) installdirs
 		$(DESTDIR)$(TORTUREDIR) \
 		$(TORTURE_PROGS)
 
-installlib: $(INSTALLABLE_SHARED_LIBS) $(STATIC_LIBS) installdirs
+installlib:: $(INSTALLABLE_SHARED_LIBS) $(STATIC_LIBS) installdirs
 	@$(SHELL) $(srcdir)/script/installlib.sh $(DESTDIR)$(LIBDIR) "$(SHLIBEXT)" $(INSTALLABLE_SHARED_LIBS) 
 	#@$(SHELL) $(srcdir)/script/installlib.sh $(DESTDIR)$(LIBDIR) "$(STLIBEXT)" $(STATIC_LIBS)
 
-installheader: headers installdirs
+installheader:: headers installdirs
 	@srcdir=$(srcdir) builddir=$(builddir) $(PERL) $(srcdir)/script/installheader.pl $(DESTDIR)$(INCLUDEDIR) $(PUBLIC_HEADERS) $(DEFAULT_HEADERS)
 
-installdat: installdirs
+installdat:: installdirs
 	@$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR)$(DATADIR) $(srcdir)
 
-installswat: installdirs
+installswat:: installdirs
 	@$(SHELL) $(srcdir)/script/installswat.sh $(DESTDIR)$(SWATDIR) $(srcdir)
 
-installman: manpages installdirs
+installman:: manpages installdirs
 	@$(SHELL) $(srcdir)/script/installman.sh $(DESTDIR)$(MANDIR) $(MANPAGES)
 
-installmisc: installdirs
+installmisc:: installdirs
 	@$(SHELL) $(srcdir)/script/installmisc.sh $(srcdir) $(DESTDIR)$(JSDIR) $(DESTDIR)$(SETUPDIR) $(DESTDIR)$(BINDIR)
 
-installpc: installdirs
+installpc:: installdirs
 	@$(SHELL) $(srcdir)/script/installpc.sh $(builddir) $(DESTDIR)$(PKGCONFIGDIR) $(PC_FILES)
 
-uninstall: uninstallbin uninstallman uninstallmisc uninstalllib uninstallheader \
+uninstall:: uninstallbin uninstallman uninstallmisc uninstalllib uninstallheader \
 	uninstallplugins
 
-uninstallmisc:
+uninstallmisc::
 	#FIXME
 
-uninstallbin:
+uninstallbin::
 	@$(SHELL) $(srcdir)/script/uninstallbin.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(SBINDIR) $(DESTDIR)$(LIBDIR) $(DESTDIR)$(VARDIR) $(DESTDIR)$(SBIN_PROGS)
 	@$(SHELL) $(srcdir)/script/uninstallbin.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(BINDIR) $(DESTDIR)$(LIBDIR) $(DESTDIR)$(VARDIR) $(DESTDIR)$(BIN_PROGS)
 	@$(SHELL) $(srcdir)/script/uninstalltorture.sh $(DESTDIR)$(TORTUREDIR) $(TORTURE_PROGS)
 
-uninstalllib:
+uninstalllib::
 	@$(SHELL) $(srcdir)/script/uninstalllib.sh $(DESTDIR)$(LIBDIR) $(SHARED_LIBS)
 	#@$(SHELL) $(srcdir)/script/uninstalllib.sh $(DESTDIR)$(LIBDIR) $(STATIC_LIBS) 
 
-uninstallheader:
+uninstallheader::
 	@$(SHELL) $(srcdir)/script/uninstallheader.sh $(DESTDIR)$(INCLUDEDIR) $(PUBLIC_HEADERS)
 
-uninstallman:
+uninstallman::
 	@$(SHELL) $(srcdir)/script/uninstallman.sh $(DESTDIR)$(MANDIR) $(MANPAGES)
 
 Makefile: config.status $(MK_FILES)
 	./config.status
 
-etags:
-	etags `find $(srcdir) -name "*.[ch]"`
-
-ctags:
-	ctags `find $(srcdir) -name "*.[ch]"`
-
 pidl/Makefile: pidl/Makefile.PL
 	cd pidl && $(PERL) Makefile.PL 
 
@@ -206,10 +184,10 @@ testcov-html:: pidl-testcov
 pidl-testcov: pidl/Makefile
 	cd pidl && cover -test
 
-installpidl: pidl/Makefile
+installpidl:: pidl/Makefile
 	$(MAKE) -C pidl install
 
-uninstallpidl: pidl/Makefile
+uninstallpidl:: pidl/Makefile
 	$(MAKE) -C pidl uninstall
 
 $(IDL_HEADER_FILES) \
@@ -219,10 +197,10 @@ $(IDL_HEADER_FILES) \
 	$(IDL_NDR_EJS_C_FILES) $(IDL_NDR_EJS_H_FILES) \
 	$(IDL_NDR_PY_C_FILES) $(IDL_NDR_PY_H_FILES): idl
 
-idl_full: pidl/lib/Parse/Pidl/IDL.pm pidl/lib/Parse/Pidl/Expr.pm 
+idl_full:: pidl/lib/Parse/Pidl/IDL.pm pidl/lib/Parse/Pidl/Expr.pm 
 	@CPP="$(CPP)" PERL="$(PERL)" srcdir=$(srcdir) $(srcdir)/script/build_idl.sh FULL
 
-idl: pidl/lib/Parse/Pidl/IDL.pm pidl/lib/Parse/Pidl/Expr.pm 
+idl:: pidl/lib/Parse/Pidl/IDL.pm pidl/lib/Parse/Pidl/Expr.pm 
 	@CPP="$(CPP)" PERL="$(PERL)" srcdir=$(srcdir) $(srcdir)/script/build_idl.sh PARTIAL 
 
 pidl/lib/Parse/Pidl/IDL.pm: pidl/idl.yp
@@ -233,139 +211,8 @@ pidl/lib/Parse/Pidl/Expr.pm: pidl/idl.yp
 	-$(YAPP) -m 'Parse::Pidl::Expr' -o pidl/lib/Parse/Pidl/Expr.pm pidl/expr.yp ||\
 		touch pidl/lib/Parse/Pidl/Expr.pm 
 
-include/config.h:
-	@echo "include/config.h not present"
-	@echo "You need to rerun ./autogen.sh and ./configure"
-	@/bin/false
-
-$(srcdir)/version.h: $(srcdir)/VERSION
-	@$(SHELL) script/mkversion.sh VERSION $(srcdir)/version.h $(srcdir)/
-
-regen_version:
-	@$(SHELL) script/mkversion.sh VERSION $(srcdir)/version.h $(srcdir)/
-
-clean_pch:
-	@echo "Removing precompiled headers"
-	@-rm -f include/includes.h.gch
-
-pch: clean_pch include/includes.h.gch
-
-clean:: clean_pch
-	@echo Removing objects
-	@-find . -name '*.o' -exec rm -f '{}' \;
-	@echo Removing hostcc objects
-	@-find . -name '*.ho' -exec rm -f '{}' \;
-	@echo Removing binaries
-	@-rm -f $(BIN_PROGS) $(SBIN_PROGS) $(BINARIES) $(TORTURE_PROGS)
-	@echo Removing libraries
-	@-rm -f $(STATIC_LIBRARIES) $(SHARED_LIBRARIES)
-	@-rm -f bin/static/*.a bin/shared/*.$(SHLIBEXT)
-	@echo Removing modules
-	@-rm -f bin/modules/*/*.$(SHLIBEXT)
-	@-rm -f bin/*_init_module.c
-	@echo Removing dummy targets
-	@-rm -f bin/.*_*
-	@echo Removing generated files
-	@-rm -f bin/*_init_module.c
-	@-rm -rf librpc/gen_* 
-	@echo Removing proto headers
-	@-rm -f $(PROTO_HEADERS)
-
-distclean: clean
-	-rm -f include/config.h include/config_tmp.h include/build.h
-	-rm -f Makefile 
-	-rm -f config.status
-	-rm -f config.log config.cache
-	-rm -f config.pm config.mk
-	-rm -f $(PC_FILES)
-
-removebackup:
-	-rm -f *.bak *~ */*.bak */*~ */*/*.bak */*/*~ */*/*/*.bak */*/*/*~
-
-realdistclean:: distclean removebackup
-	-rm -f include/config_tmp.h.in
-	-rm -f version.h
-	-rm -f configure
-	-rm -f $(MANPAGES)
-
-check:: test
-
-include selftest/config.mk
-
-unused_macros:
-	$(srcdir)/script/find_unused_macros.pl `find . -name "*.[ch]"` | sort
-
-###############################################################################
-# File types
-###############################################################################
-
-.SUFFIXES: .x .c .et .y .l .d .o .h .h.gch .a .$(SHLIBEXT) .1 .1.xml .3 .3.xml .5 .5.xml .7 .7.xml .8 .8.xml .ho .idl .hd
-
-.c.d:
-	@echo "Generating dependencies for $<"
-	@$(DEPENDS)
-
-.c.hd:
-	@echo "Generating host-compiler dependencies for $<"
-	@$(HDEPENDS)
-
-include/includes.d: include/includes.h
-	@echo "Generating dependencies for $<"
-	@$(PCHDEPENDS)
-
-.c.o:
-	@if test -n "$(CC_CHECKER)"; then \
-		echo "Checking  $< with '$(CC_CHECKER)'"; \
-		$(CHECK) ; \
-	fi
-	@echo "Compiling $<"
-	@-mkdir -p `dirname $@`
-	@$(COMPILE) && exit 0 ; \
-		echo "The following command failed:" 1>&2;\
-		echo "$(COMPILE)" 1>&2;\
-		$(COMPILE) >/dev/null 2>&1
-
-.c.ho:
-	@echo "Compiling $< with host compiler"
-	@-mkdir -p `dirname $@`
-	@$(HCOMPILE) && exit 0;\
-		echo "The following command failed:" 1>&2;\
-		echo "$(HCOMPILE)" 1>&2;\
-		$(HCOMPILE) >/dev/null 2>&1
-
-.h.h.gch:
-	@echo "Precompiling $<"
-	@$(PCHCOMPILE)
-
-.y.c:
-	@echo "Building $< with $(YACC)"
-	@-$(srcdir)/script/yacc_compile.sh "$(YACC)" "$<" "$@"
-
-.l.c:
-	@echo "Building $< with $(LEX)"
-	@-$(srcdir)/script/lex_compile.sh "$(LEX)" "$<" "$@"
-
-DOCBOOK_MANPAGE_URL = http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl
-
-.1.xml.1:
-	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
-
-.3.xml.3:
-	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
-
-.5.xml.5:
-	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
-
-.7.xml.7:
-	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
-
-.8.xml.8:
-	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
-
-DEP_FILES = $(patsubst %.ho,%.hd,$(patsubst %.o,%.d,$(ALL_OBJS))) \
-		   include/includes.d
-
-dist:: idl_full manpages configure distclean 
+mkinclude selftest/config.mk
+mkinclude rules.mk
 
-configure: 
-	./autogen.sh
+showflags::
+	@echo '  pwd        = '`/bin/pwd`
diff --git a/source4/nbt_server/nbt_server.c b/source4/nbt_server/nbt_server.c
index 1718ef7f2e..2ac1fb4ef3 100644
--- a/source4/nbt_server/nbt_server.c
+++ b/source4/nbt_server/nbt_server.c
@@ -89,19 +89,9 @@ static void nbtd_task_init(struct task_server *task)
 
 
 /*
-  initialise the nbt server
- */
-static NTSTATUS nbtd_init(struct event_context *event_ctx, struct loadparm_context *lp_ctx, const struct model_ops *model_ops)
-{
-	return task_server_startup(event_ctx, lp_ctx, 
-				   model_ops, nbtd_task_init);
-}
-
-
-/*
   register ourselves as a available server
 */
 NTSTATUS server_service_nbtd_init(void)
 {
-	return register_server_service("nbt", nbtd_init);
+	return register_server_service("nbt", nbtd_task_init);
 }
diff --git a/source4/nsswitch/config.m4 b/source4/nsswitch/config.m4
index bb10c28866..a3b7412841 100644
--- a/source4/nsswitch/config.m4
+++ b/source4/nsswitch/config.m4
@@ -3,7 +3,6 @@ AC_CHECK_HEADERS(nss.h nss_common.h ns_api.h )
 case "$host_os" in
 	*linux*)
 		SMB_LIBRARY(nss_winbind,
-			    [Linux Name service switch library using winbind],
 			    [nsswitch/winbind_nss_linux.o],
 			    [LIBWINBIND-CLIENT],
 			    [2],[2])
diff --git a/source4/param/config.mk b/source4/param/config.mk
index f7d5d03d43..8ded5f1a13 100644
--- a/source4/param/config.mk
+++ b/source4/param/config.mk
@@ -1,7 +1,7 @@
 [LIBRARY::LIBSAMBA-CONFIG]
-DESCRIPTION = Reading Samba configuration files
 VERSION = 0.0.1
 SO_VERSION = 0
+PC_FILE = samba-config.pc
 OBJ_FILES = loadparm.o \
 			params.o \
 			generic.o \
diff --git a/source4/param/loadparm.c b/source4/param/loadparm.c
index 2b7b9dd7da..9ec5a59d15 100644
--- a/source4/param/loadparm.c
+++ b/source4/param/loadparm.c
@@ -2408,6 +2408,8 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
 	lp_do_global_parameter_var(lp_ctx, "setup directory", "%s", 
 				   dyn_SETUPDIR);
 
+	lp_do_global_parameter(lp_ctx, "prefork children:smb", "4");
+
 	for (i = 0; parm_table[i].label; i++) {
 		if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) {
 			lp_ctx->flags[i] |= FLAG_DEFAULT;
diff --git a/source4/param/param.i b/source4/param/param.i
index eeecb0e5b9..7322302117 100644
--- a/source4/param/param.i
+++ b/source4/param/param.i
@@ -50,6 +50,7 @@ typedef struct loadparm_context {
     %extend {
         loadparm_context(TALLOC_CTX *mem_ctx) { return loadparm_init(mem_ctx); }
         bool load(const char *filename) { return lp_load($self, filename); }
+        bool load_default() { return lp_load_default($self); }
 #ifdef SWIGPYTHON
         int __len__() { return lp_numservices($self); }
         struct loadparm_service *__getitem__(const char *name) { return lp_service($self, name); }
diff --git a/source4/param/param.py b/source4/param/param.py
index 66b51e5d3b..5adf7a4ecc 100644
--- a/source4/param/param.py
+++ b/source4/param/param.py
@@ -64,6 +64,7 @@ class LoadParm(object):
         _param.LoadParm_swiginit(self,_param.new_LoadParm(*args, **kwargs))
     __swig_destroy__ = _param.delete_LoadParm
 LoadParm.load = new_instancemethod(_param.LoadParm_load,None,LoadParm)
+LoadParm.load_default = new_instancemethod(_param.LoadParm_load_default,None,LoadParm)
 LoadParm.__len__ = new_instancemethod(_param.LoadParm___len__,None,LoadParm)
 LoadParm.__getitem__ = new_instancemethod(_param.LoadParm___getitem__,None,LoadParm)
 LoadParm.configfile = new_instancemethod(_param.LoadParm_configfile,None,LoadParm)
diff --git a/source4/param/param_wrap.c b/source4/param/param_wrap.c
index d8be725c5e..275e2d67ec 100644
--- a/source4/param/param_wrap.c
+++ b/source4/param/param_wrap.c
@@ -2602,6 +2602,7 @@ SWIGINTERNINLINE PyObject*
   return PyBool_FromLong(value ? 1 : 0);
 }
 
+SWIGINTERN bool loadparm_context_load_default(loadparm_context *self){ return lp_load_default(self); }
 SWIGINTERN int loadparm_context___len__(loadparm_context *self){ return lp_numservices(self); }
 
   #define SWIG_From_long   PyInt_FromLong 
@@ -2840,6 +2841,34 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_LoadParm_load_default(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  loadparm_context *arg1 = (loadparm_context *) 0 ;
+  bool result;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  PyObject * obj0 = 0 ;
+  char *  kwnames[] = {
+    (char *) "self", NULL 
+  };
+  
+  arg1 = loadparm_init(NULL);
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"|O:LoadParm_load_default",kwnames,&obj0)) SWIG_fail;
+  if (obj0) {
+    res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_loadparm_context, 0 |  0 );
+    if (!SWIG_IsOK(res1)) {
+      SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "LoadParm_load_default" "', argument " "1"" of type '" "loadparm_context *""'"); 
+    }
+    arg1 = (loadparm_context *)(argp1);
+  }
+  result = (bool)loadparm_context_load_default(arg1);
+  resultobj = SWIG_From_bool((bool)(result));
+  return resultobj;
+fail:
+  return NULL;
+}
+
+
 SWIGINTERN PyObject *_wrap_LoadParm___len__(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
   PyObject *resultobj = 0;
   loadparm_context *arg1 = (loadparm_context *) 0 ;
@@ -4050,6 +4079,7 @@ SWIGINTERN PyObject *Swig_var_default_config_get(void) {
 static PyMethodDef SwigMethods[] = {
 	 { (char *)"new_LoadParm", (PyCFunction)_wrap_new_LoadParm, METH_NOARGS, NULL},
 	 { (char *)"LoadParm_load", (PyCFunction) _wrap_LoadParm_load, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"LoadParm_load_default", (PyCFunction) _wrap_LoadParm_load_default, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm___len__", (PyCFunction) _wrap_LoadParm___len__, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm___getitem__", (PyCFunction) _wrap_LoadParm___getitem__, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"LoadParm_configfile", (PyCFunction) _wrap_LoadParm_configfile, METH_VARARGS | METH_KEYWORDS, NULL},
diff --git a/source4/param/samba-config.pc.in b/source4/param/samba-config.pc.in
new file mode 100644
index 0000000000..801f6aeda4
--- /dev/null
+++ b/source4/param/samba-config.pc.in
@@ -0,0 +1,10 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: samba-config
+Description: Reading Samba configuration files
+Version: 0.0.1
+Libs: -L${libdir} -lsamba-config 
+Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/param/tests/bindings.py b/source4/param/tests/bindings.py
index 9ea1c00daf..0dd186b9df 100644
--- a/source4/param/tests/bindings.py
+++ b/source4/param/tests/bindings.py
@@ -46,6 +46,9 @@ class LoadParmTestCase(unittest.TestCase):
         self.assertTrue(file.is_myname("BLA"))
         self.assertFalse(file.is_myname("FOOBAR"))
 
+    def test_load_default(self):
+        file = param.LoadParm()
+        file.load_default()
 
 class ParamTestCase(unittest.TestCase):
     def test_init(self):
diff --git a/source4/pidl/idl.yp b/source4/pidl/idl.yp
index d2543c580c..028b628e18 100644
--- a/source4/pidl/idl.yp
+++ b/source4/pidl/idl.yp
@@ -293,12 +293,7 @@ properties: property          { $_[1] }
 ;
 
 property: identifier                   {{ "$_[1]" => "1"     }}
-          | identifier '(' listtext ')' {{ "$_[1]" => "$_[3]" }}
-;
-
-listtext:
-    anytext 
-    | listtext ',' anytext { "$_[1] $_[3]" }
+          | identifier '(' commalisttext ')' {{ "$_[1]" => "$_[3]" }}
 ;
 
 commalisttext:
diff --git a/source4/pidl/lib/Parse/Pidl/CUtil.pm b/source4/pidl/lib/Parse/Pidl/CUtil.pm
index bd7b16812c..9deb6ee177 100644
--- a/source4/pidl/lib/Parse/Pidl/CUtil.pm
+++ b/source4/pidl/lib/Parse/Pidl/CUtil.pm
@@ -6,7 +6,7 @@ package Parse::Pidl::CUtil;
 
 require Exporter;
 @ISA = qw(Exporter);
-@EXPORT = qw(get_pointer_to get_value_of);
+@EXPORT = qw(get_pointer_to get_value_of get_array_element);
 use vars qw($VERSION);
 $VERSION = '0.01';
 
@@ -36,4 +36,17 @@ sub get_value_of($)
 	}
 }
 
+sub get_array_element($$)
+{
+	my ($var_name, $idx) = @_;
+
+	if ($var_name =~ /^\*.*$/) {
+		$var_name = "($var_name)";
+	} elsif ($var_name =~ /^\&.*$/) {
+		$var_name = "($var_name)";
+	}
+
+	return "$var_name"."[$idx]";
+}
+
 1;
diff --git a/source4/pidl/lib/Parse/Pidl/Compat.pm b/source4/pidl/lib/Parse/Pidl/Compat.pm
index 7939bb2df2..7519021144 100644
--- a/source4/pidl/lib/Parse/Pidl/Compat.pm
+++ b/source4/pidl/lib/Parse/Pidl/Compat.pm
@@ -148,10 +148,6 @@ sub CheckInterface($)
 {
 	my $if = shift;
 
-	if (has_property($if, "pointer_default_top") and 
-		$if->{PROPERTIES}->{pointer_default_top} ne "ref") {
-		warning($if, "pointer_default_top() is pidl-specific");
-	}
 }
 
 sub Check($)
diff --git a/source4/pidl/lib/Parse/Pidl/IDL.pm b/source4/pidl/lib/Parse/Pidl/IDL.pm
index 35e1d7bcd7..aeee69e306 100644
--- a/source4/pidl/lib/Parse/Pidl/IDL.pm
+++ b/source4/pidl/lib/Parse/Pidl/IDL.pm
@@ -124,7 +124,7 @@ sub new {
 		}
 	},
 	{#State 16
-		DEFAULT => -116
+		DEFAULT => -114
 	},
 	{#State 17
 		DEFAULT => -11
@@ -184,7 +184,7 @@ sub new {
 		}
 	},
 	{#State 26
-		DEFAULT => -112
+		DEFAULT => -110
 	},
 	{#State 27
 		ACTIONS => {
@@ -263,17 +263,17 @@ sub new {
 	},
 	{#State 40
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
 			'text' => 61,
-			'listtext' => 57,
 			'anytext' => 56,
-			'constant' => 58
+			'constant' => 57,
+			'commalisttext' => 59
 		}
 	},
 	{#State 41
@@ -392,28 +392,28 @@ sub new {
 		DEFAULT => -89
 	},
 	{#State 57
-		ACTIONS => {
-			"," => 97,
-			")" => 98
-		}
+		DEFAULT => -93
 	},
 	{#State 58
-		DEFAULT => -95
+		DEFAULT => -113
 	},
 	{#State 59
-		DEFAULT => -115
+		ACTIONS => {
+			"," => 97,
+			")" => 98
+		}
 	},
 	{#State 60
-		DEFAULT => -94
+		DEFAULT => -92
 	},
 	{#State 61
-		DEFAULT => -96
+		DEFAULT => -94
 	},
 	{#State 62
 		ACTIONS => {
 			";" => 99
 		},
-		DEFAULT => -117,
+		DEFAULT => -115,
 		GOTOS => {
 			'optional_semicolon' => 100
 		}
@@ -430,7 +430,7 @@ sub new {
 		ACTIONS => {
 			";" => 99
 		},
-		DEFAULT => -117,
+		DEFAULT => -115,
 		GOTOS => {
 			'optional_semicolon' => 102
 		}
@@ -466,7 +466,7 @@ sub new {
 		ACTIONS => {
 			'IDENTIFIER' => 104
 		},
-		DEFAULT => -114,
+		DEFAULT => -112,
 		GOTOS => {
 			'optional_identifier' => 105
 		}
@@ -501,7 +501,7 @@ sub new {
 		ACTIONS => {
 			'IDENTIFIER' => 104
 		},
-		DEFAULT => -114,
+		DEFAULT => -112,
 		GOTOS => {
 			'optional_identifier' => 107
 		}
@@ -516,7 +516,7 @@ sub new {
 		ACTIONS => {
 			'IDENTIFIER' => 104
 		},
-		DEFAULT => -114,
+		DEFAULT => -112,
 		GOTOS => {
 			'optional_identifier' => 108
 		}
@@ -525,7 +525,7 @@ sub new {
 		ACTIONS => {
 			'IDENTIFIER' => 104
 		},
-		DEFAULT => -114,
+		DEFAULT => -112,
 		GOTOS => {
 			'optional_identifier' => 109
 		}
@@ -549,242 +549,242 @@ sub new {
 	},
 	{#State 82
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
 			'anytext' => 112,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 83
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
 			'anytext' => 113,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 84
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
 			'anytext' => 114,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 85
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
 			'anytext' => 115,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 86
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
 			'anytext' => 116,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 87
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
 			'anytext' => 117,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 88
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
 			'anytext' => 118,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 89
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 119,
+			'anytext' => 56,
 			'text' => 61,
-			'constant' => 58,
-			'commalisttext' => 120
+			'constant' => 57,
+			'commalisttext' => 119
 		}
 	},
 	{#State 90
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 121,
+			'anytext' => 120,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 91
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 122,
+			'anytext' => 121,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 92
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 123,
+			'anytext' => 122,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 93
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 119,
+			'anytext' => 56,
 			'text' => 61,
-			'constant' => 58,
-			'commalisttext' => 124
+			'constant' => 57,
+			'commalisttext' => 123
 		}
 	},
 	{#State 94
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 125,
+			'anytext' => 124,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 95
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 126,
+			'anytext' => 125,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 96
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 127,
+			'anytext' => 126,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 97
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 128,
+			'anytext' => 127,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
 	{#State 98
 		DEFAULT => -88
 	},
 	{#State 99
-		DEFAULT => -118
+		DEFAULT => -116
 	},
 	{#State 100
 		DEFAULT => -13
 	},
 	{#State 101
 		ACTIONS => {
-			";" => 129
+			";" => 128
 		}
 	},
 	{#State 102
@@ -795,20 +795,20 @@ sub new {
 			'IDENTIFIER' => 26
 		},
 		GOTOS => {
-			'identifier' => 130
+			'identifier' => 129
 		}
 	},
 	{#State 104
-		DEFAULT => -113
+		DEFAULT => -111
 	},
 	{#State 105
 		ACTIONS => {
-			"{" => 132
+			"{" => 131
 		},
 		DEFAULT => -68,
 		GOTOS => {
-			'union_body' => 133,
-			'opt_union_body' => 131
+			'union_body' => 132,
+			'opt_union_body' => 130
 		}
 	},
 	{#State 106
@@ -816,46 +816,46 @@ sub new {
 	},
 	{#State 107
 		ACTIONS => {
-			"{" => 135
+			"{" => 134
 		},
 		DEFAULT => -58,
 		GOTOS => {
-			'struct_body' => 134,
-			'opt_struct_body' => 136
+			'struct_body' => 133,
+			'opt_struct_body' => 135
 		}
 	},
 	{#State 108
 		ACTIONS => {
-			"{" => 137
+			"{" => 136
 		},
 		DEFAULT => -41,
 		GOTOS => {
-			'opt_enum_body' => 139,
-			'enum_body' => 138
+			'opt_enum_body' => 138,
+			'enum_body' => 137
 		}
 	},
 	{#State 109
 		ACTIONS => {
-			"{" => 141
+			"{" => 140
 		},
 		DEFAULT => -49,
 		GOTOS => {
-			'bitmap_body' => 142,
-			'opt_bitmap_body' => 140
+			'bitmap_body' => 141,
+			'opt_bitmap_body' => 139
 		}
 	},
 	{#State 110
 		ACTIONS => {
-			"(" => 143
+			"(" => 142
 		}
 	},
 	{#State 111
 		ACTIONS => {
 			'IDENTIFIER' => 26,
-			"*" => 145
+			"*" => 144
 		},
 		GOTOS => {
-			'identifier' => 144
+			'identifier' => 143
 		}
 	},
 	{#State 112
@@ -876,7 +876,7 @@ sub new {
 			"." => 95,
 			">" => 96
 		},
-		DEFAULT => -106
+		DEFAULT => -104
 	},
 	{#State 113
 		ACTIONS => {
@@ -887,7 +887,7 @@ sub new {
 			"{" => 89,
 			"=" => 92
 		},
-		DEFAULT => -97
+		DEFAULT => -95
 	},
 	{#State 114
 		ACTIONS => {
@@ -907,7 +907,7 @@ sub new {
 			"." => 95,
 			">" => 96
 		},
-		DEFAULT => -101
+		DEFAULT => -99
 	},
 	{#State 115
 		ACTIONS => {
@@ -927,7 +927,7 @@ sub new {
 			"." => 95,
 			">" => 96
 		},
-		DEFAULT => -109
+		DEFAULT => -107
 	},
 	{#State 116
 		ACTIONS => {
@@ -938,7 +938,7 @@ sub new {
 			"{" => 89,
 			"=" => 92
 		},
-		DEFAULT => -108
+		DEFAULT => -106
 	},
 	{#State 117
 		ACTIONS => {
@@ -949,7 +949,7 @@ sub new {
 			"{" => 89,
 			"=" => 92
 		},
-		DEFAULT => -99
+		DEFAULT => -97
 	},
 	{#State 118
 		ACTIONS => {
@@ -969,35 +969,15 @@ sub new {
 			"." => 95,
 			">" => 96
 		},
-		DEFAULT => -105
+		DEFAULT => -103
 	},
 	{#State 119
 		ACTIONS => {
-			"-" => 83,
-			":" => 82,
-			"<" => 84,
-			"+" => 86,
-			"~" => 85,
-			"*" => 87,
-			"?" => 88,
-			"{" => 89,
-			"&" => 90,
-			"/" => 91,
-			"=" => 92,
-			"(" => 93,
-			"|" => 94,
-			"." => 95,
-			">" => 96
-		},
-		DEFAULT => -91
-	},
-	{#State 120
-		ACTIONS => {
-			"}" => 146,
-			"," => 147
+			"}" => 145,
+			"," => 97
 		}
 	},
-	{#State 121
+	{#State 120
 		ACTIONS => {
 			":" => 82,
 			"<" => 84,
@@ -1006,9 +986,9 @@ sub new {
 			"{" => 89,
 			"=" => 92
 		},
-		DEFAULT => -103
+		DEFAULT => -101
 	},
-	{#State 122
+	{#State 121
 		ACTIONS => {
 			":" => 82,
 			"<" => 84,
@@ -1017,9 +997,9 @@ sub new {
 			"{" => 89,
 			"=" => 92
 		},
-		DEFAULT => -104
+		DEFAULT => -102
 	},
-	{#State 123
+	{#State 122
 		ACTIONS => {
 			"-" => 83,
 			":" => 82,
@@ -1037,15 +1017,15 @@ sub new {
 			"." => 95,
 			">" => 96
 		},
-		DEFAULT => -107
+		DEFAULT => -105
 	},
-	{#State 124
+	{#State 123
 		ACTIONS => {
-			"," => 147,
-			")" => 148
+			"," => 97,
+			")" => 146
 		}
 	},
-	{#State 125
+	{#State 124
 		ACTIONS => {
 			":" => 82,
 			"<" => 84,
@@ -1054,9 +1034,9 @@ sub new {
 			"{" => 89,
 			"=" => 92
 		},
-		DEFAULT => -102
+		DEFAULT => -100
 	},
-	{#State 126
+	{#State 125
 		ACTIONS => {
 			":" => 82,
 			"<" => 84,
@@ -1065,9 +1045,9 @@ sub new {
 			"{" => 89,
 			"=" => 92
 		},
-		DEFAULT => -98
+		DEFAULT => -96
 	},
-	{#State 127
+	{#State 126
 		ACTIONS => {
 			":" => 82,
 			"<" => 84,
@@ -1076,9 +1056,9 @@ sub new {
 			"{" => 89,
 			"=" => 92
 		},
-		DEFAULT => -100
+		DEFAULT => -98
 	},
-	{#State 128
+	{#State 127
 		ACTIONS => {
 			"-" => 83,
 			":" => 82,
@@ -1098,221 +1078,207 @@ sub new {
 		},
 		DEFAULT => -90
 	},
-	{#State 129
+	{#State 128
 		DEFAULT => -15
 	},
-	{#State 130
+	{#State 129
 		ACTIONS => {
-			"[" => 149
+			"[" => 147
 		},
 		DEFAULT => -80,
 		GOTOS => {
-			'array_len' => 150
+			'array_len' => 148
 		}
 	},
-	{#State 131
+	{#State 130
 		DEFAULT => -70
 	},
-	{#State 132
+	{#State 131
 		DEFAULT => -65,
 		GOTOS => {
-			'union_elements' => 151
+			'union_elements' => 149
 		}
 	},
-	{#State 133
+	{#State 132
 		DEFAULT => -69
 	},
-	{#State 134
+	{#State 133
 		DEFAULT => -59
 	},
-	{#State 135
+	{#State 134
 		DEFAULT => -74,
 		GOTOS => {
-			'element_list1' => 152
+			'element_list1' => 150
 		}
 	},
-	{#State 136
+	{#State 135
 		DEFAULT => -60
 	},
-	{#State 137
+	{#State 136
 		ACTIONS => {
 			'IDENTIFIER' => 26
 		},
 		GOTOS => {
-			'identifier' => 153,
-			'enum_element' => 154,
-			'enum_elements' => 155
+			'identifier' => 151,
+			'enum_element' => 152,
+			'enum_elements' => 153
 		}
 	},
-	{#State 138
+	{#State 137
 		DEFAULT => -42
 	},
-	{#State 139
+	{#State 138
 		DEFAULT => -43
 	},
-	{#State 140
+	{#State 139
 		DEFAULT => -51
 	},
-	{#State 141
+	{#State 140
 		ACTIONS => {
 			'IDENTIFIER' => 26
 		},
 		DEFAULT => -54,
 		GOTOS => {
-			'identifier' => 158,
-			'bitmap_element' => 157,
-			'bitmap_elements' => 156,
-			'opt_bitmap_elements' => 159
+			'identifier' => 156,
+			'bitmap_element' => 155,
+			'bitmap_elements' => 154,
+			'opt_bitmap_elements' => 157
 		}
 	},
-	{#State 142
+	{#State 141
 		DEFAULT => -50
 	},
-	{#State 143
+	{#State 142
 		ACTIONS => {
 			"," => -76,
-			"void" => 163,
+			"void" => 161,
 			")" => -76
 		},
 		DEFAULT => -83,
 		GOTOS => {
-			'base_element' => 160,
-			'element_list2' => 162,
-			'property_list' => 161
+			'base_element' => 158,
+			'element_list2' => 160,
+			'property_list' => 159
 		}
 	},
-	{#State 144
+	{#State 143
 		ACTIONS => {
-			"[" => 149,
-			"=" => 165
+			"[" => 147,
+			"=" => 163
 		},
 		GOTOS => {
-			'array_len' => 164
+			'array_len' => 162
 		}
 	},
-	{#State 145
+	{#State 144
 		DEFAULT => -73
 	},
-	{#State 146
-		ACTIONS => {
-			'CONSTANT' => 59,
-			'TEXT' => 16,
-			'IDENTIFIER' => 26
-		},
-		DEFAULT => -93,
-		GOTOS => {
-			'identifier' => 60,
-			'anytext' => 166,
-			'text' => 61,
-			'constant' => 58
-		}
-	},
-	{#State 147
+	{#State 145
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 167,
+			'anytext' => 164,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
-	{#State 148
+	{#State 146
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 168,
+			'anytext' => 165,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
-	{#State 149
+	{#State 147
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
-			"]" => 169,
+			"]" => 166,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 170,
+			'anytext' => 167,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
-	{#State 150
+	{#State 148
 		ACTIONS => {
-			";" => 171
+			";" => 168
 		}
 	},
-	{#State 151
+	{#State 149
 		ACTIONS => {
-			"}" => 172
+			"}" => 169
 		},
 		DEFAULT => -83,
 		GOTOS => {
-			'optional_base_element' => 174,
-			'property_list' => 173
+			'optional_base_element' => 171,
+			'property_list' => 170
 		}
 	},
-	{#State 152
+	{#State 150
 		ACTIONS => {
-			"}" => 175
+			"}" => 172
 		},
 		DEFAULT => -83,
 		GOTOS => {
-			'base_element' => 176,
-			'property_list' => 161
+			'base_element' => 173,
+			'property_list' => 159
 		}
 	},
-	{#State 153
+	{#State 151
 		ACTIONS => {
-			"=" => 177
+			"=" => 174
 		},
 		DEFAULT => -46
 	},
-	{#State 154
+	{#State 152
 		DEFAULT => -44
 	},
-	{#State 155
+	{#State 153
 		ACTIONS => {
-			"}" => 178,
-			"," => 179
+			"}" => 175,
+			"," => 176
 		}
 	},
-	{#State 156
+	{#State 154
 		ACTIONS => {
-			"," => 180
+			"," => 177
 		},
 		DEFAULT => -55
 	},
-	{#State 157
+	{#State 155
 		DEFAULT => -52
 	},
-	{#State 158
+	{#State 156
 		ACTIONS => {
-			"=" => 181
+			"=" => 178
 		}
 	},
-	{#State 159
+	{#State 157
 		ACTIONS => {
-			"}" => 182
+			"}" => 179
 		}
 	},
-	{#State 160
+	{#State 158
 		DEFAULT => -78
 	},
-	{#State 161
+	{#State 159
 		ACTIONS => {
 			'IDENTIFIER' => 26,
 			"signed" => 75,
@@ -1329,60 +1295,40 @@ sub new {
 			'identifier' => 72,
 			'struct' => 49,
 			'enum' => 52,
-			'type' => 183,
+			'type' => 180,
 			'union' => 54,
 			'sign' => 73
 		}
 	},
-	{#State 162
+	{#State 160
 		ACTIONS => {
-			"," => 184,
-			")" => 185
+			"," => 181,
+			")" => 182
 		}
 	},
-	{#State 163
+	{#State 161
 		DEFAULT => -77
 	},
-	{#State 164
+	{#State 162
 		ACTIONS => {
-			"=" => 186
+			"=" => 183
 		}
 	},
-	{#State 165
+	{#State 163
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 187,
+			'anytext' => 184,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
-	{#State 166
-		ACTIONS => {
-			"-" => 83,
-			":" => 82,
-			"<" => 84,
-			"+" => 86,
-			"~" => 85,
-			"*" => 87,
-			"?" => 88,
-			"{" => 89,
-			"&" => 90,
-			"/" => 91,
-			"=" => 92,
-			"(" => 93,
-			"|" => 94,
-			"." => 95,
-			">" => 96
-		},
-		DEFAULT => -111
-	},
-	{#State 167
+	{#State 164
 		ACTIONS => {
 			"-" => 83,
 			":" => 82,
@@ -1400,9 +1346,9 @@ sub new {
 			"." => 95,
 			">" => 96
 		},
-		DEFAULT => -92
+		DEFAULT => -109
 	},
-	{#State 168
+	{#State 165
 		ACTIONS => {
 			":" => 82,
 			"<" => 84,
@@ -1411,18 +1357,18 @@ sub new {
 			"{" => 89,
 			"=" => 92
 		},
-		DEFAULT => -110
+		DEFAULT => -108
 	},
-	{#State 169
+	{#State 166
 		ACTIONS => {
-			"[" => 149
+			"[" => 147
 		},
 		DEFAULT => -80,
 		GOTOS => {
-			'array_len' => 188
+			'array_len' => 185
 		}
 	},
-	{#State 170
+	{#State 167
 		ACTIONS => {
 			"-" => 83,
 			":" => 82,
@@ -1438,130 +1384,130 @@ sub new {
 			"(" => 93,
 			"*" => 87,
 			"." => 95,
-			"]" => 189,
+			"]" => 186,
 			">" => 96
 		}
 	},
-	{#State 171
+	{#State 168
 		DEFAULT => -27
 	},
-	{#State 172
+	{#State 169
 		DEFAULT => -67
 	},
-	{#State 173
+	{#State 170
 		ACTIONS => {
 			"[" => 20
 		},
 		DEFAULT => -83,
 		GOTOS => {
-			'base_or_empty' => 190,
-			'base_element' => 191,
-			'empty_element' => 192,
-			'property_list' => 193
+			'base_or_empty' => 187,
+			'base_element' => 188,
+			'empty_element' => 189,
+			'property_list' => 190
 		}
 	},
-	{#State 174
+	{#State 171
 		DEFAULT => -66
 	},
-	{#State 175
+	{#State 172
 		DEFAULT => -57
 	},
-	{#State 176
+	{#State 173
 		ACTIONS => {
-			";" => 194
+			";" => 191
 		}
 	},
-	{#State 177
+	{#State 174
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 195,
+			'anytext' => 192,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
-	{#State 178
+	{#State 175
 		DEFAULT => -40
 	},
-	{#State 179
+	{#State 176
 		ACTIONS => {
 			'IDENTIFIER' => 26
 		},
 		GOTOS => {
-			'identifier' => 153,
-			'enum_element' => 196
+			'identifier' => 151,
+			'enum_element' => 193
 		}
 	},
-	{#State 180
+	{#State 177
 		ACTIONS => {
 			'IDENTIFIER' => 26
 		},
 		GOTOS => {
-			'identifier' => 158,
-			'bitmap_element' => 197
+			'identifier' => 156,
+			'bitmap_element' => 194
 		}
 	},
-	{#State 181
+	{#State 178
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 198,
+			'anytext' => 195,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
-	{#State 182
+	{#State 179
 		DEFAULT => -48
 	},
-	{#State 183
+	{#State 180
 		DEFAULT => -72,
 		GOTOS => {
-			'pointers' => 199
+			'pointers' => 196
 		}
 	},
-	{#State 184
+	{#State 181
 		DEFAULT => -83,
 		GOTOS => {
-			'base_element' => 200,
-			'property_list' => 161
+			'base_element' => 197,
+			'property_list' => 159
 		}
 	},
-	{#State 185
+	{#State 182
 		ACTIONS => {
-			";" => 201
+			";" => 198
 		}
 	},
-	{#State 186
+	{#State 183
 		ACTIONS => {
-			'CONSTANT' => 59,
+			'CONSTANT' => 58,
 			'TEXT' => 16,
 			'IDENTIFIER' => 26
 		},
-		DEFAULT => -93,
+		DEFAULT => -91,
 		GOTOS => {
 			'identifier' => 60,
-			'anytext' => 202,
+			'anytext' => 199,
 			'text' => 61,
-			'constant' => 58
+			'constant' => 57
 		}
 	},
-	{#State 187
+	{#State 184
 		ACTIONS => {
 			"-" => 83,
 			":" => 82,
 			"?" => 88,
 			"<" => 84,
-			";" => 203,
+			";" => 200,
 			"+" => 86,
 			"~" => 85,
 			"&" => 90,
@@ -1575,34 +1521,34 @@ sub new {
 			">" => 96
 		}
 	},
-	{#State 188
+	{#State 185
 		DEFAULT => -81
 	},
-	{#State 189
+	{#State 186
 		ACTIONS => {
-			"[" => 149
+			"[" => 147
 		},
 		DEFAULT => -80,
 		GOTOS => {
-			'array_len' => 204
+			'array_len' => 201
 		}
 	},
-	{#State 190
+	{#State 187
 		DEFAULT => -64
 	},
-	{#State 191
+	{#State 188
 		ACTIONS => {
-			";" => 205
+			";" => 202
 		}
 	},
-	{#State 192
+	{#State 189
 		DEFAULT => -63
 	},
-	{#State 193
+	{#State 190
 		ACTIONS => {
 			'IDENTIFIER' => 26,
 			"signed" => 75,
-			";" => 206,
+			";" => 203,
 			'void' => 69,
 			"unsigned" => 79,
 			"[" => 20
@@ -1616,15 +1562,15 @@ sub new {
 			'identifier' => 72,
 			'struct' => 49,
 			'enum' => 52,
-			'type' => 183,
+			'type' => 180,
 			'union' => 54,
 			'sign' => 73
 		}
 	},
-	{#State 194
+	{#State 191
 		DEFAULT => -75
 	},
-	{#State 195
+	{#State 192
 		ACTIONS => {
 			"-" => 83,
 			":" => 82,
@@ -1644,13 +1590,13 @@ sub new {
 		},
 		DEFAULT => -47
 	},
-	{#State 196
+	{#State 193
 		DEFAULT => -45
 	},
-	{#State 197
+	{#State 194
 		DEFAULT => -53
 	},
-	{#State 198
+	{#State 195
 		ACTIONS => {
 			"-" => 83,
 			":" => 82,
@@ -1670,28 +1616,28 @@ sub new {
 		},
 		DEFAULT => -56
 	},
-	{#State 199
+	{#State 196
 		ACTIONS => {
 			'IDENTIFIER' => 26,
-			"*" => 145
+			"*" => 144
 		},
 		GOTOS => {
-			'identifier' => 207
+			'identifier' => 204
 		}
 	},
-	{#State 200
+	{#State 197
 		DEFAULT => -79
 	},
-	{#State 201
+	{#State 198
 		DEFAULT => -26
 	},
-	{#State 202
+	{#State 199
 		ACTIONS => {
 			"-" => 83,
 			":" => 82,
 			"?" => 88,
 			"<" => 84,
-			";" => 208,
+			";" => 205,
 			"+" => 86,
 			"~" => 85,
 			"&" => 90,
@@ -1705,31 +1651,31 @@ sub new {
 			">" => 96
 		}
 	},
-	{#State 203
+	{#State 200
 		DEFAULT => -24
 	},
-	{#State 204
+	{#State 201
 		DEFAULT => -82
 	},
-	{#State 205
+	{#State 202
 		DEFAULT => -62
 	},
-	{#State 206
+	{#State 203
 		DEFAULT => -61
 	},
-	{#State 207
+	{#State 204
 		ACTIONS => {
-			"[" => 149
+			"[" => 147
 		},
 		DEFAULT => -80,
 		GOTOS => {
-			'array_len' => 209
+			'array_len' => 206
 		}
 	},
-	{#State 208
+	{#State 205
 		DEFAULT => -25
 	},
-	{#State 209
+	{#State 206
 		DEFAULT => -71
 	}
 ],
@@ -1744,43 +1690,43 @@ sub new {
 	[#Rule 2
 		 'idl', 2,
 sub
-#line 19 "idl.yp"
+#line 19 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 3
 		 'idl', 2,
 sub
-#line 20 "idl.yp"
+#line 20 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 4
 		 'idl', 2,
 sub
-#line 21 "idl.yp"
+#line 21 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 5
 		 'idl', 2,
 sub
-#line 22 "idl.yp"
+#line 22 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 6
 		 'idl', 2,
 sub
-#line 23 "idl.yp"
+#line 23 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 7
 		 'idl', 2,
 sub
-#line 24 "idl.yp"
+#line 24 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 8
 		 'import', 3,
 sub
-#line 27 "idl.yp"
+#line 27 "pidl/idl.yp"
 {{
 			"TYPE" => "IMPORT", 
 			"PATHS" => $_[2],
@@ -1791,7 +1737,7 @@ sub
 	[#Rule 9
 		 'include', 3,
 sub
-#line 34 "idl.yp"
+#line 34 "pidl/idl.yp"
 {{ 
 			"TYPE" => "INCLUDE", 
 			"PATHS" => $_[2],
@@ -1802,7 +1748,7 @@ sub
 	[#Rule 10
 		 'importlib', 3,
 sub
-#line 41 "idl.yp"
+#line 41 "pidl/idl.yp"
 {{ 
 			"TYPE" => "IMPORTLIB", 
 			"PATHS" => $_[2],
@@ -1813,19 +1759,19 @@ sub
 	[#Rule 11
 		 'commalist', 1,
 sub
-#line 50 "idl.yp"
+#line 50 "pidl/idl.yp"
 { [ $_[1] ] }
 	],
 	[#Rule 12
 		 'commalist', 3,
 sub
-#line 51 "idl.yp"
+#line 51 "pidl/idl.yp"
 { push(@{$_[1]}, $_[3]); $_[1] }
 	],
 	[#Rule 13
 		 'coclass', 7,
 sub
-#line 55 "idl.yp"
+#line 55 "pidl/idl.yp"
 {{
                "TYPE" => "COCLASS", 
 	       "PROPERTIES" => $_[1],
@@ -1841,13 +1787,13 @@ sub
 	[#Rule 15
 		 'interface_names', 4,
 sub
-#line 67 "idl.yp"
+#line 67 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 16
 		 'interface', 7,
 sub
-#line 71 "idl.yp"
+#line 71 "pidl/idl.yp"
 {{
                "TYPE" => "INTERFACE", 
 	       "PROPERTIES" => $_[1],
@@ -1860,7 +1806,7 @@ sub
 	[#Rule 17
 		 'cpp_quote', 4,
 sub
-#line 82 "idl.yp"
+#line 82 "pidl/idl.yp"
 {{
 		 "TYPE" => "CPP_QUOTE",
 		 "FILE" => $_[0]->YYData->{FILE},
@@ -1871,13 +1817,13 @@ sub
 	[#Rule 18
 		 'definitions', 1,
 sub
-#line 91 "idl.yp"
+#line 91 "pidl/idl.yp"
 { [ $_[1] ] }
 	],
 	[#Rule 19
 		 'definitions', 2,
 sub
-#line 92 "idl.yp"
+#line 92 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 20
@@ -1895,7 +1841,7 @@ sub
 	[#Rule 24
 		 'const', 7,
 sub
-#line 100 "idl.yp"
+#line 100 "pidl/idl.yp"
 {{
                      "TYPE"  => "CONST", 
 		     "DTYPE"  => $_[2],
@@ -1909,7 +1855,7 @@ sub
 	[#Rule 25
 		 'const', 8,
 sub
-#line 110 "idl.yp"
+#line 110 "pidl/idl.yp"
 {{
                      "TYPE"  => "CONST", 
 		     "DTYPE"  => $_[2],
@@ -1924,7 +1870,7 @@ sub
 	[#Rule 26
 		 'function', 7,
 sub
-#line 124 "idl.yp"
+#line 124 "pidl/idl.yp"
 {{
 		"TYPE" => "FUNCTION",
 		"NAME" => $_[3],
@@ -1938,7 +1884,7 @@ sub
 	[#Rule 27
 		 'typedef', 6,
 sub
-#line 136 "idl.yp"
+#line 136 "pidl/idl.yp"
 {{
 	             "TYPE" => "TYPEDEF", 
                      "PROPERTIES" => $_[1],
@@ -1964,7 +1910,7 @@ sub
 	[#Rule 32
 		 'typedecl', 2,
 sub
-#line 149 "idl.yp"
+#line 149 "pidl/idl.yp"
 { $_[1] }
 	],
 	[#Rule 33
@@ -1976,7 +1922,7 @@ sub
 	[#Rule 35
 		 'existingtype', 2,
 sub
-#line 154 "idl.yp"
+#line 154 "pidl/idl.yp"
 { ($_[1]?$_[1]:"signed") ." $_[2]" }
 	],
 	[#Rule 36
@@ -1991,13 +1937,13 @@ sub
 	[#Rule 39
 		 'type', 1,
 sub
-#line 158 "idl.yp"
+#line 158 "pidl/idl.yp"
 { "void" }
 	],
 	[#Rule 40
 		 'enum_body', 3,
 sub
-#line 160 "idl.yp"
+#line 160 "pidl/idl.yp"
 { $_[2] }
 	],
 	[#Rule 41
@@ -2009,7 +1955,7 @@ sub
 	[#Rule 43
 		 'enum', 4,
 sub
-#line 163 "idl.yp"
+#line 163 "pidl/idl.yp"
 {{
              "TYPE" => "ENUM", 
 			 "PROPERTIES" => $_[1],
@@ -2020,13 +1966,13 @@ sub
 	[#Rule 44
 		 'enum_elements', 1,
 sub
-#line 172 "idl.yp"
+#line 172 "pidl/idl.yp"
 { [ $_[1] ] }
 	],
 	[#Rule 45
 		 'enum_elements', 3,
 sub
-#line 173 "idl.yp"
+#line 173 "pidl/idl.yp"
 { push(@{$_[1]}, $_[3]); $_[1] }
 	],
 	[#Rule 46
@@ -2035,13 +1981,13 @@ sub
 	[#Rule 47
 		 'enum_element', 3,
 sub
-#line 177 "idl.yp"
+#line 177 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 48
 		 'bitmap_body', 3,
 sub
-#line 180 "idl.yp"
+#line 180 "pidl/idl.yp"
 { $_[2] }
 	],
 	[#Rule 49
@@ -2053,7 +1999,7 @@ sub
 	[#Rule 51
 		 'bitmap', 4,
 sub
-#line 183 "idl.yp"
+#line 183 "pidl/idl.yp"
 {{
              "TYPE" => "BITMAP", 
 		     "PROPERTIES" => $_[1],
@@ -2064,13 +2010,13 @@ sub
 	[#Rule 52
 		 'bitmap_elements', 1,
 sub
-#line 192 "idl.yp"
+#line 192 "pidl/idl.yp"
 { [ $_[1] ] }
 	],
 	[#Rule 53
 		 'bitmap_elements', 3,
 sub
-#line 193 "idl.yp"
+#line 193 "pidl/idl.yp"
 { push(@{$_[1]}, $_[3]); $_[1] }
 	],
 	[#Rule 54
@@ -2082,13 +2028,13 @@ sub
 	[#Rule 56
 		 'bitmap_element', 3,
 sub
-#line 198 "idl.yp"
+#line 198 "pidl/idl.yp"
 { "$_[1] ( $_[3] )" }
 	],
 	[#Rule 57
 		 'struct_body', 3,
 sub
-#line 201 "idl.yp"
+#line 201 "pidl/idl.yp"
 { $_[2] }
 	],
 	[#Rule 58
@@ -2100,7 +2046,7 @@ sub
 	[#Rule 60
 		 'struct', 4,
 sub
-#line 205 "idl.yp"
+#line 205 "pidl/idl.yp"
 {{
              "TYPE" => "STRUCT", 
 			 "PROPERTIES" => $_[1],
@@ -2111,7 +2057,7 @@ sub
 	[#Rule 61
 		 'empty_element', 2,
 sub
-#line 214 "idl.yp"
+#line 214 "pidl/idl.yp"
 {{
 		 "NAME" => "",
 		 "TYPE" => "EMPTY",
@@ -2131,7 +2077,7 @@ sub
 	[#Rule 64
 		 'optional_base_element', 2,
 sub
-#line 228 "idl.yp"
+#line 228 "pidl/idl.yp"
 { $_[2]->{PROPERTIES} = FlattenHash([$_[1],$_[2]->{PROPERTIES}]); $_[2] }
 	],
 	[#Rule 65
@@ -2140,13 +2086,13 @@ sub
 	[#Rule 66
 		 'union_elements', 2,
 sub
-#line 233 "idl.yp"
+#line 233 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 67
 		 'union_body', 3,
 sub
-#line 236 "idl.yp"
+#line 236 "pidl/idl.yp"
 { $_[2] }
 	],
 	[#Rule 68
@@ -2158,7 +2104,7 @@ sub
 	[#Rule 70
 		 'union', 4,
 sub
-#line 240 "idl.yp"
+#line 240 "pidl/idl.yp"
 {{
              "TYPE" => "UNION", 
 			 "PROPERTIES" => $_[1],
@@ -2169,7 +2115,7 @@ sub
 	[#Rule 71
 		 'base_element', 5,
 sub
-#line 249 "idl.yp"
+#line 249 "pidl/idl.yp"
 {{
 			   "NAME" => $_[4],
 			   "TYPE" => $_[2],
@@ -2183,25 +2129,25 @@ sub
 	[#Rule 72
 		 'pointers', 0,
 sub
-#line 263 "idl.yp"
+#line 263 "pidl/idl.yp"
 { 0 }
 	],
 	[#Rule 73
 		 'pointers', 2,
 sub
-#line 264 "idl.yp"
+#line 264 "pidl/idl.yp"
 { $_[1]+1 }
 	],
 	[#Rule 74
 		 'element_list1', 0,
 sub
-#line 268 "idl.yp"
+#line 268 "pidl/idl.yp"
 { [] }
 	],
 	[#Rule 75
 		 'element_list1', 3,
 sub
-#line 269 "idl.yp"
+#line 269 "pidl/idl.yp"
 { push(@{$_[1]}, $_[2]); $_[1] }
 	],
 	[#Rule 76
@@ -2213,13 +2159,13 @@ sub
 	[#Rule 78
 		 'element_list2', 1,
 sub
-#line 275 "idl.yp"
+#line 275 "pidl/idl.yp"
 { [ $_[1] ] }
 	],
 	[#Rule 79
 		 'element_list2', 3,
 sub
-#line 276 "idl.yp"
+#line 276 "pidl/idl.yp"
 { push(@{$_[1]}, $_[3]); $_[1] }
 	],
 	[#Rule 80
@@ -2228,13 +2174,13 @@ sub
 	[#Rule 81
 		 'array_len', 3,
 sub
-#line 281 "idl.yp"
+#line 281 "pidl/idl.yp"
 { push(@{$_[3]}, "*"); $_[3] }
 	],
 	[#Rule 82
 		 'array_len', 4,
 sub
-#line 282 "idl.yp"
+#line 282 "pidl/idl.yp"
 { push(@{$_[4]}, "$_[2]"); $_[4] }
 	],
 	[#Rule 83
@@ -2243,178 +2189,169 @@ sub
 	[#Rule 84
 		 'property_list', 4,
 sub
-#line 288 "idl.yp"
+#line 288 "pidl/idl.yp"
 { FlattenHash([$_[1],$_[3]]); }
 	],
 	[#Rule 85
 		 'properties', 1,
 sub
-#line 291 "idl.yp"
+#line 291 "pidl/idl.yp"
 { $_[1] }
 	],
 	[#Rule 86
 		 'properties', 3,
 sub
-#line 292 "idl.yp"
+#line 292 "pidl/idl.yp"
 { FlattenHash([$_[1], $_[3]]); }
 	],
 	[#Rule 87
 		 'property', 1,
 sub
-#line 295 "idl.yp"
+#line 295 "pidl/idl.yp"
 {{ "$_[1]" => "1"     }}
 	],
 	[#Rule 88
 		 'property', 4,
 sub
-#line 296 "idl.yp"
+#line 296 "pidl/idl.yp"
 {{ "$_[1]" => "$_[3]" }}
 	],
 	[#Rule 89
-		 'listtext', 1, undef
-	],
-	[#Rule 90
-		 'listtext', 3,
-sub
-#line 301 "idl.yp"
-{ "$_[1] $_[3]" }
-	],
-	[#Rule 91
 		 'commalisttext', 1, undef
 	],
-	[#Rule 92
+	[#Rule 90
 		 'commalisttext', 3,
 sub
-#line 306 "idl.yp"
+#line 301 "pidl/idl.yp"
 { "$_[1],$_[3]" }
 	],
-	[#Rule 93
+	[#Rule 91
 		 'anytext', 0,
 sub
-#line 310 "idl.yp"
+#line 305 "pidl/idl.yp"
 { "" }
 	],
+	[#Rule 92
+		 'anytext', 1, undef
+	],
+	[#Rule 93
+		 'anytext', 1, undef
+	],
 	[#Rule 94
 		 'anytext', 1, undef
 	],
 	[#Rule 95
-		 'anytext', 1, undef
+		 'anytext', 3,
+sub
+#line 307 "pidl/idl.yp"
+{ "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 96
-		 'anytext', 1, undef
+		 'anytext', 3,
+sub
+#line 308 "pidl/idl.yp"
+{ "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 97
 		 'anytext', 3,
 sub
-#line 312 "idl.yp"
+#line 309 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 98
 		 'anytext', 3,
 sub
-#line 313 "idl.yp"
+#line 310 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 99
 		 'anytext', 3,
 sub
-#line 314 "idl.yp"
+#line 311 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 100
 		 'anytext', 3,
 sub
-#line 315 "idl.yp"
+#line 312 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 101
 		 'anytext', 3,
 sub
-#line 316 "idl.yp"
+#line 313 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 102
 		 'anytext', 3,
 sub
-#line 317 "idl.yp"
+#line 314 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 103
 		 'anytext', 3,
 sub
-#line 318 "idl.yp"
+#line 315 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 104
 		 'anytext', 3,
 sub
-#line 319 "idl.yp"
+#line 316 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 105
 		 'anytext', 3,
 sub
-#line 320 "idl.yp"
+#line 317 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 106
 		 'anytext', 3,
 sub
-#line 321 "idl.yp"
+#line 318 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 107
 		 'anytext', 3,
 sub
-#line 322 "idl.yp"
+#line 319 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]" }
 	],
 	[#Rule 108
-		 'anytext', 3,
-sub
-#line 323 "idl.yp"
-{ "$_[1]$_[2]$_[3]" }
-	],
-	[#Rule 109
-		 'anytext', 3,
-sub
-#line 324 "idl.yp"
-{ "$_[1]$_[2]$_[3]" }
-	],
-	[#Rule 110
 		 'anytext', 5,
 sub
-#line 325 "idl.yp"
+#line 320 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]$_[4]$_[5]" }
 	],
-	[#Rule 111
+	[#Rule 109
 		 'anytext', 5,
 sub
-#line 326 "idl.yp"
+#line 321 "pidl/idl.yp"
 { "$_[1]$_[2]$_[3]$_[4]$_[5]" }
 	],
-	[#Rule 112
+	[#Rule 110
 		 'identifier', 1, undef
 	],
-	[#Rule 113
+	[#Rule 111
 		 'optional_identifier', 1, undef
 	],
-	[#Rule 114
+	[#Rule 112
 		 'optional_identifier', 0, undef
 	],
-	[#Rule 115
+	[#Rule 113
 		 'constant', 1, undef
 	],
-	[#Rule 116
+	[#Rule 114
 		 'text', 1,
 sub
-#line 340 "idl.yp"
+#line 335 "pidl/idl.yp"
 { "\"$_[1]\"" }
 	],
-	[#Rule 117
+	[#Rule 115
 		 'optional_semicolon', 0, undef
 	],
-	[#Rule 118
+	[#Rule 116
 		 'optional_semicolon', 1, undef
 	]
 ],
@@ -2422,7 +2359,7 @@ sub
     bless($self,$class);
 }
 
-#line 351 "idl.yp"
+#line 346 "pidl/idl.yp"
 
 
 use Parse::Pidl qw(error);
diff --git a/source4/pidl/lib/Parse/Pidl/NDR.pm b/source4/pidl/lib/Parse/Pidl/NDR.pm
index fc6bfe4c96..86ed1a8d10 100644
--- a/source4/pidl/lib/Parse/Pidl/NDR.pm
+++ b/source4/pidl/lib/Parse/Pidl/NDR.pm
@@ -72,9 +72,9 @@ my $scalar_alignment = {
 	'ipv4address' => 4
 };
 
-sub GetElementLevelTable($)
+sub GetElementLevelTable($$)
 {
-	my $e = shift;
+	my ($e, $pointer_default) = @_;
 
 	my $order = [];
 	my $is_deferred = 0;
@@ -157,32 +157,45 @@ sub GetElementLevelTable($)
 
 	# Next, all the pointers
 	foreach my $i (1..$e->{POINTERS}) {
-		my $pt = pointer_type($e);
-
 		my $level = "EMBEDDED";
 		# Top level "ref" pointers do not have a referrent identifier
-		$level = "TOP" if ( defined($pt) 
-				and $i == 1
-				and $e->{PARENT}->{TYPE} eq "FUNCTION");
+		$level = "TOP" if ($i == 1 and $e->{PARENT}->{TYPE} eq "FUNCTION");
+
+		my $pt;
+		#
+		# Only the first level gets the pointer type from the
+		# pointer property, the others get them from
+		# the pointer_default() interface property
+		#
+		# see http://msdn2.microsoft.com/en-us/library/aa378984(VS.85).aspx
+		# (Here they talk about the rightmost pointer, but testing shows
+		#  they mean the leftmost pointer.)
+		#
+		# --metze
+		#
+		$pt = pointer_type($e);
+		if ($i > 1) {
+			$is_deferred = 1 if ($pt ne "ref" and $e->{PARENT}->{TYPE} eq "FUNCTION");
+			$pt = $pointer_default;
+		}
 
 		push (@$order, { 
 			TYPE => "POINTER",
-			# for now, there can only be one pointer type per element
-			POINTER_TYPE => pointer_type($e),
+			POINTER_TYPE => $pt,
 			POINTER_INDEX => $pointer_idx,
 			IS_DEFERRED => "$is_deferred",
 			LEVEL => $level
 		});
 
 		warning($e, "top-level \[out\] pointer `$e->{NAME}' is not a \[ref\] pointer") 
-			if ($i == 1 and pointer_type($e) ne "ref" and 
+			if ($i == 1 and $pt ne "ref" and
 				$e->{PARENT}->{TYPE} eq "FUNCTION" and 
 				not has_property($e, "in"));
 
 		$pointer_idx++;
 		
 		# everything that follows will be deferred
-		$is_deferred = 1 if ($e->{PARENT}->{TYPE} ne "FUNCTION");
+		$is_deferred = 1 if ($level ne "TOP");
 
 		my $array_size = shift @size_is;
 		my $array_length;
@@ -391,7 +404,7 @@ sub ParseElement($$)
 		NAME => $e->{NAME},
 		TYPE => $e->{TYPE},
 		PROPERTIES => $e->{PROPERTIES},
-		LEVELS => GetElementLevelTable($e),
+		LEVELS => GetElementLevelTable($e, $pointer_default),
 		REPRESENTATION_TYPE => ($e->{PROPERTIES}->{represent_as} or $e->{TYPE}),
 		ALIGN => align_type($e->{TYPE}),
 		ORIGINAL => $e
@@ -581,7 +594,7 @@ sub ParseFunction($$$)
 	my $rettype = undef;
 	my $thisopnum = undef;
 
-	CheckPointerTypes($d, $ndr->{PROPERTIES}->{pointer_default_top});
+	CheckPointerTypes($d, "ref");
 
 	if (not defined($d->{PROPERTIES}{noopnum})) {
 		$thisopnum = ${$opnum};
@@ -623,7 +636,7 @@ sub CheckPointerTypes($$)
 
 	foreach my $e (@{$s->{ELEMENTS}}) {
 		if ($e->{POINTERS} and not defined(pointer_type($e))) {
-			$e->{PROPERTIES}->{$default} = 1;
+			$e->{PROPERTIES}->{$default} = '1';
 		}
 	}
 }
@@ -661,12 +674,6 @@ sub ParseInterface($)
 		$idl->{PROPERTIES}->{pointer_default} = "unique";
 	}
 
-	if (not has_property($idl, "pointer_default_top")) {
-		$idl->{PROPERTIES}->{pointer_default_top} = "ref";
-	} else {
-		warning($idl, "pointer_default_top() is a pidl extension and should not be used");
-	}
-
 	foreach my $d (@{$idl->{DATA}}) {
 		if ($d->{TYPE} eq "FUNCTION") {
 			push (@functions, ParseFunction($idl, $d, \$opnum));
@@ -688,7 +695,7 @@ sub ParseInterface($)
 	if (!defined $idl->{PROPERTIES}->{endpoint}) {
 		push @endpoints, "\"ncacn_np:[\\\\pipe\\\\" . $idl->{NAME} . "]\"";
 	} else {
-		@endpoints = split / /, $idl->{PROPERTIES}->{endpoint};
+		@endpoints = split /,/, $idl->{PROPERTIES}->{endpoint};
 	}
 
 	return { 
@@ -824,7 +831,6 @@ my %property_list = (
 	"uuid"			=> ["INTERFACE"],
 	"endpoint"		=> ["INTERFACE"],
 	"pointer_default"	=> ["INTERFACE"],
-	"pointer_default_top"	=> ["INTERFACE"],
 	"helper"		=> ["INTERFACE"],
 	"authservice"		=> ["INTERFACE"],
 
diff --git a/source4/pidl/lib/Parse/Pidl/Samba4/Header.pm b/source4/pidl/lib/Parse/Pidl/Samba4/Header.pm
index 2b3a9df80f..2e77ff01b8 100644
--- a/source4/pidl/lib/Parse/Pidl/Samba4/Header.pm
+++ b/source4/pidl/lib/Parse/Pidl/Samba4/Header.pm
@@ -82,10 +82,11 @@ sub HeaderElement($)
 
 #####################################################################
 # parse a struct
-sub HeaderStruct($$)
+sub HeaderStruct($$;$)
 {
-	my($struct,$name) = @_;
+	my($struct,$name,$tail) = @_;
 	pidl "struct $name";
+	pidl $tail if defined($tail) and not defined($struct->{ELEMENTS});
 	return if (not defined($struct->{ELEMENTS}));
 	pidl " {\n";
 	$tab_depth++;
@@ -103,13 +104,14 @@ sub HeaderStruct($$)
 	if (defined $struct->{PROPERTIES}) {
 		HeaderProperties($struct->{PROPERTIES}, []);
 	}
+	pidl $tail if defined($tail);
 }
 
 #####################################################################
 # parse a enum
-sub HeaderEnum($$)
+sub HeaderEnum($$;$)
 {
-	my($enum,$name) = @_;
+	my($enum,$name,$tail) = @_;
 	my $first = 1;
 
 	pidl "enum $name";
@@ -131,30 +133,29 @@ sub HeaderEnum($$)
 		my $count = 0;
 		my $with_val = 0;
 		my $without_val = 0;
-		if (defined($enum->{ELEMENTS})) {
-			pidl " { __donnot_use_enum_$name=0x7FFFFFFF}\n";
-			foreach my $e (@{$enum->{ELEMENTS}}) {
-				my $t = "$e";
-				my $name;
-				my $value;
-				if ($t =~ /(.*)=(.*)/) {
-					$name = $1;
-					$value = $2;
-					$with_val = 1;
-					fatal($e->{ORIGINAL}, "you can't mix enum member with values and without values!")
-						unless ($without_val == 0);
-				} else {
-					$name = $t;
-					$value = $count++;
-					$without_val = 1;
-					fatal($e->{ORIGINAL}, "you can't mix enum member with values and without values!")
-						unless ($with_val == 0);
-				}
-				pidl "#define $name ( $value )\n";
+		pidl " { __donnot_use_enum_$name=0x7FFFFFFF}\n";
+		foreach my $e (@{$enum->{ELEMENTS}}) {
+			my $t = "$e";
+			my $name;
+			my $value;
+			if ($t =~ /(.*)=(.*)/) {
+				$name = $1;
+				$value = $2;
+				$with_val = 1;
+				fatal($e->{ORIGINAL}, "you can't mix enum member with values and without values!")
+					unless ($without_val == 0);
+			} else {
+				$name = $t;
+				$value = $count++;
+				$without_val = 1;
+				fatal($e->{ORIGINAL}, "you can't mix enum member with values and without values!")
+					unless ($with_val == 0);
 			}
+			pidl "#define $name ( $value )\n";
 		}
 		pidl "#endif\n";
 	}
+	pidl $tail if defined($tail);
 }
 
 #####################################################################
@@ -172,12 +173,13 @@ sub HeaderBitmap($$)
 
 #####################################################################
 # parse a union
-sub HeaderUnion($$)
+sub HeaderUnion($$;$)
 {
-	my($union,$name) = @_;
+	my($union,$name,$tail) = @_;
 	my %done = ();
 
 	pidl "union $name";
+	pidl $tail if defined($tail) and not defined($union->{ELEMENTS});
 	return if (not defined($union->{ELEMENTS}));
 	pidl " {\n";
 	$tab_depth++;
@@ -195,18 +197,19 @@ sub HeaderUnion($$)
 	if (defined $union->{PROPERTIES}) {
 		HeaderProperties($union->{PROPERTIES}, []);
 	}
+	pidl $tail if defined($tail);
 }
 
 #####################################################################
 # parse a type
-sub HeaderType($$$)
+sub HeaderType($$$;$)
 {
-	my($e,$data,$name) = @_;
+	my($e,$data,$name,$tail) = @_;
 	if (ref($data) eq "HASH") {
-		($data->{TYPE} eq "ENUM") && HeaderEnum($data, $name);
+		($data->{TYPE} eq "ENUM") && HeaderEnum($data, $name, $tail);
 		($data->{TYPE} eq "BITMAP") && HeaderBitmap($data, $name);
-		($data->{TYPE} eq "STRUCT") && HeaderStruct($data, $name);
-		($data->{TYPE} eq "UNION") && HeaderUnion($data, $name);
+		($data->{TYPE} eq "STRUCT") && HeaderStruct($data, $name, $tail);
+		($data->{TYPE} eq "UNION") && HeaderUnion($data, $name, $tail);
 		return;
 	}
 
@@ -215,14 +218,15 @@ sub HeaderType($$$)
 	} else {
 		pidl mapTypeName($e->{TYPE});
 	}
+	pidl $tail if defined($tail);
 }
 
 #####################################################################
 # parse a typedef
-sub HeaderTypedef($)
+sub HeaderTypedef($;$)
 {
-	my($typedef) = shift;
-	HeaderType($typedef, $typedef->{DATA}, $typedef->{NAME}) if defined ($typedef->{DATA});
+	my($typedef,$tail) = @_;
+	HeaderType($typedef, $typedef->{DATA}, $typedef->{NAME}, $tail) if defined ($typedef->{DATA});
 }
 
 #####################################################################
@@ -359,16 +363,11 @@ sub HeaderInterface($)
 	}
 
 	foreach my $t (@{$interface->{TYPES}}) {
-		HeaderTypedef($t) if ($t->{TYPE} eq "TYPEDEF");
-		HeaderStruct($t, $t->{NAME}) if ($t->{TYPE} eq "STRUCT");
-		HeaderUnion($t, $t->{NAME}) if ($t->{TYPE} eq "UNION");
-		HeaderEnum($t, $t->{NAME}) if ($t->{TYPE} eq "ENUM");
+		HeaderTypedef($t, ";\n\n") if ($t->{TYPE} eq "TYPEDEF");
+		HeaderStruct($t, $t->{NAME}, ";\n\n") if ($t->{TYPE} eq "STRUCT");
+		HeaderUnion($t, $t->{NAME}, ";\n\n") if ($t->{TYPE} eq "UNION");
+		HeaderEnum($t, $t->{NAME}, ";\n\n") if ($t->{TYPE} eq "ENUM");
 		HeaderBitmap($t, $t->{NAME}) if ($t->{TYPE} eq "BITMAP");
-		pidl ";\n\n" if ($t->{TYPE} eq "BITMAP" or 
-				 $t->{TYPE} eq "STRUCT" or 
-				 $t->{TYPE} eq "TYPEDEF" or 
-				 $t->{TYPE} eq "UNION" or 
-				 $t->{TYPE} eq "ENUM");
 	}
 
 	foreach my $fn (@{$interface->{FUNCTIONS}}) {
diff --git a/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm b/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
index 02d3a80992..60d5bf8781 100644
--- a/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
+++ b/source4/pidl/lib/Parse/Pidl/Samba4/NDR/Parser.pm
@@ -14,7 +14,7 @@ require Exporter;
 use strict;
 use Parse::Pidl::Typelist qw(hasType getType mapTypeName typeHasBody);
 use Parse::Pidl::Util qw(has_property ParseExpr ParseExprExt print_uuid);
-use Parse::Pidl::CUtil qw(get_pointer_to get_value_of);
+use Parse::Pidl::CUtil qw(get_pointer_to get_value_of get_array_element);
 use Parse::Pidl::NDR qw(GetPrevLevel GetNextLevel ContainsDeferred is_charset_array);
 use Parse::Pidl::Samba4 qw(is_intree choose_header);
 use Parse::Pidl::Samba4::Header qw(GenerateFunctionInEnv GenerateFunctionOutEnv EnvSubstituteValue GenerateStructEnv);
@@ -42,19 +42,21 @@ sub append_prefix($$)
 {
 	my ($e, $var_name) = @_;
 	my $pointers = 0;
+	my $arrays = 0;
 
 	foreach my $l (@{$e->{LEVELS}}) {
 		if ($l->{TYPE} eq "POINTER") {
 			$pointers++;
 		} elsif ($l->{TYPE} eq "ARRAY") {
+			$arrays++;
 			if (($pointers == 0) and 
 			    (not $l->{IS_FIXED}) and
 			    (not $l->{IS_INLINE})) {
-				return get_value_of($var_name); 
+				return get_value_of($var_name);
 			}
 		} elsif ($l->{TYPE} eq "DATA") {
 			if (Parse::Pidl::Typelist::scalar_is_reference($l->{DATA_TYPE})) {
-				return get_value_of($var_name) unless ($pointers);
+				return get_value_of($var_name) unless ($pointers or $arrays);
 			}
 		}
 	}
@@ -375,7 +377,7 @@ sub ParseArrayPullHeader($$$$$$)
 	}
 
 	if (not $l->{IS_FIXED} and not is_charset_array($e, $l)) {
-		$self->AllocateArrayLevel($e,$l,$ndr,$env,$size);
+		$self->AllocateArrayLevel($e,$l,$ndr,$var_name,$size);
 	}
 
 	return $length;
@@ -384,7 +386,7 @@ sub ParseArrayPullHeader($$$$$$)
 sub compression_alg($$)
 {
 	my ($e, $l) = @_;
-	my ($alg, $clen, $dlen) = split(/ /, $l->{COMPRESSION});
+	my ($alg, $clen, $dlen) = split(/,/, $l->{COMPRESSION});
 
 	return $alg;
 }
@@ -392,7 +394,7 @@ sub compression_alg($$)
 sub compression_clen($$$)
 {
 	my ($e, $l, $env) = @_;
-	my ($alg, $clen, $dlen) = split(/ /, $l->{COMPRESSION});
+	my ($alg, $clen, $dlen) = split(/,/, $l->{COMPRESSION});
 
 	return ParseExpr($clen, $env, $e->{ORIGINAL});
 }
@@ -400,7 +402,7 @@ sub compression_clen($$$)
 sub compression_dlen($$$)
 {
 	my ($e,$l,$env) = @_;
-	my ($alg, $clen, $dlen) = split(/ /, $l->{COMPRESSION});
+	my ($alg, $clen, $dlen) = split(/,/, $l->{COMPRESSION});
 
 	return ParseExpr($dlen, $env, $e->{ORIGINAL});
 }
@@ -582,7 +584,7 @@ sub ParseElementPushLevel
 		my $length = ParseExpr($l->{LENGTH_IS}, $env, $e->{ORIGINAL});
 		my $counter = "cntr_$e->{NAME}_$l->{LEVEL_INDEX}";
 
-		$var_name = $var_name . "[$counter]";
+		$var_name = get_array_element($var_name, $counter);
 
 		if (($primitives and not $l->{IS_DEFERRED}) or ($deferred and $l->{IS_DEFERRED})) {
 			$self->pidl("for ($counter = 0; $counter < $length; $counter++) {");
@@ -669,23 +671,48 @@ sub ParsePtrPush($$$$)
 	}
 }
 
+sub need_pointer_to($$$)
+{
+	my ($e, $l, $scalar_only) = @_;
+
+	my $t;
+	if (ref($l->{DATA_TYPE})) {
+		$t = "$l->{DATA_TYPE}->{TYPE}_$l->{DATA_TYPE}->{NAME}";
+	} else {
+		$t = $l->{DATA_TYPE};
+	}
+
+	if (not Parse::Pidl::Typelist::is_scalar($t)) {
+		return 1 if $scalar_only;
+	}
+
+	my $arrays = 0;
+
+	foreach my $tl (@{$e->{LEVELS}}) {
+		last if $l == $tl;
+		if ($tl->{TYPE} eq "ARRAY") {
+			$arrays++;
+		}
+	}
+
+	if (Parse::Pidl::Typelist::scalar_is_reference($t)) {
+		return 1 unless $arrays;
+	}
+
+	return 0;
+}
+
 sub ParseDataPrint($$$$)
 {
 	my ($self, $e, $l, $var_name) = @_;
 	
-	if (not ref($l->{DATA_TYPE}) or 
-		defined($l->{DATA_TYPE}->{NAME})) {
-		my $t;
-		if (ref($l->{DATA_TYPE})) {
-			$t = "$l->{DATA_TYPE}->{TYPE}_$l->{DATA_TYPE}->{NAME}";
-		} else {
-			$t = $l->{DATA_TYPE};
-		}
-		if (not Parse::Pidl::Typelist::is_scalar($t) or 
-			Parse::Pidl::Typelist::scalar_is_reference($t)) {
+	if (not ref($l->{DATA_TYPE}) or defined($l->{DATA_TYPE}->{NAME})) {
+
+		if (need_pointer_to($e, $l, 1)) {
 			$var_name = get_pointer_to($var_name);
 		}
-		$self->pidl("ndr_print_$t(ndr, \"$e->{NAME}\", $var_name);");
+
+		$self->pidl(TypeFunctionName("ndr_print", $l->{DATA_TYPE})."(ndr, \"$e->{NAME}\", $var_name);");
 	} else {
 		$self->ParseTypePrint($l->{DATA_TYPE}, $var_name);
 	}
@@ -752,7 +779,7 @@ sub ParseElementPrint($$$$)
 				$self->pidl("if (idx_$l->{LEVEL_INDEX}) {");
 				$self->indent;
 
-				$var_name = $var_name . "[$counter]";
+				$var_name = get_array_element($var_name, $counter);
 			}
 		} elsif ($l->{TYPE} eq "DATA") {
 			$self->ParseDataPrint($e, $l, $var_name);
@@ -815,12 +842,11 @@ sub ParseDataPull($$$$$$$)
 {
 	my ($self,$e,$l,$ndr,$var_name,$primitives,$deferred) = @_;
 
-	if (not ref($l->{DATA_TYPE}) or 
-		defined($l->{DATA_TYPE}->{NAME})) {
+	if (not ref($l->{DATA_TYPE}) or defined($l->{DATA_TYPE}->{NAME})) {
 
 		my $ndr_flags = CalcNdrFlags($l, $primitives, $deferred);
 
-		if (Parse::Pidl::Typelist::scalar_is_reference($l->{DATA_TYPE})) {
+		if (need_pointer_to($e, $l, 0)) {
 			$var_name = get_pointer_to($var_name);
 		}
 
@@ -830,7 +856,7 @@ sub ParseDataPull($$$$$$$)
 
 		if (my $range = has_property($e, "range")) {
 			$var_name = get_value_of($var_name);
-			my ($low, $high) = split(/ /, $range, 2);
+			my ($low, $high) = split(/,/, $range, 2);
 			$self->pidl("if ($var_name < $low || $var_name > $high) {");
 			$self->pidl("\treturn ndr_pull_error($ndr, NDR_ERR_RANGE, \"value out of range\");");
 			$self->pidl("}");
@@ -845,21 +871,15 @@ sub ParseDataPush($$$$$$$)
 	my ($self,$e,$l,$ndr,$var_name,$primitives,$deferred) = @_;
 
 	if (not ref($l->{DATA_TYPE}) or defined($l->{DATA_TYPE}->{NAME})) {
-		my $t;
-		if (ref($l->{DATA_TYPE}) eq "HASH") {
-			$t = "$l->{DATA_TYPE}->{TYPE}_$l->{DATA_TYPE}->{NAME}";
-		} else {
-			$t = $l->{DATA_TYPE};
-		}
-				
+
+		my $ndr_flags = CalcNdrFlags($l, $primitives, $deferred);
+
 		# strings are passed by value rather than reference
-		if (not Parse::Pidl::Typelist::is_scalar($t) or 
-			Parse::Pidl::Typelist::scalar_is_reference($t)) {
+		if (need_pointer_to($e, $l, 1)) {
 			$var_name = get_pointer_to($var_name);
 		}
 
-		my $ndr_flags = CalcNdrFlags($l, $primitives, $deferred);
-		$self->pidl("NDR_CHECK(ndr_push_$t($ndr, $ndr_flags, $var_name));");
+		$self->pidl("NDR_CHECK(".TypeFunctionName("ndr_push", $l->{DATA_TYPE})."($ndr, $ndr_flags, $var_name));");
 	} else {
 		$self->ParseTypePush($l->{DATA_TYPE}, $var_name, $primitives, $deferred);
 	}
@@ -890,15 +910,17 @@ sub CalcNdrFlags($$$)
 	return undef;
 }
 
-sub ParseMemCtxPullStart($$$$)
+sub ParseMemCtxPullFlags($$$$)
 {
-	my ($self, $e, $l, $ptr_name) = @_;
+	my ($self, $e, $l) = @_;
 
-	my $mem_r_ctx = "_mem_save_$e->{NAME}_$l->{LEVEL_INDEX}";
-	my $mem_c_ctx = $ptr_name;
-	my $mem_c_flags = "0";
+	return undef unless ($l->{TYPE} eq "POINTER" or $l->{TYPE} eq "ARRAY");
 
-	return if ($l->{TYPE} eq "ARRAY" and $l->{IS_FIXED});
+	return undef if ($l->{TYPE} eq "ARRAY" and $l->{IS_FIXED});
+	return undef if has_fast_array($e, $l);
+	return undef if is_charset_array($e, $l);
+
+	my $mem_flags = "0";
 
 	if (($l->{TYPE} eq "POINTER") and ($l->{POINTER_TYPE} eq "ref")) {
 		my $nl = GetNextLevel($e, $l);
@@ -906,12 +928,25 @@ sub ParseMemCtxPullStart($$$$)
 		my $next_is_string = (($nl->{TYPE} eq "DATA") and 
 					($nl->{DATA_TYPE} eq "string"));
 		if ($next_is_array or $next_is_string) {
-			return;
-		} else {
-			$mem_c_flags = "LIBNDR_FLAG_REF_ALLOC";
+			return undef;
+		} elsif ($l->{LEVEL} eq "TOP") {
+			$mem_flags = "LIBNDR_FLAG_REF_ALLOC";
 		}
 	}
 
+	return $mem_flags;
+}
+
+sub ParseMemCtxPullStart($$$$)
+{
+	my ($self, $e, $l, $ptr_name) = @_;
+
+	my $mem_r_ctx = "_mem_save_$e->{NAME}_$l->{LEVEL_INDEX}";
+	my $mem_c_ctx = $ptr_name;
+	my $mem_c_flags = $self->ParseMemCtxPullFlags($e, $l);
+
+	return unless defined($mem_c_flags);
+
 	$self->pidl("$mem_r_ctx = NDR_PULL_GET_MEM_CTX(ndr);");
 	$self->pidl("NDR_PULL_SET_MEM_CTX(ndr, $mem_c_ctx, $mem_c_flags);");
 }
@@ -921,21 +956,9 @@ sub ParseMemCtxPullEnd($$$)
 	my ($self, $e, $l) = @_;
 
 	my $mem_r_ctx = "_mem_save_$e->{NAME}_$l->{LEVEL_INDEX}";
-	my $mem_r_flags = "0";
+	my $mem_r_flags = $self->ParseMemCtxPullFlags($e, $l);
 
-	return if ($l->{TYPE} eq "ARRAY" and $l->{IS_FIXED});
-
-	if (($l->{TYPE} eq "POINTER") and ($l->{POINTER_TYPE} eq "ref")) {
-		my $nl = GetNextLevel($e, $l);
-		my $next_is_array = ($nl->{TYPE} eq "ARRAY");
-		my $next_is_string = (($nl->{TYPE} eq "DATA") and 
-					($nl->{DATA_TYPE} eq "string"));
-		if ($next_is_array or $next_is_string) {
-			return;
-		} else {
-			$mem_r_flags = "LIBNDR_FLAG_REF_ALLOC";
-		}
-	}
+	return unless defined($mem_r_flags);
 
 	$self->pidl("NDR_PULL_SET_MEM_CTX(ndr, $mem_r_ctx, $mem_r_flags);");
 }
@@ -1025,7 +1048,7 @@ sub ParseElementPullLevel
 		my $counter = "cntr_$e->{NAME}_$l->{LEVEL_INDEX}";
 		my $array_name = $var_name;
 
-		$var_name = $var_name . "[$counter]";
+		$var_name = get_array_element($var_name, $counter);
 
 		$self->ParseMemCtxPullStart($e, $l, $array_name);
 
@@ -1106,10 +1129,7 @@ sub ParsePtrPull($$$$$)
 	my $next_is_string = (($nl->{TYPE} eq "DATA") and 
 						 ($nl->{DATA_TYPE} eq "string"));
 
-	if ($l->{POINTER_TYPE} eq "ref") {
-		if ($l->{LEVEL} eq "EMBEDDED") {
-			$self->pidl("NDR_CHECK(ndr_pull_ref_ptr($ndr, &_ptr_$e->{NAME}));");
-		}
+	if ($l->{POINTER_TYPE} eq "ref" and $l->{LEVEL} eq "TOP") {
 
 		if (!$next_is_array and !$next_is_string) {
 			$self->pidl("if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {");
@@ -1118,16 +1138,19 @@ sub ParsePtrPull($$$$$)
 		}
 		
 		return;
+	} elsif ($l->{POINTER_TYPE} eq "ref" and $l->{LEVEL} eq "EMBEDDED") {
+		$self->pidl("NDR_CHECK(ndr_pull_ref_ptr($ndr, &_ptr_$e->{NAME}));");
 	} elsif (($l->{POINTER_TYPE} eq "unique") or 
 		 ($l->{POINTER_TYPE} eq "relative") or
 		 ($l->{POINTER_TYPE} eq "full")) {
 		$self->pidl("NDR_CHECK(ndr_pull_generic_ptr($ndr, &_ptr_$e->{NAME}));");
-		$self->pidl("if (_ptr_$e->{NAME}) {");
-		$self->indent;
 	} else {
 		die("Unhandled pointer type $l->{POINTER_TYPE}");
 	}
 
+	$self->pidl("if (_ptr_$e->{NAME}) {");
+	$self->indent;
+
 	# Don't do this for arrays, they're allocated at the actual level 
 	# of the array
 	unless ($next_is_array or $next_is_string) { 
@@ -1441,31 +1464,12 @@ sub DeclareArrayVariables($$)
 	}
 }
 
-sub need_decl_mem_ctx($$)
-{
-	my ($e,$l) = @_;
-
-	return 0 if has_fast_array($e,$l);
-	return 0 if is_charset_array($e,$l);
-	return 1 if (($l->{TYPE} eq "ARRAY") and not $l->{IS_FIXED});
-
-	if (($l->{TYPE} eq "POINTER") and ($l->{POINTER_TYPE} eq "ref")) {
-		my $nl = GetNextLevel($e, $l);
-		my $next_is_array = ($nl->{TYPE} eq "ARRAY");
-		my $next_is_string = (($nl->{TYPE} eq "DATA") and 
-					($nl->{DATA_TYPE} eq "string"));
-		return 0 if ($next_is_array or $next_is_string);
-	}
-	return 1 if ($l->{TYPE} eq "POINTER");
-
-	return 0;
-}
-
 sub DeclareMemCtxVariables($$)
 {
 	my ($self,$e) = @_;
 	foreach my $l (@{$e->{LEVELS}}) {
-		if (need_decl_mem_ctx($e, $l)) {
+		my $mem_flags = $self->ParseMemCtxPullFlags($e, $l);
+		if (defined($mem_flags)) {
 			$self->pidl("TALLOC_CTX *_mem_save_$e->{NAME}_$l->{LEVEL_INDEX};");
 		}
 	}
@@ -1607,7 +1611,7 @@ sub ParseUnionPushPrimitives($$$)
 		if ($el->{CASE} eq "default") {
 			$have_default = 1;
 		}
-		$self->pidl("$el->{CASE}:");
+		$self->pidl("$el->{CASE}: {");
 
 		if ($el->{TYPE} ne "EMPTY") {
 			$self->indent;
@@ -1621,7 +1625,7 @@ sub ParseUnionPushPrimitives($$$)
 			$self->ParseElementPush($el, "ndr", {$el->{NAME} => "$varname->$el->{NAME}"}, 1, 0);
 			$self->deindent;
 		}
-		$self->pidl("break;");
+		$self->pidl("break; }");
 		$self->pidl("");
 	}
 	if (! $have_default) {
@@ -2058,9 +2062,7 @@ sub ParseFunctionPush($$)
 
 sub AllocateArrayLevel($$$$$$)
 {
-	my ($self,$e,$l,$ndr,$env,$size) = @_;
-
-	my $var = ParseExpr($e->{NAME}, $env, $e->{ORIGINAL});
+	my ($self,$e,$l,$ndr,$var,$size) = @_;
 
 	my $pl = GetPrevLevel($e, $l);
 	if (defined($pl) and 
@@ -2236,7 +2238,7 @@ sub FunctionTable($$)
 		$interface->{PROPERTIES}->{authservice} = "\"host\"";
 	}
 
-	my @a = split / /, $interface->{PROPERTIES}->{authservice};
+	my @a = split /,/, $interface->{PROPERTIES}->{authservice};
 	my $authservice_count = $#a + 1;
 
 	$self->pidl("static const char * const $interface->{NAME}\_authservice_strings[] = {");
@@ -2311,7 +2313,7 @@ sub HeaderInterface($$$)
 	}
 
 	if (defined $interface->{PROPERTIES}->{helper}) {
-		$self->HeaderInclude(split / /, $interface->{PROPERTIES}->{helper});
+		$self->HeaderInclude(split /,/, $interface->{PROPERTIES}->{helper});
 	}
 
 	if (defined $interface->{PROPERTIES}->{uuid}) {
diff --git a/source4/pidl/tests/Util.pm b/source4/pidl/tests/Util.pm
index 82ab130e5a..4ad216a6a1 100644
--- a/source4/pidl/tests/Util.pm
+++ b/source4/pidl/tests/Util.pm
@@ -134,7 +134,7 @@ $c
 		$cc = "cc";
 	}
 
-	my $flags = `pkg-config --libs --cflags ndr samba-config`;
+	my $flags = `pkg-config --libs --cflags ndr`;
 
 	my $cmd = "$cc $cflags -x c - -o $outfile $flags $ldflags";
 	$cmd =~ s/\n//g;
diff --git a/source4/pidl/tests/ndr.pl b/source4/pidl/tests/ndr.pl
index 7fcc7ef40e..504b7ec8de 100755
--- a/source4/pidl/tests/ndr.pl
+++ b/source4/pidl/tests/ndr.pl
@@ -4,7 +4,7 @@
 use strict;
 use warnings;
 
-use Test::More tests => 40;
+use Test::More tests => 46;
 use FindBin qw($RealBin);
 use lib "$RealBin";
 use Util;
@@ -22,7 +22,7 @@ my $e = {
 	'PARENT' => { TYPE => 'STRUCT' },
 	'LINE' => 42 };
 
-is_deeply(GetElementLevelTable($e), [
+is_deeply(GetElementLevelTable($e, "unique"), [
 	{
 		'IS_DEFERRED' => 0,
 		'LEVEL_INDEX' => 0,
@@ -33,7 +33,7 @@ is_deeply(GetElementLevelTable($e), [
 	}
 ]);
 
-my $ne = ParseElement($e, undef);
+my $ne = ParseElement($e, "unique");
 is($ne->{ORIGINAL}, $e);
 is($ne->{NAME}, "v");
 is($ne->{ALIGN}, 1);
@@ -60,7 +60,7 @@ $e = {
 	'TYPE' => 'uint8',
 	'LINE' => 42 };
 
-is_deeply(GetElementLevelTable($e), [
+is_deeply(GetElementLevelTable($e, "unique"), [
 	{
 		LEVEL_INDEX => 0,
 		IS_DEFERRED => 0,
@@ -90,7 +90,7 @@ $e = {
 	'PARENT' => { TYPE => 'STRUCT' },
 	'LINE' => 42 };
 
-is_deeply(GetElementLevelTable($e), [
+is_deeply(GetElementLevelTable($e, "unique"), [
 	{
 		LEVEL_INDEX => 0,
 		IS_DEFERRED => 0,
@@ -128,7 +128,7 @@ $e = {
 	'PARENT' => { TYPE => 'STRUCT' },
 	'LINE' => 42 };
 
-is_deeply(GetElementLevelTable($e), [
+is_deeply(GetElementLevelTable($e, "unique"), [
 	{
 		LEVEL_INDEX => 0,
 		IS_DEFERRED => 0,
@@ -147,6 +147,97 @@ is_deeply(GetElementLevelTable($e), [
 	}
 ]);
 
+# Case 3 : ref pointers
+#
+$e = {
+	'FILE' => 'foo.idl',
+	'NAME' => 'v',
+	'PROPERTIES' => {"ref" => 1},
+	'POINTERS' => 3,
+	'TYPE' => 'uint8',
+	'PARENT' => { TYPE => 'STRUCT' },
+	'LINE' => 42 };
+
+is_deeply(GetElementLevelTable($e, "unique"), [
+	{
+		LEVEL_INDEX => 0,
+		IS_DEFERRED => 0,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 0,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		LEVEL_INDEX => 1,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "unique",
+		POINTER_INDEX => 1,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		LEVEL_INDEX => 2,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "unique",
+		POINTER_INDEX => 2,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		'IS_DEFERRED' => 1,
+		'LEVEL_INDEX' => 3,
+		'DATA_TYPE' => 'uint8',
+		'CONTAINS_DEFERRED' => 0,
+		'TYPE' => 'DATA',
+		'IS_SURROUNDING' => 0,
+	}
+]);
+
+# Case 3 : ref pointers
+#
+$e = {
+	'FILE' => 'foo.idl',
+	'NAME' => 'v',
+	'PROPERTIES' => {"ref" => 1},
+	'POINTERS' => 3,
+	'TYPE' => 'uint8',
+	'PARENT' => { TYPE => 'STRUCT' },
+	'LINE' => 42 };
+
+is_deeply(GetElementLevelTable($e, "ref"), [
+	{
+		LEVEL_INDEX => 0,
+		IS_DEFERRED => 0,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 0,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		LEVEL_INDEX => 1,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 1,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		LEVEL_INDEX => 2,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 2,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		'IS_DEFERRED' => 1,
+		'LEVEL_INDEX' => 3,
+		'DATA_TYPE' => 'uint8',
+		'CONTAINS_DEFERRED' => 0,
+		'TYPE' => 'DATA',
+		'IS_SURROUNDING' => 0,
+	}
+]);
 
 # Case 4 : top-level ref pointers
 #
@@ -159,7 +250,7 @@ $e = {
 	'PARENT' => { TYPE => 'FUNCTION' },
 	'LINE' => 42 };
 
-is_deeply(GetElementLevelTable($e), [
+is_deeply(GetElementLevelTable($e, "unique"), [
 	{
 		LEVEL_INDEX => 0,
 		IS_DEFERRED => 0,
@@ -178,6 +269,190 @@ is_deeply(GetElementLevelTable($e), [
 	}
 ]);
 
+# Case 4 : top-level ref pointers, triple with pointer_default("unique")
+#
+$e = {
+	'FILE' => 'foo.idl',
+	'NAME' => 'v',
+	'PROPERTIES' => {"ref" => 1},
+	'POINTERS' => 3,
+	'TYPE' => 'uint8',
+	'PARENT' => { TYPE => 'FUNCTION' },
+	'LINE' => 42 };
+
+is_deeply(GetElementLevelTable($e, "unique"), [
+	{
+		LEVEL_INDEX => 0,
+		IS_DEFERRED => 0,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 0,
+		LEVEL => 'TOP'
+	},
+	{
+		LEVEL_INDEX => 1,
+		IS_DEFERRED => 0,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "unique",
+		POINTER_INDEX => 1,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		LEVEL_INDEX => 2,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "unique",
+		POINTER_INDEX => 2,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		'IS_DEFERRED' => 1,
+		'LEVEL_INDEX' => 3,
+		'DATA_TYPE' => 'uint8',
+		'CONTAINS_DEFERRED' => 0,
+		'TYPE' => 'DATA',
+		'IS_SURROUNDING' => 0,
+	}
+]);
+
+# Case 4 : top-level unique pointers, triple with pointer_default("unique")
+#
+$e = {
+	'FILE' => 'foo.idl',
+	'NAME' => 'v',
+	'PROPERTIES' => {"unique" => 1, "in" => 1},
+	'POINTERS' => 3,
+	'TYPE' => 'uint8',
+	'PARENT' => { TYPE => 'FUNCTION' },
+	'LINE' => 42 };
+
+is_deeply(GetElementLevelTable($e, "unique"), [
+	{
+		LEVEL_INDEX => 0,
+		IS_DEFERRED => 0,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "unique",
+		POINTER_INDEX => 0,
+		LEVEL => 'TOP'
+	},
+	{
+		LEVEL_INDEX => 1,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "unique",
+		POINTER_INDEX => 1,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		LEVEL_INDEX => 2,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "unique",
+		POINTER_INDEX => 2,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		'IS_DEFERRED' => 1,
+		'LEVEL_INDEX' => 3,
+		'DATA_TYPE' => 'uint8',
+		'CONTAINS_DEFERRED' => 0,
+		'TYPE' => 'DATA',
+		'IS_SURROUNDING' => 0,
+	}
+]);
+
+# Case 4 : top-level unique pointers, triple with pointer_default("ref")
+#
+$e = {
+	'FILE' => 'foo.idl',
+	'NAME' => 'v',
+	'PROPERTIES' => {"unique" => 1, "in" => 1},
+	'POINTERS' => 3,
+	'TYPE' => 'uint8',
+	'PARENT' => { TYPE => 'FUNCTION' },
+	'LINE' => 42 };
+
+is_deeply(GetElementLevelTable($e, "ref"), [
+	{
+		LEVEL_INDEX => 0,
+		IS_DEFERRED => 0,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "unique",
+		POINTER_INDEX => 0,
+		LEVEL => 'TOP'
+	},
+	{
+		LEVEL_INDEX => 1,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 1,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		LEVEL_INDEX => 2,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 2,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		'IS_DEFERRED' => 1,
+		'LEVEL_INDEX' => 3,
+		'DATA_TYPE' => 'uint8',
+		'CONTAINS_DEFERRED' => 0,
+		'TYPE' => 'DATA',
+		'IS_SURROUNDING' => 0,
+	}
+]);
+
+# Case 4 : top-level ref pointers, triple with pointer_default("ref")
+#
+$e = {
+	'FILE' => 'foo.idl',
+	'NAME' => 'v',
+	'PROPERTIES' => {"ref" => 1},
+	'POINTERS' => 3,
+	'TYPE' => 'uint8',
+	'PARENT' => { TYPE => 'FUNCTION' },
+	'LINE' => 42 };
+
+is_deeply(GetElementLevelTable($e, "ref"), [
+	{
+		LEVEL_INDEX => 0,
+		IS_DEFERRED => 0,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 0,
+		LEVEL => 'TOP'
+	},
+	{
+		LEVEL_INDEX => 1,
+		IS_DEFERRED => 0,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 1,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		LEVEL_INDEX => 2,
+		IS_DEFERRED => 1,
+		TYPE => 'POINTER',
+		POINTER_TYPE => "ref",
+		POINTER_INDEX => 2,
+		LEVEL => 'EMBEDDED'
+	},
+	{
+		'IS_DEFERRED' => 1,
+		'LEVEL_INDEX' => 3,
+		'DATA_TYPE' => 'uint8',
+		'CONTAINS_DEFERRED' => 0,
+		'TYPE' => 'DATA',
+		'IS_SURROUNDING' => 0,
+	}
+]);
+
 # representation_type
 $e = {
 	'FILE' => 'foo.idl',
diff --git a/source4/pidl/tests/ndr_compat.pl b/source4/pidl/tests/ndr_compat.pl
index 735d929e27..355e7f6732 100755
--- a/source4/pidl/tests/ndr_compat.pl
+++ b/source4/pidl/tests/ndr_compat.pl
@@ -3,7 +3,7 @@
 # Published under the GNU General Public License
 use strict;
 
-use Test::More tests => 3;
+use Test::More tests => 2;
 use FindBin qw($RealBin);
 use lib "$RealBin";
 use Util; 
@@ -19,9 +19,3 @@ sub parse_idl($)
 
 test_warnings("", sub {parse_idl("void x();"); });
 test_warnings("nofile:0: top-level [out] pointer `x' is not a [ref] pointer\n", sub {parse_idl("void x([out,unique] int *x);"); });
-
-test_warnings("nofile:0: pointer_default_top() is a pidl extension and should not be used\n", sub {
-	my $pidl = Parse::Pidl::IDL::parse_string("[pointer_default_top(unique)] interface echo { void x(); }; ", "nofile");
-	Parse::Pidl::NDR::Parse($pidl);
-});
-
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 3d9262b995..4d38dc069e 100644
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -797,11 +797,11 @@ static WERROR dcesrv_netr_NETRLOGONSETSERVICEBITS(struct dcesrv_call_state *dce_
 }
 
 
-/* 
-  netr_NETRLOGONGETTRUSTRID 
+/*
+  netr_LogonGetTrustRid
 */
-static WERROR dcesrv_netr_NETRLOGONGETTRUSTRID(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-		       struct netr_NETRLOGONGETTRUSTRID *r)
+static WERROR dcesrv_netr_LogonGetTrustRid(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+		       struct netr_LogonGetTrustRid *r)
 {
 	DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 }
@@ -1212,11 +1212,11 @@ static WERROR dcesrv_netr_DsrEnumerateDomainTrusts(struct dcesrv_call_state *dce
 }
 
 
-/* 
-  netr_DSRDEREGISTERDNSHOSTRECORDS 
+/*
+  netr_DsrDeregisterDNSHostRecords
 */
-static WERROR dcesrv_netr_DSRDEREGISTERDNSHOSTRECORDS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
-		       struct netr_DSRDEREGISTERDNSHOSTRECORDS *r)
+static WERROR dcesrv_netr_DsrDeregisterDNSHostRecords(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+		       struct netr_DsrDeregisterDNSHostRecords *r)
 {
 	DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 }
diff --git a/source4/rpc_server/service_rpc.c b/source4/rpc_server/service_rpc.c
index 46916135f9..ddcf1c2a99 100644
--- a/source4/rpc_server/service_rpc.c
+++ b/source4/rpc_server/service_rpc.c
@@ -457,18 +457,6 @@ failed:
 	task_server_terminate(task, "Failed to startup dcerpc server task");	
 }
 
-/*
-  called on startup of the smb server service It's job is to start
-  listening on all configured sockets
-*/
-static NTSTATUS dcesrv_init(struct event_context *event_context, 
-			    struct loadparm_context *lp_ctx,
-			    const struct model_ops *model_ops)
-{	
-	return task_server_startup(event_context, lp_ctx, 
-				   model_ops, dcesrv_task_init);
-}
-
 NTSTATUS server_service_rpc_init(void)
 {
 	init_module_fn static_init[] = { STATIC_dcerpc_server_MODULES };
@@ -479,5 +467,5 @@ NTSTATUS server_service_rpc_init(void)
 
 	talloc_free(shared_init);
 	
-	return register_server_service("rpc", dcesrv_init);
+	return register_server_service("rpc", dcesrv_task_init);
 }
diff --git a/source4/rules.mk b/source4/rules.mk
new file mode 100644
index 0000000000..4548bfbade
--- /dev/null
+++ b/source4/rules.mk
@@ -0,0 +1,196 @@
+# Dependencies command
+DEPENDS = $(CC) -M -MG -MP -MT $(<:.c=.o) -MT $@ \
+    $(CFLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
+    $(CPPFLAGS) $(FIRST_PREREQ) -o $@
+# Dependencies for host objects
+HDEPENDS = $(CC) -M -MG -MP -MT $(<:.c=.ho) -MT $@ \
+    $(HOSTCC_FLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
+    $(CPPFLAGS) $(FIRST_PREREQ) -o $@
+# Dependencies for precompiled headers
+PCHDEPENDS = $(CC) -M -MG -MT include/includes.h.gch -MT $@ \
+    $(CFLAGS) $(CPPFLAGS) $(FIRST_PREREQ) -o $@
+
+# $< is broken in older BSD versions:
+# when $@ is foo/bar.o, $< could be torture/foo/bar.c
+# if it also exists. So better use $* which is foo/bar
+# and append .c manually to get foo/bar.c
+#
+# If we have GNU Make, it is safe to use $<, which also lets
+# building with $srcdir != $builddir work.
+
+# Run a static analysis checker
+CHECK = $(CC_CHECKER) $(CFLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
+    $(PICFLAG) $(CPPLAGS) -c $(FIRST_PREREQ) -o $@
+
+# Run the configured compiler
+COMPILE = $(CC) $(CFLAGS) $(PICFLAG) \
+          `$(PERL) $(srcdir)/script/cflags.pl $@` \
+		  $(CPPFLAGS) \
+		  -c $(FIRST_PREREQ) -o $@
+
+# Run the compiler for the build host
+HCOMPILE = $(HOSTCC) $(HOSTCC_FLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
+	 $(CPPFLAGS) -c $(FIRST_PREREQ) -o $@
+
+# Precompile headers
+PCHCOMPILE = @$(CC) -Ilib/replace \
+    $(CFLAGS) `$(PERL) $(srcdir)/script/cflags.pl $@` \
+    $(PICFLAG) $(CPPFLAGS) -c $(FIRST_PREREQ) -o $@
+
+include/config.h:
+	@echo "include/config.h not present"
+	@echo "You need to rerun ./autogen.sh and ./configure"
+	@/bin/false
+
+$(srcdir)/version.h: $(srcdir)/VERSION
+	@$(SHELL) script/mkversion.sh VERSION $(srcdir)/version.h $(srcdir)/
+
+regen_version::
+	@$(SHELL) script/mkversion.sh VERSION $(srcdir)/version.h $(srcdir)/
+
+clean_pch::
+	@echo "Removing precompiled headers"
+	@-rm -f include/includes.h.gch
+
+pch:: clean_pch include/includes.h.gch
+
+clean:: clean_pch
+	@echo Removing objects
+	@-find . -name '*.o' -exec rm -f '{}' \;
+	@echo Removing hostcc objects
+	@-find . -name '*.ho' -exec rm -f '{}' \;
+	@echo Removing binaries
+	@-rm -f $(BIN_PROGS) $(SBIN_PROGS) $(BINARIES) $(TORTURE_PROGS)
+	@echo Removing libraries
+	@-rm -f $(STATIC_LIBRARIES) $(SHARED_LIBRARIES)
+	@-rm -f bin/static/*.a bin/shared/*.$(SHLIBEXT)
+	@echo Removing modules
+	@-rm -f bin/modules/*/*.$(SHLIBEXT)
+	@-rm -f bin/*_init_module.c
+	@echo Removing dummy targets
+	@-rm -f bin/.*_*
+	@echo Removing generated files
+	@-rm -f bin/*_init_module.c
+	@-rm -rf librpc/gen_* 
+	@echo Removing proto headers
+	@-rm -f $(PROTO_HEADERS)
+
+distclean:: clean
+	-rm -f include/config.h include/config_tmp.h include/build.h
+	-rm -f Makefile 
+	-rm -f config.status
+	-rm -f config.log config.cache
+	-rm -f config.pm config.mk
+	-rm -f $(PC_FILES)
+
+removebackup::
+	-rm -f *.bak *~ */*.bak */*~ */*/*.bak */*/*~ */*/*/*.bak */*/*/*~
+
+realdistclean:: distclean removebackup
+	-rm -f include/config_tmp.h.in
+	-rm -f version.h
+	-rm -f configure
+	-rm -f $(MANPAGES)
+
+check:: test
+
+unused_macros:
+	$(srcdir)/script/find_unused_macros.pl `find . -name "*.[ch]"` | sort
+
+###############################################################################
+# File types
+###############################################################################
+
+.SUFFIXES: .x .c .et .y .l .d .o .h .h.gch .a .$(SHLIBEXT) .1 .1.xml .3 .3.xml .5 .5.xml .7 .7.xml .8 .8.xml .ho .idl .hd
+
+.c.d:
+	@echo "Generating dependencies for $<"
+	@$(DEPENDS)
+
+.c.hd:
+	@echo "Generating host-compiler dependencies for $<"
+	@$(HDEPENDS)
+
+include/includes.d: include/includes.h
+	@echo "Generating dependencies for $<"
+	@$(PCHDEPENDS)
+
+.c.o:
+	@if test -n "$(CC_CHECKER)"; then \
+		echo "Checking  $< with '$(CC_CHECKER)'"; \
+		$(CHECK) ; \
+	fi
+	@echo "Compiling $<"
+	@-mkdir -p `dirname $@`
+	@$(COMPILE) && exit 0 ; \
+		echo "The following command failed:" 1>&2;\
+		echo "$(COMPILE)" 1>&2;\
+		$(COMPILE) >/dev/null 2>&1
+
+.c.ho:
+	@echo "Compiling $< with host compiler"
+	@-mkdir -p `dirname $@`
+	@$(HCOMPILE) && exit 0;\
+		echo "The following command failed:" 1>&2;\
+		echo "$(HCOMPILE)" 1>&2;\
+		$(HCOMPILE) >/dev/null 2>&1
+
+.h.h.gch:
+	@echo "Precompiling $<"
+	@$(PCHCOMPILE)
+
+.y.c:
+	@echo "Building $< with $(YACC)"
+	@-$(srcdir)/script/yacc_compile.sh "$(YACC)" "$<" "$@"
+
+.l.c:
+	@echo "Building $< with $(LEX)"
+	@-$(srcdir)/script/lex_compile.sh "$(LEX)" "$<" "$@"
+
+DOCBOOK_MANPAGE_URL = http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl
+
+.1.xml.1:
+	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
+
+.3.xml.3:
+	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
+
+.5.xml.5:
+	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
+
+.7.xml.7:
+	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
+
+.8.xml.8:
+	$(XSLTPROC) -o $@ $(DOCBOOK_MANPAGE_URL) $<
+
+DEP_FILES = $(patsubst %.ho,%.hd,$(patsubst %.o,%.d,$(ALL_OBJS))) \
+		   include/includes.d
+
+dist:: idl_full manpages configure distclean 
+
+configure: 
+	./autogen.sh
+
+showflags::
+	@echo 'Samba will be compiled with flags:'
+	@echo '  CPP        = $(CPP)'
+	@echo '  CPPFLAGS   = $(CPPFLAGS)'
+	@echo '  CC         = $(CC)'
+	@echo '  CFLAGS     = $(CFLAGS)'
+	@echo '  PICFLAG    = $(PICFLAG)'
+	@echo '  BNLD       = $(BNLD)'
+	@echo '  BNLD_FLAGS = $(BNLD_FLAGS)'
+	@echo '  STLD       = $(STLD)'
+	@echo '  STLD_FLAGS = $(STLD_FLAGS)'
+	@echo '  SHLD       = $(SHLD)'
+	@echo '  SHLD_FLAGS = $(SHLD_FLAGS)'
+	@echo '  MDLD       = $(MDLD)'
+	@echo '  MDLD_FLAGS = $(MDLD_FLAGS)'
+	@echo '  SHLIBEXT   = $(SHLIBEXT)'
+
+etags:
+	etags `find $(srcdir) -name "*.[ch]"`
+
+ctags:
+	ctags `find $(srcdir) -name "*.[ch]"`
diff --git a/source4/samba4-knownfail b/source4/samba4-knownfail
index b1b2140fec..cf5f97ca74 100644
--- a/source4/samba4-knownfail
+++ b/source4/samba4-knownfail
@@ -34,3 +34,5 @@ RPC-NETLOGON.*.GetTrustPasswords
 BASE-CHARSET.*.Testing partial surrogate
 .*NET-API-DELSHARE.*				# DelShare isn't implemented yet
 RAP.*netservergetinfo
+kinit with pkinit # fails with: salt type 3 not supported
+
diff --git a/source4/samba4-skip b/source4/samba4-skip
index 8ce9c4f9cc..b53f444c9c 100644
--- a/source4/samba4-skip
+++ b/source4/samba4-skip
@@ -50,3 +50,4 @@ RPC-FRSAPI							# Not provided by Samba 4
 WINBIND							# FIXME: This should not be skipped
 NSS-TEST						# Fails
 samba4.samba3sam.python		# Conversion from EJS not yet finished
+RAW-OFFLINE 			# Samba 4 doesn't have much offline support yet
diff --git a/source4/scripting/bin/winreg.py b/source4/scripting/bin/winreg.py
index f68f2d12f2..1e39ee8f78 100755
--- a/source4/scripting/bin/winreg.py
+++ b/source4/scripting/bin/winreg.py
@@ -12,7 +12,8 @@ import optparse
 import samba.getopt as options
 
 parser = optparse.OptionParser("%s <BINDING> [path]" % sys.argv[0])
-parser.add_option_group(options.SambaOptions(parser))
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
 parser.add_option("--createkey", type="string", metavar="KEYNAME", 
         help="create a key")
 
@@ -25,7 +26,7 @@ if len(args) < 1:
 binding = args[0]
 
 print "Connecting to " + binding
-conn = winreg.winreg(binding, opts.configfile)
+conn = winreg.winreg(binding, sambaopts.get_loadparm())
 
 def list_values(key):
     (num_values, max_valnamelen, max_valbufsize) = conn.QueryInfoKey(key, winreg.String())[4:8]
diff --git a/source4/scripting/ejs/smbcalls_rpc.c b/source4/scripting/ejs/smbcalls_rpc.c
index 2bfc8b5883..44cfa16d7e 100644
--- a/source4/scripting/ejs/smbcalls_rpc.c
+++ b/source4/scripting/ejs/smbcalls_rpc.c
@@ -80,7 +80,7 @@ static int ejs_irpc_connect(MprVarHandle eid, int argc, char **argv)
 	for (i=0;i<10000;i++) {
 		p->msg_ctx = messaging_init(p, 
 					    lp_messaging_path(p, global_loadparm),
-					    cluster_id(EJS_ID_BASE + i), 
+					    cluster_id(EJS_ID_BASE, i), 
 				            lp_iconv_convenience(global_loadparm),
 					    ev);
 		if (p->msg_ctx) break;
diff --git a/source4/scripting/libjs/provision.js b/source4/scripting/libjs/provision.js
index 0cca49dec9..e71498010c 100644
--- a/source4/scripting/libjs/provision.js
+++ b/source4/scripting/libjs/provision.js
@@ -484,9 +484,6 @@ function provision_fix_subobj(subobj, paths)
 	subobj.ADMINPASS_B64   = ldb.encode(subobj.ADMINPASS);
 	subobj.DNSPASS_B64     = ldb.encode(subobj.DNSPASS);
 
-	var rdns = split(",", subobj.DOMAINDN);
-	subobj.RDN_DC = substr(rdns[0], strlen("DC="));
-
 	subobj.SAM_LDB		= "tdb://" + paths.samdb;
 	subobj.SECRETS_KEYTAB	= paths.keytab;
 	subobj.DNS_KEYTAB	= paths.dns_keytab;
@@ -527,6 +524,10 @@ function provision_become_dc(subobj, message, erase, paths, session_info)
 	var ok = provision_fix_subobj(subobj, paths);
 	assert(ok);
 
+	if (subobj.BACKEND_MOD == undefined) {
+		subobj.BACKEND_MOD = "repl_meta_data";
+	}
+
 	info.subobj = subobj;
 	info.message = message;
 	info.session_info = session_info;
@@ -613,10 +614,21 @@ function provision(subobj, message, blank, paths, session_info, credentials, lda
 	var lp = loadparm_init();
 	var sys = sys_init();
 	var info = new Object();
+	random_init(local);
 
 	var ok = provision_fix_subobj(subobj, paths);
 	assert(ok);
 
+	if (strlower(subobj.SERVERROLE) == strlower("domain controller")) {
+		if (subobj.BACKEND_MOD == undefined) {
+			subobj.BACKEND_MOD = "repl_meta_data";
+		}
+	} else {
+		if (subobj.BACKEND_MOD == undefined) {
+			subobj.BACKEND_MOD = "objectguid";
+		}
+	}
+
 	if (subobj.DOMAINGUID != undefined) {
 		subobj.DOMAINGUID_MOD = sprintf("replace: objectGUID\nobjectGUID: %s\n-", subobj.DOMAINGUID);
 	} else {
@@ -696,6 +708,20 @@ function provision(subobj, message, blank, paths, session_info, credentials, lda
 
 	samdb.set_domain_sid(subobj.DOMAINSID);
 
+	if (strlower(subobj.SERVERROLE) == strlower("domain controller")) {
+		if (subobj.INVOCATIONID == undefined) {
+			subobj.INVOCATIONID = randguid();
+		}
+		samdb.set_ntds_invocationId(subobj.INVOCATIONID);
+		if (subobj.BACKEND_MOD == undefined) {
+			subobj.BACKEND_MOD = "repl_meta_data";
+		}
+	} else {
+		if (subobj.BACKEND_MOD == undefined) {
+			subobj.BACKEND_MOD = "objectguid";
+		}
+	}
+
 	var load_schema_ok = load_schema(subobj, message, samdb);
 	assert(load_schema_ok.is_ok);
 
@@ -961,7 +987,6 @@ function provision_guess()
 	subobj.VERSION      = version();
 	subobj.HOSTIP       = hostip();
 	subobj.DOMAINSID    = randsid();
-	subobj.INVOCATIONID = randguid();
 	subobj.POLICYGUID   = randguid();
 	subobj.KRBTGTPASS   = randpass(12);
 	subobj.MACHINEPASS  = randpass(12);
@@ -969,9 +994,6 @@ function provision_guess()
 	subobj.ADMINPASS    = randpass(12);
 	subobj.LDAPMANAGERPASS     = randpass(12);
 	subobj.DEFAULTSITE  = "Default-First-Site-Name";
-	subobj.NEWGUID      = randguid;
-	subobj.NTTIME       = nttime;
-	subobj.LDAPTIME     = ldaptime;
 	subobj.DATESTRING   = datestring;
 	subobj.ROOT         = findnss(nss.getpwnam, "root");
 	subobj.NOBODY       = findnss(nss.getpwnam, "nobody");
@@ -1016,9 +1038,6 @@ function provision_guess()
 	subobj.DOMAINDN_MOD = "pdc_fsmo,password_hash,instancetype";
 	subobj.CONFIGDN_MOD = "naming_fsmo,instancetype";
 	subobj.SCHEMADN_MOD = "schema_fsmo,instancetype";
-	subobj.DOMAINDN_MOD2 = ",objectguid";
-	subobj.CONFIGDN_MOD2 = ",objectguid";
-	subobj.SCHEMADN_MOD2 = ",objectguid";
 
 	subobj.ACI		= "# no aci for local ldb";
 
diff --git a/source4/scripting/python/STATUS b/source4/scripting/python/STATUS
index 6e6475bfde..ee67b8bc7a 100644
--- a/source4/scripting/python/STATUS
+++ b/source4/scripting/python/STATUS
@@ -1,6 +1,5 @@
 dsdb/samdb/ldb_modules/tests/samba3sam.py: Fix remaining failing tests
 lib/ldb/tests/python/ldap.py: Fix remaining 3 FIXME's
-provisioning in LDAP mode(TEST_LDAP=yes PROVISION_PYTHON=yes make test)
 command-line vampire
 provisioning: combine some of the python dictionaries
 finish scripting/bin/smbstatus.py
diff --git a/source4/scripting/python/config.m4 b/source4/scripting/python/config.m4
index 908efd1588..1f03ec8e34 100644
--- a/source4/scripting/python/config.m4
+++ b/source4/scripting/python/config.m4
@@ -66,6 +66,7 @@ if test $working_python = yes; then
 	SMB_ENABLE(EXT_LIB_PYTHON,YES)
 	SMB_ENABLE(smbpython,YES)
 	SMB_ENABLE(LIBPYTHON,YES)
+	AC_DEFINE(HAVE_WORKING_PYTHON, 1, [Whether we have working python support])
 	AC_MSG_RESULT([yes])
 else
 	AC_MSG_ERROR([Python not found. Please install Python 2.x and its development headers/libraries.])
diff --git a/source4/scripting/python/config.mk b/source4/scripting/python/config.mk
index 450da0e90a..b15e1fcda7 100644
--- a/source4/scripting/python/config.mk
+++ b/source4/scripting/python/config.mk
@@ -33,7 +33,7 @@ pythonmods:: $(PYTHON_DSOS) $(PYTHON_PYS)
 PYDOCTOR_MODULES=bin/python/ldb.py bin/python/auth.py bin/python/credentials.py bin/python/registry.py bin/python/tdb.py bin/python/security.py bin/python/events.py bin/python/net.py
 
 pydoctor:: pythonmods
-	LD_LIBRARY_PATH=bin/shared PYTHONPATH=bin/python pydoctor --make-html --docformat=restructuredtext --add-package scripting/python/samba/ $(addprefix --add-module , $(PYDOCTOR_MODULES))
+	LD_LIBRARY_PATH=bin/shared PYTHONPATH=bin/python pydoctor --project-name=Samba --make-html --docformat=restructuredtext --add-package scripting/python/samba/ $(addprefix --add-module , $(PYDOCTOR_MODULES))
 
 installpython:: pythonmods
 	@$(SHELL) $(srcdir)/script/installpython.sh \
diff --git a/source4/scripting/python/misc.i b/source4/scripting/python/misc.i
index 2f41840670..a11b2fb825 100644
--- a/source4/scripting/python/misc.i
+++ b/source4/scripting/python/misc.i
@@ -66,3 +66,14 @@ WERROR dsdb_attach_schema_from_ldif_file(struct ldb_context *ldb, const char *pf
 const char *samba_version_string(void);
 int dsdb_set_global_schema(struct ldb_context *ldb);
 int ldb_register_samba_handlers(struct ldb_context *ldb);
+
+%inline %{
+bool dsdb_set_ntds_invocation_id(struct ldb_context *ldb, const char *guid)
+{
+    struct GUID invocation_id_in;
+    if (NT_STATUS_IS_ERR(GUID_from_string(guid, &invocation_id_in))) {
+        return false;
+    }
+    return samdb_set_ntds_invocation_id(ldb, &invocation_id_in);
+}
+%}
diff --git a/source4/scripting/python/misc.py b/source4/scripting/python/misc.py
index ae900a1f62..2fc7fe37e7 100644
--- a/source4/scripting/python/misc.py
+++ b/source4/scripting/python/misc.py
@@ -70,5 +70,6 @@ dsdb_attach_schema_from_ldif_file = _misc.dsdb_attach_schema_from_ldif_file
 version = _misc.version
 dsdb_set_global_schema = _misc.dsdb_set_global_schema
 ldb_register_samba_handlers = _misc.ldb_register_samba_handlers
+dsdb_set_ntds_invocation_id = _misc.dsdb_set_ntds_invocation_id
 
 
diff --git a/source4/scripting/python/misc_wrap.c b/source4/scripting/python/misc_wrap.c
index a7493550cc..f467f851bd 100644
--- a/source4/scripting/python/misc_wrap.c
+++ b/source4/scripting/python/misc_wrap.c
@@ -2794,6 +2794,16 @@ SWIG_From_int  (int value)
   return SWIG_From_long  (value);
 }
 
+
+bool dsdb_set_ntds_invocation_id(struct ldb_context *ldb, const char *guid)
+{
+    struct GUID invocation_id_in;
+    if (NT_STATUS_IS_ERR(GUID_from_string(guid, &invocation_id_in))) {
+        return false;
+    }
+    return samdb_set_ntds_invocation_id(ldb, &invocation_id_in);
+}
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -3102,6 +3112,46 @@ fail:
 }
 
 
+SWIGINTERN PyObject *_wrap_dsdb_set_ntds_invocation_id(PyObject *SWIGUNUSEDPARM(self), PyObject *args, PyObject *kwargs) {
+  PyObject *resultobj = 0;
+  struct ldb_context *arg1 = (struct ldb_context *) 0 ;
+  char *arg2 = (char *) 0 ;
+  bool result;
+  void *argp1 = 0 ;
+  int res1 = 0 ;
+  int res2 ;
+  char *buf2 = 0 ;
+  int alloc2 = 0 ;
+  PyObject * obj0 = 0 ;
+  PyObject * obj1 = 0 ;
+  char *  kwnames[] = {
+    (char *) "ldb",(char *) "guid", NULL 
+  };
+  
+  if (!PyArg_ParseTupleAndKeywords(args,kwargs,(char *)"OO:dsdb_set_ntds_invocation_id",kwnames,&obj0,&obj1)) SWIG_fail;
+  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_ldb_context, 0 |  0 );
+  if (!SWIG_IsOK(res1)) {
+    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "dsdb_set_ntds_invocation_id" "', argument " "1"" of type '" "struct ldb_context *""'"); 
+  }
+  arg1 = (struct ldb_context *)(argp1);
+  res2 = SWIG_AsCharPtrAndSize(obj1, &buf2, NULL, &alloc2);
+  if (!SWIG_IsOK(res2)) {
+    SWIG_exception_fail(SWIG_ArgError(res2), "in method '" "dsdb_set_ntds_invocation_id" "', argument " "2"" of type '" "char const *""'");
+  }
+  arg2 = (char *)(buf2);
+  if (arg1 == NULL)
+  SWIG_exception(SWIG_ValueError, 
+    "ldb context must be non-NULL");
+  result = (bool)dsdb_set_ntds_invocation_id(arg1,(char const *)arg2);
+  resultobj = SWIG_From_bool((bool)(result));
+  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
+  return resultobj;
+fail:
+  if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
+  return NULL;
+}
+
+
 static PyMethodDef SwigMethods[] = {
 	 { (char *)"random_password", (PyCFunction) _wrap_random_password, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"ldb_set_credentials", (PyCFunction) _wrap_ldb_set_credentials, METH_VARARGS | METH_KEYWORDS, NULL},
@@ -3112,6 +3162,7 @@ static PyMethodDef SwigMethods[] = {
 	 { (char *)"version", (PyCFunction)_wrap_version, METH_NOARGS, NULL},
 	 { (char *)"dsdb_set_global_schema", (PyCFunction) _wrap_dsdb_set_global_schema, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { (char *)"ldb_register_samba_handlers", (PyCFunction) _wrap_ldb_register_samba_handlers, METH_VARARGS | METH_KEYWORDS, NULL},
+	 { (char *)"dsdb_set_ntds_invocation_id", (PyCFunction) _wrap_dsdb_set_ntds_invocation_id, METH_VARARGS | METH_KEYWORDS, NULL},
 	 { NULL, NULL, 0, NULL }
 };
 
diff --git a/source4/scripting/python/modules.c b/source4/scripting/python/modules.c
index fff981e941..2ecad20b8e 100644
--- a/source4/scripting/python/modules.c
+++ b/source4/scripting/python/modules.c
@@ -62,7 +62,7 @@ void py_load_samba_modules(void)
 void py_update_path(const char *bindir)
 {
 	char *newpath;
-	asprintf(&newpath, "%s:%s/python:%s/../scripting/python", Py_GetPath(), bindir, bindir);
+	asprintf(&newpath, "%s/python:%s/../scripting/python:%s", bindir, bindir, Py_GetPath());
 	PySys_SetPath(newpath);
 	free(newpath);
 }
diff --git a/source4/scripting/python/pyrpc.h b/source4/scripting/python/pyrpc.h
index 5390c6923d..3a5d235cfc 100644
--- a/source4/scripting/python/pyrpc.h
+++ b/source4/scripting/python/pyrpc.h
@@ -27,3 +27,8 @@
 #define dom_sid28_Type dom_sid_Type
 #define dom_sid2_Check dom_sid_Check
 #define dom_sid28_Check dom_sid28_Check
+
+/* This macro is only provided by Python >= 2.3 */
+#ifndef PyAPI_DATA
+#   define PyAPI_DATA(RTYPE) extern RTYPE
+#endif
diff --git a/source4/scripting/python/samba/__init__.py b/source4/scripting/python/samba/__init__.py
index 483929661d..b041165800 100644
--- a/source4/scripting/python/samba/__init__.py
+++ b/source4/scripting/python/samba/__init__.py
@@ -1,8 +1,10 @@
 #!/usr/bin/python
 
 # Unix SMB/CIFS implementation.
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
+# 
+# Based on the original in EJS:
 # Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
-# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
 #   
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -89,7 +91,7 @@ class Ldb(ldb.Ldb):
     set_session_info = misc.ldb_set_session_info
     set_loadparm = misc.ldb_set_loadparm
 
-    def searchone(self, basedn, attribute, expression=None, 
+    def searchone(self, attribute, basedn=None, expression=None, 
                   scope=ldb.SCOPE_BASE):
         """Search for one attribute as a string.
         
@@ -104,7 +106,7 @@ class Ldb(ldb.Ldb):
             return None
         values = set(res[0][attribute])
         assert len(values) == 1
-        return values.pop()
+        return self.schema_format_value(attribute, values.pop())
 
     def erase(self):
         """Erase this ldb, removing all records."""
@@ -192,6 +194,21 @@ def substitute_var(text, values):
     return text
 
 
+def check_all_substituted(text):
+    """Make sure that all substitution variables in a string have been replaced.
+    If not, raise an exception.
+    
+    :param text: The text to search for substitution variables
+    """
+    if not "${" in text:
+    	return
+    
+    var_start = text.find("${")
+    var_end = text.find("}", var_start)
+    
+    raise Exception("Not all variables substituted: %s" % text[var_start:var_end+1])
+
+
 def valid_netbios_name(name):
     """Check whether a name is valid as a NetBIOS name. """
     # FIXME: There are probably more constraints here. 
diff --git a/source4/scripting/python/samba/getopt.py b/source4/scripting/python/samba/getopt.py
index a087974a69..088a5acf6f 100644
--- a/source4/scripting/python/samba/getopt.py
+++ b/source4/scripting/python/samba/getopt.py
@@ -23,9 +23,25 @@ from credentials import Credentials
 class SambaOptions(optparse.OptionGroup):
     def __init__(self, parser):
         optparse.OptionGroup.__init__(self, parser, "Samba Common Options")
-        self.add_option("-s", "--configfile", type="string", metavar="FILE",
-                        help="Configuration file")
+        self.add_option("-s", "--configfile", action="callback",
+                        type=str, metavar="FILE", help="Configuration file", 
+                        callback=self._load_configfile)
+        self._configfile = None
 
+    def get_loadparm_path(self):
+        return self._configfile
+
+    def _load_configfile(self, option, opt_str, arg, parser):
+        self._configfile = arg
+
+    def get_loadparm(self):
+        import param
+        lp = param.LoadParm()
+        if self._configfile is None:
+            lp.load_default()
+        else:
+            lp.load(self._configfile)
+        return lp
 
 class VersionOptions(optparse.OptionGroup):
     def __init__(self, parser):
@@ -34,6 +50,7 @@ class VersionOptions(optparse.OptionGroup):
 
 class CredentialsOptions(optparse.OptionGroup):
     def __init__(self, parser):
+        self.no_pass = False
         optparse.OptionGroup.__init__(self, parser, "Credentials Options")
         self.add_option("--simple-bind-dn", metavar="DN", action="callback",
                         callback=self._set_simple_bind_dn, type=str,
@@ -46,6 +63,8 @@ class CredentialsOptions(optparse.OptionGroup):
         self.add_option("-W", "--workgroup", metavar="WORKGROUP", 
                         action="callback", type=str,
                         help="Workgroup", callback=self._parse_workgroup)
+        self.add_option("-N", "--no-pass", action="store_true",
+                        help="Don't ask for a password")
         self.creds = Credentials()
 
     def _parse_username(self, option, opt_str, arg, parser):
@@ -61,4 +80,7 @@ class CredentialsOptions(optparse.OptionGroup):
         self.creds.set_bind_dn(arg)
 
     def get_credentials(self):
+        self.creds.guess()
+        if not self.no_pass:
+            self.creds.set_cmdline_callbacks()
         return self.creds
diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py
index d59cea121e..4f52d36167 100644
--- a/source4/scripting/python/samba/provision.py
+++ b/source4/scripting/python/samba/provision.py
@@ -1,10 +1,25 @@
 #
-#    backend code for provisioning a Samba4 server
-#    Released under the GNU GPL v3 or later
-#    Copyright Jelmer Vernooij 2007
+# Unix SMB/CIFS implementation.
+# backend code for provisioning a Samba4 server
+
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
+# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
 #
 # Based on the original in EJS:
-#    Copyright Andrew Tridgell 2005
+# Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#   
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#   
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 
 from base64 import b64encode
@@ -17,9 +32,10 @@ from socket import gethostname, gethostbyname
 import param
 import registry
 import samba
-from samba import Ldb, substitute_var, valid_netbios_name
+from samba import Ldb, substitute_var, valid_netbios_name, check_all_substituted
 from samba.samdb import SamDB
 import security
+import urllib
 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
         LDB_ERR_NO_SUCH_OBJECT, timestring, CHANGETYPE_MODIFY, CHANGETYPE_NONE
 
@@ -48,12 +64,9 @@ class ProvisionPaths:
         self.dns_keytab = None
         self.dns = None
         self.winsdb = None
-        self.ldap_basedn_ldif = None
-        self.ldap_config_basedn_ldif = None
-        self.ldap_schema_basedn_ldif = None
 
 
-def install_ok(lp, session_info, credentials):
+def check_install(lp, session_info, credentials):
     """Check whether the current install seems ok.
     
     :param lp: Loadparm context
@@ -61,22 +74,26 @@ def install_ok(lp, session_info, credentials):
     :param credentials: Credentials
     """
     if lp.get("realm") == "":
-        return False
+        raise Error("Realm empty")
     ldb = Ldb(lp.get("sam database"), session_info=session_info, 
             credentials=credentials, lp=lp)
     if len(ldb.search("(cn=Administrator)")) != 1:
-        return False
-    return True
+        raise "No administrator account found"
 
 
-def findnss(nssfn, *names):
-    """Find a user or group from a list of possibilities."""
+def findnss(nssfn, names):
+    """Find a user or group from a list of possibilities.
+    
+    :param nssfn: NSS Function to try (should raise KeyError if not found)
+    :param names: Names to check.
+    :return: Value return by first names list.
+    """
     for name in names:
         try:
             return nssfn(name)
         except KeyError:
             pass
-    raise Exception("Unable to find user/group for %s" % arguments[1])
+    raise KeyError("Unable to find user/group %r" % names)
 
 
 def open_ldb(session_info, credentials, lp, dbname):
@@ -112,7 +129,7 @@ def setup_add_ldif(ldb, ldif_path, subst_vars=None):
     if subst_vars is not None:
         data = substitute_var(data, subst_vars)
 
-    assert "${" not in data
+    check_all_substituted(data)
 
     ldb.add_ldif(data)
 
@@ -128,12 +145,20 @@ def setup_modify_ldif(ldb, ldif_path, substvars=None):
     if substvars is not None:
         data = substitute_var(data, substvars)
 
-    assert "${" not in data
+    check_all_substituted(data)
 
     ldb.modify_ldif(data)
 
 
 def setup_ldb(ldb, ldif_path, subst_vars):
+    """Import a LDIF a file into a LDB handle, optionally substituting variables.
+
+    :note: Either all LDIF data will be added or none (using transactions).
+
+    :param ldb: LDB file to import into.
+    :param ldif_path: Path to the LDIF file.
+    :param subst_vars: Dictionary with substitution variables.
+    """
     assert ldb is not None
     ldb.transaction_start()
     try:
@@ -159,7 +184,7 @@ def setup_file(template, fname, substvars):
     data = open(template, 'r').read()
     if substvars:
         data = substitute_var(data, substvars)
-    assert not "${" in data
+    check_all_substituted(data)
 
     open(f, 'w').write(data)
 
@@ -172,18 +197,26 @@ def provision_paths_from_lp(lp, dnsdomain):
     """
     paths = ProvisionPaths()
     private_dir = lp.get("private dir")
+    paths.keytab = "secrets.keytab"
+    paths.dns_keytab = "dns.keytab"
+
     paths.shareconf = os.path.join(private_dir, "share.ldb")
     paths.samdb = os.path.join(private_dir, lp.get("sam database") or "samdb.ldb")
     paths.secrets = os.path.join(private_dir, lp.get("secrets database") or "secrets.ldb")
     paths.templates = os.path.join(private_dir, "templates.ldb")
-    paths.keytab = os.path.join(private_dir, "secrets.keytab")
-    paths.dns_keytab = os.path.join(private_dir, "dns.keytab")
     paths.dns = os.path.join(private_dir, dnsdomain + ".zone")
     paths.winsdb = os.path.join(private_dir, "wins.ldb")
     paths.s4_ldapi_path = os.path.join(private_dir, "ldapi")
+    paths.smbconf = os.path.join(private_dir, "smb.conf")
     paths.phpldapadminconfig = os.path.join(private_dir, 
                                             "phpldapadmin-config.php")
-    paths.hklm = os.path.join(private_dir, "hklm.ldb")
+    paths.hklm = "hklm.ldb"
+    paths.hkcr = "hkcr.ldb"
+    paths.hkcu = "hkcu.ldb"
+    paths.hku = "hku.ldb"
+    paths.hkpd = "hkpd.ldb"
+    paths.hkpt = "hkpt.ldb"
+
     paths.sysvol = lp.get("sysvol", "path")
     if paths.sysvol is None:
         paths.sysvol = os.path.join(lp.get("lock dir"), "sysvol")
@@ -235,77 +268,201 @@ def setup_name_mappings(ldb, sid, domaindn, root, nobody, nogroup, users,
     ldb.setup_name_mapping(domaindn, sid + "-520", wheel)
 
 
-def provision_become_dc(setup_dir, message, paths, lp, session_info, 
-                        credentials):
+def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, 
+                           credentials, configdn, schemadn, domaindn, 
+                           hostname, netbiosname, dnsdomain, realm, 
+                           rootdn, serverrole, ldap_backend=None, 
+                           ldap_backend_type=None, erase=False):
+    """Setup the partitions for the SAM database. 
+    
+    Alternatively, provision() may call this, and then populate the database.
+    
+    :param erase: Remove the existing data present in the database.
+     
+    :note: This will wipe the Sam Database!
+    
+    :note: This function always removes the local SAM LDB file. The erase 
+        parameter controls whether to erase the existing data, which 
+        may not be stored locally but in LDAP.
+    """
     assert session_info is not None
-    erase = False
-
-    def setup_path(file):
-        return os.path.join(setup_dir, file)
-    os.path.unlink(paths.samdb)
 
-    message("Setting up templates db")
-    setup_templatesdb(paths.templates, setup_path, session_info=session_info, 
-                      credentials=credentials, lp=lp)
+    if os.path.exists(samdb_path):
+        os.unlink(samdb_path)
 
     # Also wipes the database
-    message("Setting up sam.ldb")
-    samdb = SamDB(paths.samdb, session_info=session_info, 
+    samdb = SamDB(samdb_path, session_info=session_info, 
                   credentials=credentials, lp=lp)
 
-    message("Setting up sam.ldb partitions")
-    setup_samdb_partitions(samdb, setup_path, schemadn, configdn, domaindn)
+    #Add modules to the list to activate them by default
+    #beware often order is important
+    #
+    # Some Known ordering constraints:
+    # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
+    # - objectclass must be before password_hash, because password_hash checks
+    #   that the objectclass is of type person (filled in by objectclass
+    #   module when expanding the objectclass list)
+    # - partition must be last
+    # - each partition has its own module list then
+    modules_list = ["rootdse",
+                    "paged_results",
+                    "ranged_results",
+                    "anr",
+                    "server_sort",
+                    "extended_dn",
+                    "asq",
+                    "samldb",
+                    "rdn_name",
+                    "objectclass",
+                    "kludge_acl",
+                    "operational"]
+    tdb_modules_list = [
+                    "subtree_rename",
+                    "subtree_delete",
+                    "linked_attributes"]
+    modules_list2 = ["show_deleted",
+                    "partition"]
+ 
+    domaindn_ldb = "users.ldb"
+    if ldap_backend is not None:
+        domaindn_ldb = ldap_backend
+    configdn_ldb = "configuration.ldb"
+    if ldap_backend is not None:
+        configdn_ldb = ldap_backend
+    schemadn_ldb = "schema.ldb"
+    if ldap_backend is not None:
+        schema_ldb = ldap_backend
+    
+    	schemadn_ldb = ldap_backend
+    	
+    if ldap_backend_type == "fedora-ds":
+        backend_modules = ["nsuniqueid","paged_searches"]
+    elif ldap_backend_type == "openldap":
+        backend_modules = ["normalise","entryuuid","paged_searches"]
+    elif serverrole == "domain controller":
+        backend_modules = ["repl_meta_data"]
+    else:
+        backend_modules = ["objectguid"]
+        
+    samdb.transaction_start()
+    try:
+        setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
+                "SCHEMADN": schemadn, 
+                "SCHEMADN_LDB": schemadn_ldb,
+                "SCHEMADN_MOD2": ",objectguid",
+                "CONFIGDN": configdn,
+                "CONFIGDN_LDB": configdn_ldb,
+                "DOMAINDN": domaindn,
+                "DOMAINDN_LDB": domaindn_ldb,
+                "SCHEMADN_MOD": "schema_fsmo,instancetype",
+                "CONFIGDN_MOD": "naming_fsmo,instancetype",
+                "DOMAINDN_MOD": "pdc_fsmo,password_hash,instancetype",
+                "MODULES_LIST": ",".join(modules_list),
+                "TDB_MODULES_LIST": ","+",".join(tdb_modules_list),
+                "MODULES_LIST2": ",".join(modules_list2),
+                "BACKEND_MOD": ",".join(backend_modules),
+        })
+
+    except:
+        samdb.transaction_cancel()
+        raise
 
-    samdb = SamDB(paths.samdb, session_info=session_info, 
+    samdb.transaction_commit()
+    
+    samdb = SamDB(samdb_path, session_info=session_info, 
                   credentials=credentials, lp=lp)
 
-    ldb.transaction_start()
+    samdb.transaction_start()
     try:
         message("Setting up sam.ldb attributes")
         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
 
         message("Setting up sam.ldb rootDSE")
-        setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, 
-                            hostname, dnsdomain, realm, rootdn, configdn, 
-                            netbiosname)
+        setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
+                            dnsdomain, realm, rootdn, configdn, netbiosname)
 
         if erase:
             message("Erasing data from partitions")
             samdb.erase_partitions()
 
-        message("Setting up sam.ldb indexes")
-        samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
     except:
         samdb.transaction_cancel()
         raise
 
     samdb.transaction_commit()
+    
+    return samdb
+
 
-    message("Setting up %s" % paths.secrets)
-    secrets_ldb = setup_secretsdb(paths.secrets, setup_path, session_info, 
-                                  credentials, lp)
-    setup_ldb(secrets_ldb, setup_path("secrets_dc.ldif"), 
-              { "MACHINEPASS_B64": b64encode(machinepass) })
+def secretsdb_become_dc(secretsdb, setup_path, domain, realm, dnsdomain, 
+                        netbiosname, domainsid, keytab_path, samdb_url, 
+                        dns_keytab_path, dnspass, machinepass):
+    """Add DC-specific bits to a secrets database.
+    
+    :param secretsdb: Ldb Handle to the secrets database
+    :param setup_path: Setup path function
+    :param machinepass: Machine password
+    """
+    setup_ldb(secretsdb, setup_path("secrets_dc.ldif"), { 
+            "MACHINEPASS_B64": b64encode(machinepass),
+            "DOMAIN": domain,
+            "REALM": realm,
+            "DNSDOMAIN": dnsdomain,
+            "DOMAINSID": str(domainsid),
+            "SECRETS_KEYTAB": keytab_path,
+            "NETBIOSNAME": netbiosname,
+            "SAM_LDB": samdb_url,
+            "DNS_KEYTAB": dns_keytab_path,
+            "DNSPASS_B64": b64encode(dnspass),
+            })
 
 
 def setup_secretsdb(path, setup_path, session_info, credentials, lp):
+    """Setup the secrets database.
+
+    :param path: Path to the secrets database.
+    :param setup_path: Get the path to a setup file.
+    :param session_info: Session info.
+    :param credentials: Credentials
+    :param lp: Loadparm context
+    :return: LDB handle for the created secrets database
+    """
     if os.path.exists(path):
         os.unlink(path)
-    secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials, lp=lp)
+    secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
+                      lp=lp)
     secrets_ldb.erase()
     secrets_ldb.load_ldif_file_add(setup_path("secrets_init.ldif"))
+    secrets_ldb = Ldb(path, session_info=session_info, credentials=credentials,
+                      lp=lp)
     secrets_ldb.load_ldif_file_add(setup_path("secrets.ldif"))
     return secrets_ldb
 
 
 def setup_templatesdb(path, setup_path, session_info, credentials, lp):
+    """Setup the templates database.
+
+    :param path: Path to the database.
+    :param setup_path: Function for obtaining the path to setup files.
+    :param session_info: Session info
+    :param credentials: Credentials
+    :param lp: Loadparm context
+    """
     templates_ldb = SamDB(path, session_info=session_info,
-                        credentials=credentials, lp=lp)
+                          credentials=credentials, lp=lp)
     templates_ldb.erase()
     templates_ldb.load_ldif_file_add(setup_path("provision_templates.ldif"))
 
 
 def setup_registry(path, setup_path, session_info, credentials, lp):
+    """Setup the registry.
+    
+    :param path: Path to the registry database
+    :param setup_path: Function that returns the path to a setup.
+    :param session_info: Session information
+    :param credentials: Credentials
+    :param lp: Loadparm context
+    """
     reg = registry.Registry()
     hive = registry.open_ldb(path, session_info=session_info, 
                          credentials=credentials, lp_ctx=lp)
@@ -317,6 +474,11 @@ def setup_registry(path, setup_path, session_info, credentials, lp):
 
 def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
                         dnsdomain, realm, rootdn, configdn, netbiosname):
+    """Setup the SamDB rootdse.
+
+    :param samdb: Sam Database handle
+    :param setup_path: Obtain setup path
+    """
     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
         "SCHEMADN": schemadn, 
         "NETBIOSNAME": netbiosname,
@@ -329,61 +491,13 @@ def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname,
         "CONFIGDN": configdn,
         "VERSION": samba.version(),
         })
-
-
-def setup_samdb_partitions(samdb, setup_path, schemadn, configdn, domaindn):
-    #Add modules to the list to activate them by default
-    #beware often order is important
-    #
-    # Some Known ordering constraints:
-    # - rootdse must be first, as it makes redirects from "" -> cn=rootdse
-    # - objectclass must be before password_hash, because password_hash checks
-    #   that the objectclass is of type person (filled in by objectclass
-    #   module when expanding the objectclass list)
-    # - partition must be last
-    # - each partition has its own module list then
-    modules_list = ["rootdse",
-                    "paged_results",
-                    "ranged_results",
-                    "anr",
-                    "server_sort",
-                    "extended_dn",
-                    "asq",
-                    "samldb",
-                    "rdn_name",
-                    "objectclass",
-                    "kludge_acl",
-                    "operational"]
-    tdb_modules_list = [
-                    "subtree_rename",
-                    "subtree_delete",
-                    "linked_attributes"]
-    modules_list2 = ["show_deleted",
-                    "partition"]
- 
-    setup_add_ldif(samdb, setup_path("provision_partitions.ldif"), {
-        "SCHEMADN": schemadn, 
-        "SCHEMADN_LDB": "schema.ldb",
-        "SCHEMADN_MOD2": ",objectguid",
-        "CONFIGDN": configdn,
-        "CONFIGDN_LDB": "configuration.ldb",
-        "DOMAINDN": domaindn,
-        "DOMAINDN_LDB": "users.ldb",
-        "SCHEMADN_MOD": "schema_fsmo",
-        "CONFIGDN_MOD": "naming_fsmo",
-        "CONFIGDN_MOD2": ",objectguid",
-        "DOMAINDN_MOD": "pdc_fsmo,password_hash",
-        "DOMAINDN_MOD2": ",objectguid",
-        "MODULES_LIST": ",".join(modules_list),
-        "TDB_MODULES_LIST": ","+",".join(tdb_modules_list),
-        "MODULES_LIST2": ",".join(modules_list2),
-        })
-
+        
 
 def setup_self_join(samdb, configdn, schemadn, domaindn, 
                     netbiosname, hostname, dnsdomain, machinepass, dnspass, 
                     realm, domainname, domainsid, invocationid, setup_path,
                     policyguid, hostguid=None):
+    """Join a host to its own domain."""
     if hostguid is not None:
         hostguid_add = "objectGUID: %s" % hostguid
     else:
@@ -413,43 +527,40 @@ def setup_self_join(samdb, configdn, schemadn, domaindn,
 def setup_samdb(path, setup_path, session_info, credentials, lp, 
                 schemadn, configdn, domaindn, dnsdomain, realm, 
                 netbiosname, message, hostname, rootdn, erase, 
-                domainsid, aci, rdn_dc, domainguid, policyguid, 
-                domainname, blank, adminpass, krbtgtpass, 
-                machinepass, hostguid, invocationid, dnspass):
-    # Also wipes the database
-    message("Setting up sam.ldb")
-    samdb = SamDB(path, session_info=session_info, 
-                  credentials=credentials, lp=lp)
+                domainsid, aci, domainguid, policyguid, 
+                domainname, fill, adminpass, krbtgtpass, 
+                machinepass, hostguid, invocationid, dnspass,
+                serverrole, ldap_backend=None, ldap_backend_type=None):
+    """Setup a complete SAM Database.
+    
+    :note: This will wipe the main SAM database file!
+    """
 
-    message("Setting up sam.ldb partitions")
-    setup_samdb_partitions(samdb, setup_path, schemadn, configdn, domaindn)
+    # Also wipes the database
+    setup_samdb_partitions(path, setup_path, schemadn=schemadn, configdn=configdn, 
+                           domaindn=domaindn, message=message, lp=lp,
+                           credentials=credentials, session_info=session_info,
+                           hostname=hostname, netbiosname=netbiosname, 
+                           dnsdomain=dnsdomain, realm=realm, rootdn=rootdn,
+                           ldap_backend=ldap_backend, serverrole=serverrole,
+                           ldap_backend_type=ldap_backend_type, erase=erase)
 
     samdb = SamDB(path, session_info=session_info, 
                   credentials=credentials, lp=lp)
 
-    samdb.transaction_start()
-    try:
-        message("Setting up sam.ldb attributes")
-        samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
-
-        message("Setting up sam.ldb rootDSE")
-        setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, 
-                            hostname, dnsdomain, realm, rootdn, configdn, 
-                            netbiosname)
-
-        if erase:
-            message("Erasing data from partitions")
-            samdb.erase_partitions()
-    except:
-        samdb.transaction_cancel()
-        raise
-
-    samdb.transaction_commit()
+    if fill == FILL_DRS:
+       # We want to finish here, but setup the index before we do so
+        message("Setting up sam.ldb index")
+        samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
+        return samdb
 
     message("Pre-loading the Samba 4 and AD schema")
     samdb = SamDB(path, session_info=session_info, 
                   credentials=credentials, lp=lp)
     samdb.set_domain_sid(domainsid)
+    if lp.get("server role") == "domain controller":
+        samdb.set_invocation_id(invocationid)
+
     load_schema(setup_path, samdb, schemadn, netbiosname, configdn)
 
     samdb.transaction_start()
@@ -459,7 +570,6 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
         setup_add_ldif(samdb, setup_path("provision_basedn.ldif"), {
             "DOMAINDN": domaindn,
             "ACI": aci,
-            "RDN_DC": rdn_dc,
             })
 
         message("Modifying DomainDN: " + domaindn + "")
@@ -469,7 +579,6 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
             domainguid_mod = ""
 
         setup_modify_ldif(samdb, setup_path("provision_basedn_modify.ldif"), {
-            "RDN_DC": rdn_dc,
             "LDAPTIME": timestring(int(time.time())),
             "DOMAINSID": str(domainsid),
             "SCHEMADN": schemadn, 
@@ -500,7 +609,8 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
             "EXTENSIBLEOBJECT": "# no objectClass: extensibleObject for local ldb"
             })
         message("Modifying schema container")
-        setup_modify_ldif(samdb, setup_path("provision_schema_basedn_modify.ldif"), {
+        setup_modify_ldif(samdb, 
+            setup_path("provision_schema_basedn_modify.ldif"), {
             "SCHEMADN": schemadn,
             "NETBIOSNAME": netbiosname,
             "DEFAULTSITE": DEFAULTSITE,
@@ -549,7 +659,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
             "CONFIGDN": configdn,
             })
 
-        if not blank:
+        if fill == FILL_FULL:
             message("Setting up sam.ldb users and groups")
             setup_add_ldif(samdb, setup_path("provision_users.ldif"), {
                 "DOMAINDN": domaindn,
@@ -561,17 +671,18 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
 
             if lp.get("server role") == "domain controller":
                 message("Setting up self join")
-                setup_self_join(samdb, configdn=configdn, schemadn=schemadn, domaindn=domaindn, 
-                                invocationid=invocationid, dnspass=dnspass, netbiosname=netbiosname,
-                                dnsdomain=dnsdomain, realm=realm, machinepass=machinepass, 
-                                domainname=domainname, domainsid=domainsid, policyguid=policyguid,
-                                hostname=hostname, hostguid=hostguid, setup_path=setup_path)
-
+                setup_self_join(samdb, configdn=configdn, schemadn=schemadn, 
+                                domaindn=domaindn, invocationid=invocationid, 
+                                dnspass=dnspass, netbiosname=netbiosname, 
+                                dnsdomain=dnsdomain, realm=realm, 
+                                machinepass=machinepass, domainname=domainname, 
+                                domainsid=domainsid, policyguid=policyguid,
+                                hostname=hostname, hostguid=hostguid, 
+                                setup_path=setup_path)
+
+    #We want to setup the index last, as adds are faster unindexed
         message("Setting up sam.ldb index")
         samdb.load_ldif_file_add(setup_path("provision_index.ldif"))
-
-        message("Setting up sam.ldb rootDSE marking as synchronized")
-        setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
     except:
         samdb.transaction_cancel()
         raise
@@ -579,14 +690,18 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
     samdb.transaction_commit()
     return samdb
 
-
-def provision(lp, setup_dir, message, blank, paths, session_info, 
-              credentials, ldapbackend, realm=None, domain=None, hostname=None, 
-              hostip=None, domainsid=None, hostguid=None, adminpass=None, 
-              krbtgtpass=None, domainguid=None, policyguid=None, 
-              invocationid=None, machinepass=None, dnspass=None, root=None,
-              nobody=None, nogroup=None, users=None, wheel=None, backup=None, 
-              aci=None, serverrole=None):
+FILL_FULL = "FULL"
+FILL_NT4SYNC = "NT4SYNC"
+FILL_DRS = "DRS"
+
+def provision(lp, setup_dir, message, paths, session_info, 
+              credentials, samdb_fill=FILL_FULL, realm=None, rootdn=None,
+              domain=None, hostname=None, hostip=None, domainsid=None, 
+              hostguid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
+              policyguid=None, invocationid=None, machinepass=None, 
+              dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
+              wheel=None, backup=None, aci=None, serverrole=None, erase=False,
+              ldap_backend=None, ldap_backend_type=None):
     """Provision samba4
     
     :note: caution, this wipes all existing data!
@@ -595,14 +710,10 @@ def provision(lp, setup_dir, message, blank, paths, session_info,
     def setup_path(file):
         return os.path.join(setup_dir, file)
 
-    erase = False
-
     if domainsid is None:
         domainsid = security.random_sid()
     if policyguid is None:
         policyguid = uuid.random()
-    if invocationid is None:
-        invocationid = uuid.random()
     if adminpass is None:
         adminpass = misc.random_password(12)
     if krbtgtpass is None:
@@ -612,45 +723,42 @@ def provision(lp, setup_dir, message, blank, paths, session_info,
     if dnspass is None:
         dnspass = misc.random_password(12)
     if root is None:
-        root = findnss(pwd.getpwnam, "root")[4]
+        root = findnss(pwd.getpwnam, ["root"])[0]
     if nobody is None:
-        nobody = findnss(pwd.getpwnam, "nobody")[4]
+        nobody = findnss(pwd.getpwnam, ["nobody"])[0]
     if nogroup is None:
-        nogroup = findnss(grp.getgrnam, "nogroup", "nobody")[2]
+        nogroup = findnss(grp.getgrnam, ["nogroup", "nobody"])[0]
     if users is None:
-        users = findnss(grp.getgrnam, "users", "guest", "other", "unknown", 
-                        "usr")[2]
+        users = findnss(grp.getgrnam, ["users", "guest", "other", "unknown", 
+                        "usr"])[0]
     if wheel is None:
-        wheel = findnss(grp.getgrnam, "wheel", "root", "staff", "adm")[2]
+        wheel = findnss(grp.getgrnam, ["wheel", "root", "staff", "adm"])[0]
     if backup is None:
-        backup = findnss(grp.getgrnam, "backup", "wheel", "root", "staff")[2]
+        backup = findnss(grp.getgrnam, ["backup", "wheel", "root", "staff"])[0]
     if aci is None:
         aci = "# no aci for local ldb"
     if serverrole is None:
         serverrole = lp.get("server role")
+    assert serverrole in ("domain controller", "member server")
+    if invocationid is None and serverrole == "domain controller":
+        invocationid = uuid.random()
 
     if realm is None:
         realm = lp.get("realm")
-    else:
-        if lp.get("realm").upper() != realm.upper():
-            raise Exception("realm '%s' in smb.conf must match chosen realm '%s'\n" %
+
+    if lp.get("realm").upper() != realm.upper():
+        raise Exception("realm '%s' in smb.conf must match chosen realm '%s'" %
                 (lp.get("realm"), realm))
 
+    ldapi_url = "ldapi://%s" % urllib.quote(paths.s4_ldapi_path, safe="")
+    
+    if ldap_backend == "ldapi":
+        # provision-backend will set this path suggested slapd command line / fedorads.inf
+        ldap_backend = "ldapi://" % urllib.quote(os.path.join(lp.get("private dir"), "ldap", "ldapi"), safe="")
+
     assert realm is not None
     realm = realm.upper()
 
-    if domain is None:
-        domain = lp.get("workgroup")
-    else:
-        if lp.get("workgroup").upper() != domain.upper():
-            raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'\n",
-                lp.get("workgroup"), domain)
-
-    assert domain is not None
-    domain = domain.upper()
-    if not valid_netbios_name(domain):
-        raise InvalidNetbiosName(domain)
-
     if hostname is None:
         hostname = gethostname().split(".")[0].lower()
 
@@ -661,13 +769,29 @@ def provision(lp, setup_dir, message, blank, paths, session_info,
     if not valid_netbios_name(netbiosname):
         raise InvalidNetbiosName(netbiosname)
 
-    dnsdomain    = realm.lower()
-    domaindn     = "DC=" + dnsdomain.replace(".", ",DC=")
-    rootdn       = domaindn
-    configdn     = "CN=Configuration," + rootdn
-    schemadn     = "CN=Schema," + configdn
+    dnsdomain = realm.lower()
+    if serverrole == "domain controller":
+        domaindn = "DC=" + dnsdomain.replace(".", ",DC=")
+        if domain is None:
+            domain = lp.get("workgroup")
+    
+        if lp.get("workgroup").upper() != domain.upper():
+            raise Error("workgroup '%s' in smb.conf must match chosen domain '%s'",
+                lp.get("workgroup"), domain)
 
-    rdn_dc = domaindn.split(",")[0][len("DC="):]
+        assert domain is not None
+        domain = domain.upper()
+        if not valid_netbios_name(domain):
+            raise InvalidNetbiosName(domain)
+    else:
+        domaindn = "CN=" + netbiosname
+        domain = netbiosname
+    
+    if rootdn is None:
+       rootdn = domaindn
+       
+    configdn = "CN=Configuration," + rootdn
+    schemadn = "CN=Schema," + configdn
 
     message("set DOMAIN SID: %s" % str(domainsid))
     message("Provisioning for %s in realm %s" % (domain, realm))
@@ -682,9 +806,8 @@ def provision(lp, setup_dir, message, blank, paths, session_info,
             smbconfsuffix = "dc"
         elif serverrole == "member":
             smbconfsuffix = "member"
-        else:
-            assert "Invalid server role setting: %s" % serverrole
-        setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), paths.smbconf, {
+        setup_file(setup_path("provision.smb.conf.%s" % smbconfsuffix), 
+                   paths.smbconf, {
             "HOSTNAME": hostname,
             "DOMAIN_CONF": domain,
             "REALM_CONF": realm,
@@ -692,7 +815,7 @@ def provision(lp, setup_dir, message, blank, paths, session_info,
             "NETLOGONPATH": paths.netlogon,
             "SYSVOLPATH": paths.sysvol,
             })
-        lp.reload()
+        lp.load(paths.smbconf)
 
     # only install a new shares config db if there is none
     if not os.path.exists(paths.shareconf):
@@ -701,6 +824,7 @@ def provision(lp, setup_dir, message, blank, paths, session_info,
                         credentials=credentials, lp=lp)
         share_ldb.load_ldif_file_add(setup_path("share.ldif"))
 
+     
     message("Setting up secrets.ldb")
     secrets_ldb = setup_secretsdb(paths.secrets, setup_path, 
                                   session_info=session_info, 
@@ -714,44 +838,47 @@ def provision(lp, setup_dir, message, blank, paths, session_info,
     setup_templatesdb(paths.templates, setup_path, session_info=session_info, 
                       credentials=credentials, lp=lp)
 
-    samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, credentials=credentials,
-                        lp=lp, schemadn=schemadn, configdn=configdn, domaindn=domaindn,
-                        dnsdomain=dnsdomain, netbiosname=netbiosname, realm=realm, message=message,
-                        hostname=hostname, rootdn=rootdn, erase=erase, domainsid=domainsid, aci=aci,
-                        rdn_dc=rdn_dc, domainguid=domainguid, policyguid=policyguid, 
-                        domainname=domain, blank=blank, adminpass=adminpass, krbtgtpass=krbtgtpass,
-                        hostguid=hostguid, invocationid=invocationid, machinepass=machinepass,
-                        dnspass=dnspass)
+    samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, 
+                        credentials=credentials, lp=lp, schemadn=schemadn, 
+                        configdn=configdn, domaindn=domaindn,
+                        dnsdomain=dnsdomain, netbiosname=netbiosname, 
+                        realm=realm, message=message, hostname=hostname, 
+                        rootdn=rootdn, erase=erase, domainsid=domainsid, 
+                        aci=aci, domainguid=domainguid, policyguid=policyguid, 
+                        domainname=domain, fill=samdb_fill, 
+                        adminpass=adminpass, krbtgtpass=krbtgtpass,
+                        hostguid=hostguid, invocationid=invocationid, 
+                        machinepass=machinepass, dnspass=dnspass,
+                        serverrole=serverrole, ldap_backend=ldap_backend, 
+                        ldap_backend_type=ldap_backend_type)
 
     if lp.get("server role") == "domain controller":
-        os.makedirs(os.path.join(paths.sysvol, dnsdomain, "Policies", "{" + policyguid + "}"), 0755)
-        os.makedirs(os.path.join(paths.sysvol, dnsdomain, "Policies", "{" + policyguid + "}", "Machine"), 0755)
-        os.makedirs(os.path.join(paths.sysvol, dnsdomain, "Policies", "{" + policyguid + "}", "User"), 0755)
-        if not os.path.isdir(paths.netlogon):
+       policy_path = os.path.join(paths.sysvol, dnsdomain, "Policies", 
+                                  "{" + policyguid + "}")
+       os.makedirs(policy_path, 0755)
+       os.makedirs(os.path.join(policy_path, "Machine"), 0755)
+       os.makedirs(os.path.join(policy_path, "User"), 0755)
+       if not os.path.isdir(paths.netlogon):
             os.makedirs(paths.netlogon, 0755)
-        secrets_ldb = Ldb(paths.secrets, session_info=session_info, credentials=credentials, lp=lp)
-        setup_ldb(secrets_ldb, setup_path("secrets_dc.ldif"), { 
-            "MACHINEPASS_B64": b64encode(machinepass),
-            "DOMAIN": domain,
-            "REALM": realm,
-            "LDAPTIME": timestring(int(time.time())),
-            "DNSDOMAIN": dnsdomain,
-            "DOMAINSID": str(domainsid),
-            "SECRETS_KEYTAB": paths.keytab,
-            "NETBIOSNAME": netbiosname,
-            "SAM_LDB": paths.samdb,
-            "DNS_KEYTAB": paths.dns_keytab,
-            "DNSPASS_B64": b64encode(dnspass),
-            })
-
-    if not blank:
-        setup_name_mappings(samdb, str(domainsid), 
-                        domaindn, root=root, nobody=nobody, 
-                        nogroup=nogroup, wheel=wheel, users=users,
-                        backup=backup)
+       secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
+                         credentials=credentials, lp=lp)
+       secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=realm,
+                           netbiosname=netbiosname, domainsid=domainsid, 
+                           keytab_path=paths.keytab, samdb_url=paths.samdb, 
+                           dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
+                           machinepass=machinepass, dnsdomain=dnsdomain)
+
+    if samdb_fill == FILL_FULL:
+        setup_name_mappings(samdb, str(domainsid), domaindn, root=root, 
+                            nobody=nobody, nogroup=nogroup, wheel=wheel, 
+                            users=users, backup=backup)
+   
+        message("Setting up sam.ldb rootDSE marking as synchronized")
+        setup_modify_ldif(samdb, setup_path("provision_rootdse_modify.ldif"))
 
     message("Setting up phpLDAPadmin configuration")
-    create_phplpapdadmin_config(paths.phpldapadminconfig, setup_path, paths.s4_ldapi_path)
+    create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
+                               ldapi_url)
 
     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
 
@@ -759,9 +886,9 @@ def provision(lp, setup_dir, message, blank, paths, session_info,
         samdb = SamDB(paths.samdb, session_info=session_info, 
                       credentials=credentials, lp=lp)
 
-        domainguid = samdb.searchone(domaindn, "objectGUID")
+        domainguid = samdb.searchone(basedn=domaindn, attribute="objectGUID")
         assert isinstance(domainguid, str)
-        hostguid = samdb.searchone(domaindn, "objectGUID",
+        hostguid = samdb.searchone(basedn=domaindn, attribute="objectGUID",
                 expression="(&(objectClass=computer)(cn=%s))" % hostname,
                 scope=SCOPE_SUBTREE)
         assert isinstance(hostguid, str)
@@ -775,15 +902,15 @@ def provision(lp, setup_dir, message, blank, paths, session_info,
 
     return domaindn
 
-def create_phplpapdadmin_config(path, setup_path, s4_ldapi_path):
+
+def create_phpldapadmin_config(path, setup_path, ldapi_uri):
     """Create a PHP LDAP admin configuration file.
 
     :param path: Path to write the configuration to.
     :param setup_path: Function to generate setup paths.
-    :param s4_ldapi_path: Path to Samba 4 LDAPI socket.
     """
-    setup_file(setup_path("phpldapadmin-config.php"), 
-               path, {"S4_LDAPI_URI": "ldapi://%s" % s4_ldapi_path.replace("/", "%2F")})
+    setup_file(setup_path("phpldapadmin-config.php"), path, 
+            {"S4_LDAPI_URI": ldapi_uri})
 
 
 def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn, 
@@ -802,6 +929,7 @@ def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
     :param domainguid: GUID of the domain.
     :param hostguid: GUID of the host.
     """
+    assert isinstance(domainguid, str)
 
     setup_file(setup_path("provision.zone"), path, {
             "DNSPASS_B64": b64encode(dnspass),
@@ -817,7 +945,7 @@ def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
 
 
 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn):
-    """Load schema.
+    """Load schema for the SamDB.
     
     :param samdb: Load a schema into a SamDB.
     :param setup_path: Setup path function.
@@ -833,6 +961,7 @@ def load_schema(setup_path, samdb, schemadn, netbiosname, configdn):
                     "SCHEMADN": schemadn,
                     "NETBIOSNAME": netbiosname,
                     "CONFIGDN": configdn,
-                    "DEFAULTSITE": DEFAULTSITE})
+                    "DEFAULTSITE": DEFAULTSITE
+    })
     samdb.attach_schema_from_ldif(head_data, schema_data)
 
diff --git a/source4/scripting/python/samba/samdb.py b/source4/scripting/python/samba/samdb.py
index 353eaee198..c11fabf553 100644
--- a/source4/scripting/python/samba/samdb.py
+++ b/source4/scripting/python/samba/samdb.py
@@ -1,10 +1,10 @@
 #!/usr/bin/python
 
 # Unix SMB/CIFS implementation.
-# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
 #
 # Based on the original in EJS:
-# Copyright (C) Andrew Tridgell 2005
+# Copyright (C) Andrew Tridgell <tridge@samba.org> 2005
 #   
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -105,7 +105,7 @@ userAccountControl: %u
         assert(len(res) == 1 and res[0].defaultNamingContext is not None)
         domain_dn = res[0]["defaultNamingContext"][0]
         assert(domain_dn is not None)
-        dom_users = self.searchone(domain_dn, "dn", "name=Domain Users")
+        dom_users = self.searchone(basedn=domain_dn, attribute="dn", expression="name=Domain Users")
         assert(dom_users is not None)
 
         user_dn = "CN=%s,CN=Users,%s" % (username, domain_dn)
@@ -145,3 +145,10 @@ member: %s
 
     def attach_schema_from_ldif(self, pf, df):
         misc.dsdb_attach_schema_from_ldif_file(self, pf, df)
+
+    def set_invocation_id(self, invocation_id):
+    	"""Set the invocation id for this SamDB handle.
+    	
+    	:param invocation_id: GUID of the invocation id.
+    	"""
+    	misc.dsdb_set_ntds_invocation_id(self, invocation_id)
diff --git a/source4/scripting/python/samba/tests/__init__.py b/source4/scripting/python/samba/tests/__init__.py
index ad8a2524b5..9402002674 100644
--- a/source4/scripting/python/samba/tests/__init__.py
+++ b/source4/scripting/python/samba/tests/__init__.py
@@ -1,7 +1,7 @@
 #!/usr/bin/python
 
 # Unix SMB/CIFS implementation.
-# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
 #   
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -67,6 +67,10 @@ class SubstituteVarTestCase(unittest.TestCase):
     def test_unknown_var(self):
         self.assertEquals("foo ${bla} gsff", 
                 samba.substitute_var("foo ${bla} gsff", {"bar": "bla"}))
+                
+    def test_check_all_substituted(self):
+    	samba.check_all_substituted("nothing to see here")
+    	self.assertRaises(Exception, samba.check_all_substituted, "Not subsituted: ${FOOBAR}")
 
 
 class LdbExtensionTests(TestCaseInTempDir):
@@ -75,7 +79,7 @@ class LdbExtensionTests(TestCaseInTempDir):
         l = samba.Ldb(path)
         try:
             l.add({"dn": "foo=dc", "bar": "bla"})
-            self.assertEquals("bla", l.searchone(ldb.Dn(l, "foo=dc"), "bar"))
+            self.assertEquals("bla", l.searchone(basedn=ldb.Dn(l, "foo=dc"), attribute="bar"))
         finally:
             del l
             os.unlink(path)
diff --git a/source4/scripting/python/samba/tests/provision.py b/source4/scripting/python/samba/tests/provision.py
index f5a0339c1f..54a7782b3d 100644
--- a/source4/scripting/python/samba/tests/provision.py
+++ b/source4/scripting/python/samba/tests/provision.py
@@ -1,7 +1,7 @@
 #!/usr/bin/python
 
 # Unix SMB/CIFS implementation.
-# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
 #   
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -18,9 +18,14 @@
 #
 
 import os
-from samba.provision import setup_secretsdb
+from samba.provision import setup_secretsdb, secretsdb_become_dc, findnss
 import samba.tests
 from ldb import Dn
+import param
+import unittest
+
+lp = param.LoadParm()
+lp.load("st/dc/etc/smb.conf")
 
 setup_dir = "setup"
 def setup_path(file):
@@ -28,15 +33,59 @@ def setup_path(file):
 
 
 class ProvisionTestCase(samba.tests.TestCaseInTempDir):
+    """Some simple tests for individual functions in the provisioning code.
+    """
     def test_setup_secretsdb(self):
         path = os.path.join(self.tempdir, "secrets.ldb")
-        ldb = setup_secretsdb(path, setup_path, None, None, None)
+        ldb = setup_secretsdb(path, setup_path, None, None, lp=lp)
         try:
             self.assertEquals("LSA Secrets",
-                 ldb.searchone(Dn(ldb, "CN=LSA Secrets"), "CN"))
+                 ldb.searchone(basedn="CN=LSA Secrets", attribute="CN"))
         finally:
             del ldb
             os.unlink(path)
+            
+    def test_become_dc(self):
+        path = os.path.join(self.tempdir, "secrets.ldb")
+        secrets_ldb = setup_secretsdb(path, setup_path, None, None, lp=lp)
+        try:
+            secretsdb_become_dc(secrets_ldb, setup_path, domain="EXAMPLE", 
+                   realm="example", netbiosname="myhost", 
+                   domainsid="S-5-22", keytab_path="keytab.path", 
+                   samdb_url="ldap://url/", 
+                   dns_keytab_path="dns.keytab", dnspass="bla", 
+                           machinepass="machinepass", dnsdomain="example.com")
+            self.assertEquals(1, 
+                    len(secrets_ldb.search("samAccountName=krbtgt,flatname=EXAMPLE,CN=Principals")))
+	    self.assertEquals("keytab.path",
+                    secrets_ldb.searchone(basedn="flatname=EXAMPLE,CN=primary domains", 
+                                          expression="(privateKeytab=*)", 
+                                          attribute="privateKeytab"))
+            self.assertEquals("S-5-22",
+                    secrets_ldb.searchone(basedn="flatname=EXAMPLE,CN=primary domains",
+                                          expression="objectSid=*", attribute="objectSid"))
+
+        finally:
+            del secrets_ldb
+            os.unlink(path)
+
+
+class FindNssTests(unittest.TestCase):
+    """Test findnss() function."""
+    def test_nothing(self):
+        def x(y):
+            raise KeyError
+        self.assertRaises(KeyError, findnss, x, [])
+
+    def test_first(self):
+        self.assertEquals("bla", findnss(lambda x: "bla", ["bla"]))
+
+    def test_skip_first(self):
+        def x(y):
+            if y != "bla":
+                raise KeyError
+            return "ha"
+        self.assertEquals("ha", findnss(x, ["bloe", "bla"]))
 
 
 class Disabled:
@@ -73,3 +122,4 @@ class Disabled:
     def test_erase_partitions(self):
         raise NotImplementedError(self.test_erase_partitions)
 
+
diff --git a/source4/scripting/python/samba/upgrade.py b/source4/scripting/python/samba/upgrade.py
index abf1127c36..8bf75d776e 100644
--- a/source4/scripting/python/samba/upgrade.py
+++ b/source4/scripting/python/samba/upgrade.py
@@ -7,9 +7,10 @@
 
 """Support code for upgrading from Samba 3 to Samba 4."""
 
-from provision import findnss, provision
+from provision import findnss, provision, FILL_DRS
 import grp
 import ldb
+import time
 import pwd
 import uuid
 import registry
@@ -162,7 +163,6 @@ def import_wins(samba4_winsdb, samba3_winsdb):
     :param samba3_winsdb: WINS database to import from
     """
     version_id = 0
-    import time
 
     for (name, (ttl, ips, nb_flags)) in samba3_winsdb.items():
         version_id+=1
@@ -245,8 +245,9 @@ def upgrade_provision(samba3, setup_dir, message, credentials, session_info, lp,
     else:
         machinepass = None
     
-    domaindn = provision(lp=lp, setup_dir=setup_dir, message=message, blank=True, ldapbackend=None, 
-                         paths=paths, session_info=session_info, credentials=credentials, realm=realm, 
+    domaindn = provision(lp=lp, setup_dir=setup_dir, message=message, 
+                         samdb_fill=FILL_DRS, paths=paths, session_info=session_info, 
+                         credentials=credentials, realm=realm, 
                          domain=domainname, domainsid=domainsid, domainguid=domainguid, 
                          machinepass=machinepass, serverrole=serverrole)
 
diff --git a/source4/selftest/config.mk b/source4/selftest/config.mk
index 0d5f4d6ab4..7f8f211588 100644
--- a/source4/selftest/config.mk
+++ b/source4/selftest/config.mk
@@ -7,65 +7,60 @@ SELFTEST = $(LD_LIBPATH_OVERRIDE) $(PERL) $(srcdir)/selftest/selftest.pl --prefi
     --exclude=$(srcdir)/samba4-skip --testlist="./selftest/samba4_tests.sh|" \
     $(TEST_OPTIONS) 
 
-test: everything
+test:: everything
 	$(SELFTEST) $(DEFAULT_TEST_OPTIONS) --immediate $(TESTS)
 
-testone: everything
+testone:: everything
 	$(SELFTEST) $(DEFAULT_TEST_OPTIONS) --one $(TESTS)
 
-test-swrap: everything
+test-swrap:: everything
 	$(SELFTEST) --socket-wrapper --immediate $(TESTS)
 
-test-swrap-pcap: everything
+test-swrap-pcap:: everything
 	$(SELFTEST) --socket-wrapper-pcap --immediate $(TESTS)
 
-test-swrap-keep-pcap: everything
+test-swrap-keep-pcap:: everything
 	$(SELFTEST) --socket-wrapper-keep-pcap --immediate $(TESTS)
 
-test-noswrap: everything
+test-noswrap:: everything
 	$(SELFTEST) --immediate $(TESTS)
 
-quicktest: all
+quicktest:: all
 	$(SELFTEST) --quick --socket-wrapper --immediate $(TESTS)
 
-quicktestone: all
+quicktestone:: all
 	$(SELFTEST) --quick --socket-wrapper --one $(TESTS)
 
-testenv: everything
+testenv:: everything
 	$(SELFTEST) --socket-wrapper --testenv
 
-valgrindtest: valgrindtest-all
+valgrindtest:: valgrindtest-all
 
-valgrindtest-quick: all
+valgrindtest-quick:: all
 	SMBD_VALGRIND="xterm -n smbd -e $(srcdir)/script/valgrind_run $(LD_LIBPATH_OVERRIDE)" \
 	VALGRIND="valgrind -q --num-callers=30 --log-file=${selftest_prefix}/valgrind.log" \
 	$(SELFTEST) --quick --immediate --socket-wrapper $(TESTS)
 
-valgrindtest-all: everything
+valgrindtest-all:: everything
 	SMBD_VALGRIND="xterm -n smbd -e $(srcdir)/script/valgrind_run $(LD_LIBPATH_OVERRIDE)" \
 	VALGRIND="valgrind -q --num-callers=30 --log-file=${selftest_prefix}/valgrind.log" \
 	$(SELFTEST) --immediate --socket-wrapper $(TESTS)
 
-valgrindtest-env: everything
+valgrindtest-env:: everything
 	SMBD_VALGRIND="xterm -n smbd -e $(srcdir)/script/valgrind_run $(LD_LIBPATH_OVERRIDE)" \
 	VALGRIND="valgrind -q --num-callers=30 --log-file=${selftest_prefix}/valgrind.log" \
 	$(SELFTEST) --socket-wrapper --testenv
 
-gdbtest: gdbtest-all
+gdbtest:: gdbtest-all
 
-gdbtest-quick: all
+gdbtest-quick:: all
 	SMBD_VALGRIND="xterm -n smbd -e $(srcdir)/script/gdb_run $(LD_LIBPATH_OVERRIDE)" \
 	$(SELFTEST) --immediate --quick --socket-wrapper $(TESTS)
 
-gdbtest-all: everything
+gdbtest-all:: everything
 	SMBD_VALGRIND="xterm -n smbd -e $(srcdir)/script/gdb_run $(LD_LIBPATH_OVERRIDE)" \
 	$(SELFTEST) --immediate --socket-wrapper $(TESTS)
 
-gdbtest-env: everything
+gdbtest-env:: everything
 	SMBD_VALGRIND="xterm -n smbd -e $(srcdir)/script/gdb_run $(LD_LIBPATH_OVERRIDE)" \
 	$(SELFTEST) --socket-wrapper --testenv
-
-wintest: all
-	$(SELFTEST) win
-
-
diff --git a/source4/selftest/samba4_tests.sh b/source4/selftest/samba4_tests.sh
index 2068a971ca..c2ce9dc6f1 100755
--- a/source4/selftest/samba4_tests.sh
+++ b/source4/selftest/samba4_tests.sh
@@ -74,7 +74,7 @@ done
 # is now pretty well tested by the rest of the quick tests anyway
 LDBDIR=$samba4srcdir/lib/ldb
 export LDBDIR
-plantest "ldb" none $LDBDIR/tests/test-tdb.sh
+plantest "ldb" none TEST_DATA_PREFIX=\$PREFIX $LDBDIR/tests/test-tdb.sh
 
 plantest "js.ldap" dc $SCRIPTDIR/ldap.js $CONFIGURATION -d 10 \$SERVER -U\$USERNAME%\$PASSWORD
 
@@ -251,8 +251,8 @@ bbdir=$incdir/../../testprogs/blackbox
 plantest "blackbox.smbclient" dc $bbdir/test_smbclient.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$DOMAIN" "$PREFIX" 
 plantest "blackbox.kinit" dc $bbdir/test_kinit.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$REALM" "\$DOMAIN" "$PREFIX" 
 plantest "blackbox.cifsdd" dc $bbdir/test_cifsdd.sh "\$SERVER" "\$USERNAME" "\$PASSWORD" "\$DOMAIN" 
-plantest "blackbox.nmblookup" dc $bbdir/test_nmblookup.sh "\$NETBIOSNAME" "\$NETBIOSALIAS" "\$SERVER" "\$SERVER_IP" 
-plantest "blackbox.nmblookup" member $bbdir/test_nmblookup.sh "\$NETBIOSNAME" "\$NETBIOSALIAS" "\$SERVER" "\$SERVER_IP"
+plantest "blackbox.nmblookup" dc $samba4srcdir/utils/tests/test_nmblookup.sh "\$NETBIOSNAME" "\$NETBIOSALIAS" "\$SERVER" "\$SERVER_IP" 
+plantest "blackbox.nmblookup" member $samba4srcdir/utils/tests/test_nmblookup.sh "\$NETBIOSNAME" "\$NETBIOSALIAS" "\$SERVER" "\$SERVER_IP"
 
 # Tests using the "Simple" NTVFS backend
 
@@ -330,5 +330,5 @@ then
 	rm -rf $PREFIX/upgrade
 	plantest "blackbox.upgrade" none $PYTHON setup/upgrade.py $CONFIGURATION --targetdir=$PREFIX/upgrade ../testdata/samba3 ../testdata/samba3/smb.conf
 	rm -rf $PREFIX/provision
-	plantest "blackbox.provision.py" none $PYTHON ./setup/provision.py $CONFIGURATION --domain=FOO --realm=foo --targetdir=$PREFIX/provision
+	plantest "blackbox.provision.py" none $PYTHON ./setup/provision.py $CONFIGURATION --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/provision
 fi
diff --git a/source4/selftest/selftest.pl b/source4/selftest/selftest.pl
index 004332a1fc..aab2ca8f07 100755
--- a/source4/selftest/selftest.pl
+++ b/source4/selftest/selftest.pl
@@ -382,6 +382,7 @@ die("using an empty absolute prefix isn't allowed") unless $prefix_abs ne "";
 die("using '/' as absolute prefix isn't allowed") unless $prefix_abs ne "/";
 
 $ENV{PREFIX} = $prefix;
+$ENV{KRB5CCNAME} = "$prefix/krb5ticket";
 $ENV{PREFIX_ABS} = $prefix_abs;
 $ENV{SRCDIR} = $srcdir;
 $ENV{SRCDIR_ABS} = $srcdir_abs;
diff --git a/source4/setup/provision b/source4/setup/provision
index 8b24c51040..9e135cddbb 100755
--- a/source4/setup/provision
+++ b/source4/setup/provision
@@ -143,12 +143,10 @@ if (ldapbackend) {
 		subobj.LDAPMODULE = "normalise,entryuuid";
 		subobj.TDB_MODULES_LIST = "";
 	}
+	subobj.BACKEND_MOD = subobj.LDAPMODULE + ",paged_searches";
 	subobj.DOMAINDN_LDB = subobj.LDAPBACKEND;
-	subobj.DOMAINDN_MOD2 = "," + subobj.LDAPMODULE + ",paged_searches";
 	subobj.CONFIGDN_LDB = subobj.LDAPBACKEND;
-	subobj.CONFIGDN_MOD2 = "," + subobj.LDAPMODULE + ",paged_searches";
 	subobj.SCHEMADN_LDB = subobj.LDAPBACKEND;
-	subobj.SCHEMADN_MOD2 = "," + subobj.LDAPMODULE + ",paged_searches";
 	message("LDAP module: %s on backend: %s\n", subobj.LDAPMODULE, subobj.LDAPBACKEND);
 }
 
@@ -175,7 +173,9 @@ if (partitions_only) {
 		 message("--host-guid='%s' \\\n", subobj.HOSTGUID);
 	}
 	message("--policy-guid='%s' --host-name='%s' --host-ip='%s' \\\n", subobj.POLICYGUID, subobj.HOSTNAME, subobj.HOSTIP);
-	message("--invocationid='%s' \\\n", subobj.INVOCATIONID);
+	if (subobj.INVOCATIONID != undefined) {
+		message("--invocationid='%s' \\\n", subobj.INVOCATIONID);
+	}
 	message("--adminpass='%s' --krbtgtpass='%s' \\\n", subobj.ADMINPASS, subobj.KRBTGTPASS);
 	message("--machinepass='%s' --dnspass='%s' \\\n", subobj.MACHINEPASS, subobj.DNSPASS);
 	message("--root='%s' --nobody='%s' --nogroup='%s' \\\n", subobj.ROOT, subobj.NOBODY, subobj.NOGROUP);
diff --git a/source4/setup/provision.ldif b/source4/setup/provision.ldif
index 3fb9361d0b..37b6bdaa60 100644
--- a/source4/setup/provision.ldif
+++ b/source4/setup/provision.ldif
@@ -78,3 +78,7 @@ dn: CN=Policies,CN=System,${DOMAINDN}
 objectClass: top
 objectClass: container
 
+dn: CN=IP Security,CN=System,${DOMAINDN}
+objectClass: top
+objectClass: container
+
diff --git a/source4/setup/provision.py b/source4/setup/provision.py
index 88015ce0a3..033d2491f2 100755
--- a/source4/setup/provision.py
+++ b/source4/setup/provision.py
@@ -2,7 +2,8 @@
 #
 # Unix SMB/CIFS implementation.
 # provision a Samba4 server
-# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
+# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2008
+# Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
 #
 # Based on the original in EJS:
 # Copyright (C) Andrew Tridgell 2005
@@ -25,19 +26,19 @@ import getopt
 import optparse
 import os, sys
 
-# Add path to the library for in-tree use
-sys.path.append("scripting/python")
-
 import samba
 
 from auth import system_session
 import samba.getopt as options
 import param
-from samba.provision import (provision,  
-                             provision_paths_from_lp)
+from samba.provision import (provision, 
+                             provision_paths_from_lp,
+                             FILL_FULL, FILL_NT4SYNC,
+                             FILL_DRS)
 
 parser = optparse.OptionParser("provision [options]")
-parser.add_option_group(options.SambaOptions(parser))
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
 parser.add_option_group(options.VersionOptions(parser))
 credopts = options.CredentialsOptions(parser)
 parser.add_option_group(credopts)
@@ -83,8 +84,9 @@ parser.add_option("--blank", action="store_true",
 		help="do not add users or groups, just the structure")
 parser.add_option("--ldap-backend", type="string", metavar="LDAPSERVER", 
 		help="LDAP server to use for this provision")
-parser.add_option("--ldap-module=", type="string", metavar="MODULE", 
-		help="LDB mapping module to use for the LDAP backend")
+parser.add_option("--ldap-backend-type", type="choice", metavar="LDAP-BACKEND-TYPE", 
+		help="LDB mapping module to use for the LDAP backend",
+		choices=["fedora-ds", "openldap"])
 parser.add_option("--aci", type="string", metavar="ACI", 
 		help="An arbitary LDIF fragment, particularly useful to loading a backend ACI value into a target LDAP server. You must provide at least a realm and domain")
 parser.add_option("--server-role", type="choice", metavar="ROLE",
@@ -111,13 +113,15 @@ if opts.realm is None or opts.domain is None:
 	sys.exit(1)
 
 # cope with an initially blank smb.conf 
-lp = param.LoadParm()
-if opts.configfile:
-    lp.load(opts.configfile)
+private_dir = None
+lp = sambaopts.get_loadparm()
 if opts.targetdir is not None:
     if not os.path.exists(opts.targetdir):
         os.mkdir(opts.targetdir)
-    lp.set("private dir", os.path.abspath(opts.targetdir))
+    private_dir = os.path.join(opts.targetdir, "private")
+    if not os.path.exists(private_dir):
+        os.mkdir(private_dir)
+    lp.set("private dir", os.path.abspath(private_dir))
     lp.set("lock dir", os.path.abspath(opts.targetdir))
 lp.set("realm", opts.realm)
 lp.set("workgroup", opts.domain)
@@ -127,47 +131,40 @@ if opts.aci is not None:
 	print "set ACI: %s" % opts.aci
 
 paths = provision_paths_from_lp(lp, opts.realm.lower())
-paths.smbconf = opts.configfile
-
-if opts.ldap_backend:
-	if opts.ldap_backend == "ldapi":
-		subobj.ldap_backend = subobj.ldapi_uri
-
-	if not opts.ldap_module:
-		subobj.ldapmodule = "entryuuid"
-
-	subobj.domaindn_ldb = subobj.ldap_backend
-	subobj.domaindn_mod2 = ",%s,paged_searches" % subobj.ldapmodule
-	subobj.configdn_ldb = subobj.ldap_backend
-	subobj.configdn_mod2 = ",%s,paged_searches" % subobj.ldapmodule
-	subobj.schemadn_ldb = subobj.ldap_backend
-	subobj.schemadn_mod2 = ",%s,paged_searches" % subobj.ldapmodule
-	message("LDAP module: %s on backend: %s" % (subobj.ldapmodule, subobj.ldap_backend))
+if sambaopts.get_loadparm_path() is not None:
+    paths.smbconf = sambaopts.get_loadparm_path()
 
 creds = credopts.get_credentials()
 
 setup_dir = opts.setupdir
 if setup_dir is None:
 	setup_dir = "setup"
-if opts.partitions_only:
-    provision_become_dc(setup_dir, message, False, 
-                        paths, lp, system_session(), creds)
-else:
-    provision(lp, setup_dir, message, opts.blank, paths, 
-              system_session(), creds, opts.ldap_backend, realm=opts.realm,
-              domainguid=opts.domain_guid, domainsid=opts.domain_sid,
-              policyguid=opts.policy_guid, hostname=opts.host_name,
-              hostip=opts.host_ip, hostguid=opts.host_guid, 
-              invocationid=opts.invocationid, adminpass=opts.adminpass,
-              krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass,
-              dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody,
-              nogroup=opts.nogroup, wheel=opts.wheel, users=opts.users,
-              aci=opts.aci, serverrole=opts.server_role)
-    message("To reproduce this provision, run with:")
-    def shell_escape(arg):
-        if " " in arg:
-            return '"%s"' % arg
-        return arg
-    message(" ".join([shell_escape(arg) for arg in sys.argv]))
+
+samdb_fill = FILL_FULL
+if opts.blank:
+    samdb_fill = FILL_NT4SYNC
+elif opts.partitions_only:
+    samdb_fill = FILL_DRS
+
+provision(lp, setup_dir, message, paths, 
+          system_session(), creds, 
+          samdb_fill=samdb_fill, realm=opts.realm,
+          domainguid=opts.domain_guid, domainsid=opts.domain_sid,
+          policyguid=opts.policy_guid, hostname=opts.host_name,
+          hostip=opts.host_ip, hostguid=opts.host_guid, 
+          invocationid=opts.invocationid, adminpass=opts.adminpass,
+          krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass,
+          dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody,
+          nogroup=opts.nogroup, wheel=opts.wheel, users=opts.users,
+          aci=opts.aci, serverrole=opts.server_role, 
+          ldap_backend=opts.ldap_backend, 
+          ldap_backend_type=opts.ldap_backend_type)
+
+message("To reproduce this provision, run with:")
+def shell_escape(arg):
+    if " " in arg:
+        return '"%s"' % arg
+    return arg
+message(" ".join([shell_escape(arg) for arg in sys.argv]))
 
 message("All OK")
diff --git a/source4/setup/provision_basedn.ldif b/source4/setup/provision_basedn.ldif
index 3c7537f013..11eb0593e8 100644
--- a/source4/setup/provision_basedn.ldif
+++ b/source4/setup/provision_basedn.ldif
@@ -6,5 +6,4 @@ objectClass: top
 objectClass: domain
 objectClass: domainDNS
 ${ACI}
-dc: ${RDN_DC}
 
diff --git a/source4/setup/provision_basedn_modify.ldif b/source4/setup/provision_basedn_modify.ldif
index fa990599d9..dadfda720e 100644
--- a/source4/setup/provision_basedn_modify.ldif
+++ b/source4/setup/provision_basedn_modify.ldif
@@ -4,9 +4,6 @@
 dn: ${DOMAINDN}
 changetype: modify
 -
-replace: dc
-dc: ${RDN_DC}
--
 replace: forceLogoff
 forceLogoff: 9223372036854775808
 -
diff --git a/source4/setup/provision_partitions.ldif b/source4/setup/provision_partitions.ldif
index fb8bc7f595..93fea6bc2d 100644
--- a/source4/setup/provision_partitions.ldif
+++ b/source4/setup/provision_partitions.ldif
@@ -5,9 +5,9 @@ partition: ${DOMAINDN}:${DOMAINDN_LDB}
 replicateEntries: @ATTRIBUTES
 replicateEntries: @INDEXLIST
 replicateEntries: @OPTIONS
-modules:${SCHEMADN}:${SCHEMADN_MOD}${SCHEMADN_MOD2}
-modules:${CONFIGDN}:${CONFIGDN_MOD}${CONFIGDN_MOD2}
-modules:${DOMAINDN}:${DOMAINDN_MOD}${DOMAINDN_MOD2}
+modules:${SCHEMADN}:${SCHEMADN_MOD},${BACKEND_MOD}
+modules:${CONFIGDN}:${CONFIGDN_MOD},${BACKEND_MOD}
+modules:${DOMAINDN}:${DOMAINDN_MOD},${BACKEND_MOD}
 
 dn: @MODULES
 @LIST: ${MODULES_LIST}${TDB_MODULES_LIST},${MODULES_LIST2}
diff --git a/source4/setup/schema.ldif b/source4/setup/schema.ldif
index 585b418311..be68ed2b91 100644
--- a/source4/setup/schema.ldif
+++ b/source4/setup/schema.ldif
@@ -2249,6 +2249,24 @@ systemOnly: FALSE
 systemFlags: 16
 objectCategory: CN=Attribute-Schema,${SCHEMADN}
 
+dn: CN=Ipsec-ISAKMP-Reference,${SCHEMADN}
+objectClass: top
+objectClass: attributeSchema
+attributeID: 1.2.840.113556.1.4.626
+attributeSyntax: 2.5.5.1
+isSingleValued: TRUE
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-ISAKMP-Reference
+oMObjectClass:: KwwCh3McAIVK
+adminDescription: Ipsec-ISAKMP-Reference
+oMSyntax: 127
+searchFlags: 0
+lDAPDisplayName: ipsecISAKMPReference
+schemaIDGUID: b40ff820-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemFlags: 16
+objectCategory: CN=Attribute-Schema,${SCHEMADN}
+
 dn: CN=Application-Name,${SCHEMADN}
 objectClass: top
 objectClass: attributeSchema
@@ -2990,6 +3008,23 @@ systemOnly: FALSE
 systemFlags: 16
 objectCategory: CN=Attribute-Schema,${SCHEMADN}
 
+dn: CN=Ipsec-ID,${SCHEMADN}
+objectClass: top
+objectClass: attributeSchema
+attributeID: 1.2.840.113556.1.4.621
+attributeSyntax: 2.5.5.12
+isSingleValued: TRUE
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-ID
+adminDescription: Ipsec-ID
+oMSyntax: 64
+searchFlags: 0
+lDAPDisplayName: ipsecID
+schemaIDGUID: b40ff81d-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemFlags: 16
+objectCategory: CN=Attribute-Schema,${SCHEMADN}
+
 dn: CN=LDAP-Admin-Limits,${SCHEMADN}
 objectClass: top
 objectClass: attributeSchema
@@ -3317,6 +3352,24 @@ systemFlags: 16
 isMemberOfPartialAttributeSet: TRUE
 objectCategory: CN=Attribute-Schema,${SCHEMADN}
 
+dn: CN=Ipsec-NFA-Reference,${SCHEMADN}
+objectClass: top
+objectClass: attributeSchema
+attributeID: 1.2.840.113556.1.4.627
+attributeSyntax: 2.5.5.1
+isSingleValued: FALSE
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-NFA-Reference
+oMObjectClass:: KwwCh3McAIVK
+adminDescription: Ipsec-NFA-Reference
+oMSyntax: 127
+searchFlags: 0
+lDAPDisplayName: ipsecNFAReference
+schemaIDGUID: b40ff821-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemFlags: 16
+objectCategory: CN=Attribute-Schema,${SCHEMADN}
+
 dn: CN=secretary,${SCHEMADN}
 objectClass: top
 objectClass: attributeSchema
@@ -7279,6 +7332,24 @@ systemOnly: FALSE
 systemFlags: 16
 objectCategory: CN=Attribute-Schema,${SCHEMADN}
 
+dn: CN=Ipsec-Owners-Reference,${SCHEMADN}
+objectClass: top
+objectClass: attributeSchema
+attributeID: 1.2.840.113556.1.4.624
+attributeSyntax: 2.5.5.1
+isSingleValued: FALSE
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-Owners-Reference
+oMObjectClass:: KwwCh3McAIVK
+adminDescription: Ipsec-Owners-Reference
+oMSyntax: 127
+searchFlags: 0
+lDAPDisplayName: ipsecOwnersReference
+schemaIDGUID: b40ff824-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemFlags: 16
+objectCategory: CN=Attribute-Schema,${SCHEMADN}
+
 dn: CN=State-Or-Province-Name,${SCHEMADN}
 objectClass: top
 objectClass: attributeSchema
@@ -7808,6 +7879,24 @@ systemOnly: FALSE
 systemFlags: 16
 objectCategory: CN=Attribute-Schema,${SCHEMADN}
 
+dn: CN=Ipsec-Filter-Reference,${SCHEMADN}
+objectClass: top
+objectClass: attributeSchema
+attributeID: 1.2.840.113556.1.4.629
+attributeSyntax: 2.5.5.1
+isSingleValued: FALSE
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-Filter-Reference
+oMObjectClass:: KwwCh3McAIVK
+adminDescription: Ipsec-Filter-Reference
+oMSyntax: 127
+searchFlags: 0
+lDAPDisplayName: ipsecFilterReference
+schemaIDGUID: b40ff823-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemFlags: 16
+objectCategory: CN=Attribute-Schema,${SCHEMADN}
+
 dn: CN=User-Comment,${SCHEMADN}
 objectClass: top
 objectClass: attributeSchema
@@ -7946,7 +8035,6 @@ searchFlags: 0
 lDAPDisplayName: msDRM-IdentityCertificate
 schemaIDGUID: e85e1204-3434-41ad-9b56-e2901228fff0
 systemFlags: 16
-isMemberOfPartialAttributeSet: TRUE
 objectCategory: CN=Attribute-Schema,${SCHEMADN}
 
 dn: CN=Last-Logoff,${SCHEMADN}
@@ -8078,6 +8166,40 @@ systemOnly: FALSE
 systemFlags: 16
 objectCategory: CN=Attribute-Schema,${SCHEMADN}
 
+dn: CN=Ipsec-Data-Type,${SCHEMADN}
+objectClass: top
+objectClass: attributeSchema
+attributeID: 1.2.840.113556.1.4.622
+attributeSyntax: 2.5.5.9
+isSingleValued: TRUE
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-Data-Type
+adminDescription: Ipsec-Data-Type
+oMSyntax: 2
+searchFlags: 0
+lDAPDisplayName: ipsecDataType
+schemaIDGUID: b40ff81e-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemFlags: 16
+objectCategory: CN=Attribute-Schema,${SCHEMADN}
+
+dn: CN=Ipsec-Data,${SCHEMADN}
+objectClass: top
+objectClass: attributeSchema
+attributeID: 1.2.840.113556.1.4.623
+attributeSyntax: 2.5.5.10
+isSingleValued: TRUE
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-Data
+adminDescription: Ipsec-Data
+oMSyntax: 4
+searchFlags: 0
+lDAPDisplayName: ipsecData
+schemaIDGUID: b40ff81f-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemFlags: 16
+objectCategory: CN=Attribute-Schema,${SCHEMADN}
+
 dn: CN=RID-Manager-Reference,${SCHEMADN}
 objectClass: top
 objectClass: attributeSchema
@@ -8501,6 +8623,23 @@ systemOnly: FALSE
 systemFlags: 16
 objectCategory: CN=Attribute-Schema,${SCHEMADN}
 
+dn: CN=Ipsec-Name,${SCHEMADN}
+objectClass: top
+objectClass: attributeSchema
+attributeID: 1.2.840.113556.1.4.620
+attributeSyntax: 2.5.5.12
+isSingleValued: TRUE
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-Name
+adminDescription: Ipsec-Name
+oMSyntax: 64
+searchFlags: 0
+lDAPDisplayName: ipsecName
+schemaIDGUID: b40ff81c-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemFlags: 16
+objectCategory: CN=Attribute-Schema,${SCHEMADN}
+
 dn: CN=CA-Certificate,${SCHEMADN}
 objectClass: top
 objectClass: attributeSchema
@@ -8522,6 +8661,24 @@ systemFlags: 16
 isMemberOfPartialAttributeSet: TRUE
 objectCategory: CN=Attribute-Schema,${SCHEMADN}
 
+dn: CN=Ipsec-Negotiation-Policy-Reference,${SCHEMADN}
+objectClass: top
+objectClass: attributeSchema
+attributeID: 1.2.840.113556.1.4.628
+attributeSyntax: 2.5.5.1
+isSingleValued: TRUE
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-Negotiation-Policy-Reference
+oMObjectClass:: KwwCh3McAIVK
+adminDescription: Ipsec-Negotiation-Policy-Reference
+oMSyntax: 127
+searchFlags: 0
+lDAPDisplayName: ipsecNegotiationPolicyReference
+schemaIDGUID: b40ff822-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemFlags: 16
+objectCategory: CN=Attribute-Schema,${SCHEMADN}
+
 dn: CN=MHS-OR-Address,${SCHEMADN}
 objectClass: top
 objectClass: attributeSchema
@@ -9014,6 +9171,28 @@ defaultHidingValue: TRUE
 objectCategory: CN=Class-Schema,${SCHEMADN}
 defaultObjectCategory: CN=Top,${SCHEMADN}
 
+dn: CN=Ipsec-ISAKMP-Policy,${SCHEMADN}
+objectClass: top
+objectClass: classSchema
+subClassOf: ipsecBase
+governsID: 1.2.840.113556.1.5.120
+rDNAttID: cn
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-ISAKMP-Policy
+adminDescription: Ipsec-ISAKMP-Policy
+objectClassCategory: 1
+lDAPDisplayName: ipsecISAKMPPolicy
+schemaIDGUID: b40ff828-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemPossSuperiors: container
+systemPossSuperiors: computer
+systemPossSuperiors: organizationalUnit
+defaultSecurityDescriptor: D:
+systemFlags: 16
+defaultHidingValue: TRUE
+objectCategory: CN=Class-Schema,${SCHEMADN}
+defaultObjectCategory: CN=Ipsec-ISAKMP-Policy,${SCHEMADN}
+
 dn: CN=Domain-DNS,${SCHEMADN}
 objectClass: top
 objectClass: classSchema
@@ -9246,6 +9425,30 @@ defaultHidingValue: TRUE
 objectCategory: CN=Class-Schema,${SCHEMADN}
 defaultObjectCategory: CN=Display-Specifier,${SCHEMADN}
 
+dn: CN=Ipsec-Base,${SCHEMADN}
+objectClass: top
+objectClass: classSchema
+subClassOf: top
+governsID: 1.2.840.113556.1.5.7000.56
+rDNAttID: cn
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-Base
+adminDescription: Ipsec-Base
+objectClassCategory: 2
+lDAPDisplayName: ipsecBase
+schemaIDGUID: b40ff825-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemMayContain: ipsecOwnersReference
+systemMayContain: ipsecName
+systemMayContain: ipsecID
+systemMayContain: ipsecDataType
+systemMayContain: ipsecData
+defaultSecurityDescriptor: D:
+systemFlags: 16
+defaultHidingValue: TRUE
+objectCategory: CN=Class-Schema,${SCHEMADN}
+defaultObjectCategory: CN=Ipsec-Base,${SCHEMADN}
+
 dn: CN=ms-DS-Az-Scope,${SCHEMADN}
 objectClass: top
 objectClass: classSchema
@@ -9546,10 +9749,13 @@ possibleInferiors: user
 possibleInferiors: container
 possibleInferiors: groupPolicyContainer
 possibleInferiors: person
+possibleInferiors: ipsecNFA
 possibleInferiors: locality
 possibleInferiors: msDS-AzAdminManager
 possibleInferiors: organizationalUnit
+possibleInferiors: ipsecPolicy
 possibleInferiors: organizationalPerson
+possibleInferiors: ipsecISAKMPPolicy
 rDNAttID: ou
 showInAdvancedViewOnly: TRUE
 adminDisplayName: Organizational-Unit
@@ -9600,6 +9806,30 @@ defaultHidingValue: FALSE
 objectCategory: CN=Class-Schema,${SCHEMADN}
 defaultObjectCategory: CN=Organizational-Unit,${SCHEMADN}
 
+dn: CN=Ipsec-NFA,${SCHEMADN}
+objectClass: top
+objectClass: classSchema
+subClassOf: ipsecBase
+governsID: 1.2.840.113556.1.5.121
+rDNAttID: cn
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-NFA
+adminDescription: Ipsec-NFA
+objectClassCategory: 1
+lDAPDisplayName: ipsecNFA
+schemaIDGUID: b40ff829-427a-11d1-a9c2-0000f80367c1
+systemOnly: FALSE
+systemPossSuperiors: container
+systemPossSuperiors: computer
+systemPossSuperiors: organizationalUnit
+systemMayContain: ipsecNegotiationPolicyReference
+systemMayContain: ipsecFilterReference
+defaultSecurityDescriptor: D:
+systemFlags: 16
+defaultHidingValue: TRUE
+objectCategory: CN=Class-Schema,${SCHEMADN}
+defaultObjectCategory: CN=Ipsec-NFA,${SCHEMADN}
+
 dn: CN=Lost-And-Found,${SCHEMADN}
 objectClass: top
 objectClass: classSchema
@@ -9625,6 +9855,7 @@ possibleInferiors: site
 possibleInferiors: organization
 possibleInferiors: domainDNS
 possibleInferiors: person
+possibleInferiors: ipsecNFA
 possibleInferiors: queryPolicy
 possibleInferiors: locality
 possibleInferiors: subnet
@@ -9635,8 +9866,10 @@ possibleInferiors: nTDSService
 possibleInferiors: country
 possibleInferiors: organizationalUnit
 possibleInferiors: secret
+possibleInferiors: ipsecPolicy
 possibleInferiors: organizationalPerson
 possibleInferiors: server
+possibleInferiors: ipsecISAKMPPolicy
 rDNAttID: cn
 showInAdvancedViewOnly: TRUE
 adminDisplayName: Lost-And-Found
@@ -9829,6 +10062,9 @@ objectClass: top
 objectClass: classSchema
 subClassOf: user
 governsID: 1.2.840.113556.1.3.30
+possibleInferiors: ipsecNFA
+possibleInferiors: ipsecPolicy
+possibleInferiors: ipsecISAKMPPolicy
 rDNAttID: cn
 showInAdvancedViewOnly: TRUE
 adminDisplayName: Computer
@@ -9899,6 +10135,30 @@ defaultHidingValue: TRUE
 objectCategory: CN=Class-Schema,${SCHEMADN}
 defaultObjectCategory: CN=Person,${SCHEMADN}
 
+dn: CN=Ipsec-Policy,${SCHEMADN}
+objectClass: top
+objectClass: classSchema
+subClassOf: ipsecBase
+governsID: 1.2.840.113556.1.5.98
+rDNAttID: cn
+showInAdvancedViewOnly: TRUE
+adminDisplayName: Ipsec-Policy
+adminDescription: Ipsec-Policy
+objectClassCategory: 1
+lDAPDisplayName: ipsecPolicy
+schemaIDGUID: b7b13121-b82e-11d0-afee-0000f80367c1
+systemOnly: FALSE
+systemPossSuperiors: organizationalUnit
+systemPossSuperiors: computer
+systemPossSuperiors: container
+systemMayContain: ipsecNFAReference
+systemMayContain: ipsecISAKMPReference
+defaultSecurityDescriptor: D:
+systemFlags: 16
+defaultHidingValue: TRUE
+objectCategory: CN=Class-Schema,${SCHEMADN}
+defaultObjectCategory: CN=Ipsec-Policy,${SCHEMADN}
+
 dn: CN=Container,${SCHEMADN}
 objectClass: top
 objectClass: classSchema
@@ -9912,12 +10172,15 @@ possibleInferiors: user
 possibleInferiors: container
 possibleInferiors: groupPolicyContainer
 possibleInferiors: person
+possibleInferiors: ipsecNFA
 possibleInferiors: queryPolicy
 possibleInferiors: msDS-AzAdminManager
 possibleInferiors: displaySpecifier
 possibleInferiors: nTDSService
 possibleInferiors: secret
+possibleInferiors: ipsecPolicy
 possibleInferiors: organizationalPerson
+possibleInferiors: ipsecISAKMPPolicy
 mayContain: msDS-ObjectReference
 rDNAttID: cn
 showInAdvancedViewOnly: TRUE
@@ -10624,12 +10887,15 @@ possibleInferiors: user
 possibleInferiors: container
 possibleInferiors: groupPolicyContainer
 possibleInferiors: person
+possibleInferiors: ipsecNFA
 possibleInferiors: queryPolicy
 possibleInferiors: msDS-AzAdminManager
 possibleInferiors: displaySpecifier
 possibleInferiors: nTDSService
 possibleInferiors: secret
+possibleInferiors: ipsecPolicy
 possibleInferiors: organizationalPerson
+possibleInferiors: ipsecISAKMPPolicy
 rDNAttID: cn
 showInAdvancedViewOnly: TRUE
 adminDisplayName: Group-Policy-Container
@@ -10656,6 +10922,7 @@ objectClass: top
 objectClass: subSchema
 objectCategory: CN=SubSchema,${SCHEMADN}
 objectClasses: ( 2.5.6.0 NAME 'top' SUP top ABSTRACT MUST ( objectClass $ objectCategory $ nTSecurityDescriptor $ instanceType ) MAY ( url $ wWWHomePage $ whenCreated $ whenChanged $ wellKnownObjects $ wbemPath $ uSNSource $ uSNLastObjRem $ USNIntersite $ uSNDSALastObjRemoved $ uSNCreated $ uSNChanged $ systemFlags $ subSchemaSubEntry $ subRefs $ structuralObjectClass $ siteObjectBL $ serverReferenceBL $ sDRightsEffective $ revision $ repsTo $ repsFrom $ directReports $ replUpToDateVector $ replPropertyMetaData $ name $ queryPolicyBL $ proxyAddresses $ proxiedObjectName $ possibleInferiors $ partialAttributeSet $ partialAttributeDeletionList $ otherWellKnownObjects $ objectVersion $ objectGUID $ distinguishedName $ nonSecurityMemberBL $ netbootSCPBL $ ownerBL $ msDS-ReplValueMetaData $ msDS-ReplAttributeMetaData $ msDS-NonMembersBL $ msDS-NCReplOutboundNeighbors $ msDS-NCReplInboundNeighbors $ msDS-NCReplCursors $ msDS-TasksForAzRoleBL $ msDS-TasksForAzTaskBL $ msDS-OperationsForAzRoleBL $ msDS-OperationsForAzTaskBL $ msDS-MembersForAzRoleBL $ msDs-masteredBy $ mS-DS-ConsistencyGuid $ mS-DS-ConsistencyChildCount $ msDS-Approx-Immed-Subordinates $ msCOM-PartitionSetLink $ msCOM-UserLink $ modifyTimeStamp $ masteredBy $ managedObjects $ lastKnownParent $ isPrivilegeHolder $ memberOf $ isDeleted $ isCriticalSystemObject $ showInAdvancedViewOnly $ fSMORoleOwner $ fRSMemberReferenceBL $ frsComputerReferenceBL $ fromEntry $ flags $ extensionName $ dSASignature $ dSCorePropagationData $ displayNamePrintable $ displayName $ description $ createTimeStamp $ cn $ canonicalName $ bridgeheadServerListBL $ allowedChildClassesEffective $ allowedChildClasses $ allowedAttributesEffective $ allowedAttributes $ adminDisplayName $ adminDescription $ msDS-ObjectReferenceBL ) )
+objectClasses: ( 1.2.840.113556.1.5.120 NAME 'ipsecISAKMPPolicy' SUP ipsecBase STRUCTURAL )
 objectClasses: ( 1.2.840.113556.1.5.67 NAME 'domainDNS' SUP domain STRUCTURAL MAY ( msDS-Behavior-Version $ msDS-AllowedDNSSuffixes $ managedBy ) )
 objectClasses: ( 1.2.840.113556.1.5.235 NAME 'msDS-AzApplication' SUP top STRUCTURAL MAY ( msDS-AzApplicationData $ msDS-AzGenerateAudits $ msDS-AzApplicationVersion $ msDS-AzClassId $ msDS-AzApplicationName $ description ) )
 objectClasses: ( 1.2.840.113556.1.5.4 NAME 'builtinDomain' SUP top STRUCTURAL )
@@ -10664,6 +10931,7 @@ objectClasses: ( 1.2.840.113556.1.5.12 NAME 'configuration' SUP top STRUCTURAL M
 objectClasses: ( 1.2.840.113556.1.3.11 NAME 'crossRef' SUP top STRUCTURAL MUST ( nCName $ dnsRoot $ cn ) MAY ( trustParent $ superiorDNSRoot $ rootTrust $ nTMixedDomain $ nETBIOSName $ Enabled $ msDS-SDReferenceDomain $ msDS-Replication-Notify-Subsequent-DSA-Delay $ msDS-Replication-Notify-First-DSA-Delay $ msDS-NC-Replica-Locations $ msDS-DnsRootAlias $ msDS-Behavior-Version ) )
 objectClasses: ( 1.2.840.113556.1.5.83 NAME 'rIDManager' SUP top STRUCTURAL MUST ( rIDAvailablePool ) )
 objectClasses: ( 1.2.840.113556.1.5.84 NAME 'displaySpecifier' SUP top STRUCTURAL MAY ( treatAsLeaf $ shellPropertyPages $ shellContextMenu $ scopeFlags $ queryFilter $ iconPath $ extraColumns $ creationWizard $ createWizardExt $ createDialog $ contextMenu $ classDisplayName $ attributeDisplayNames $ adminPropertyPages $ adminMultiselectPropertyPages $ adminContextMenu ) )
+objectClasses: ( 1.2.840.113556.1.5.7000.56 NAME 'ipsecBase' SUP top ABSTRACT MAY ( ipsecOwnersReference $ ipsecName $ ipsecID $ ipsecDataType $ ipsecData ) )
 objectClasses: ( 1.2.840.113556.1.5.237 NAME 'msDS-AzScope' SUP top STRUCTURAL MUST ( msDS-AzScopeName ) MAY ( msDS-AzApplicationData $ description ) )
 objectClasses: ( 2.5.6.3 NAME 'locality' SUP top STRUCTURAL MUST ( l ) MAY ( street $ st $ seeAlso $ searchGuide ) )
 objectClasses: ( 1.2.840.113556.1.5.7000.53 NAME 'crossRefContainer' SUP top STRUCTURAL MAY ( msDS-SPNSuffixes $ uPNSuffixes $ msDS-UpdateScript $ msDS-ExecuteScriptPassword $ msDS-Behavior-Version ) )
@@ -10674,6 +10942,7 @@ objectClasses: ( 1.2.840.113556.1.5.3 NAME 'samDomain' SUP top AUXILIARY MAY ( t
 objectClasses: ( 1.2.840.113556.1.5.2 NAME 'samDomainBase' SUP top AUXILIARY MAY ( uASCompat $ serverState $ serverRole $ revision $ pwdProperties $ pwdHistoryLength $ oEMInformation $ objectSid $ nTSecurityDescriptor $ nextRid $ modifiedCountAtLastProm $ modifiedCount $ minPwdLength $ minPwdAge $ maxPwdAge $ lockoutThreshold $ lockoutDuration $ lockOutObservationWindow $ forceLogoff $ domainReplica $ creationTime ) )
 objectClasses: ( 2.5.6.2 NAME 'country' SUP top MUST ( c ) MAY ( co $ searchGuide ) )
 objectClasses: ( 2.5.6.5 NAME 'organizationalUnit' SUP top STRUCTURAL MUST ( ou ) MAY ( x121Address $ userPassword $ uPNSuffixes $ co $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ street $ st $ seeAlso $ searchGuide $ registeredAddress $ preferredDeliveryMethod $ postalCode $ postalAddress $ postOfficeBox $ physicalDeliveryOfficeName $ msCOM-UserPartitionSetLink $ managedBy $ thumbnailLogo $ l $ internationalISDNNumber $ gPOptions $ gPLink $ facsimileTelephoneNumber $ destinationIndicator $ desktopProfile $ defaultGroup $ countryCode $ c $ businessCategory ) )
+objectClasses: ( 1.2.840.113556.1.5.121 NAME 'ipsecNFA' SUP ipsecBase STRUCTURAL MAY ( ipsecNegotiationPolicyReference $ ipsecFilterReference ) )
 objectClasses: ( 1.2.840.113556.1.5.139 NAME 'lostAndFound' SUP top STRUCTURAL MAY ( moveTreeState ) )
 objectClasses: ( 2.5.6.7 NAME 'organizationalPerson' SUP person MAY ( x121Address $ comment $ title $ co $ primaryTelexNumber $ telexNumber $ teletexTerminalIdentifier $ street $ st $ registeredAddress $ preferredDeliveryMethod $ postalCode $ postalAddress $ postOfficeBox $ thumbnailPhoto $ physicalDeliveryOfficeName $ pager $ otherPager $ otherTelephone $ mobile $ otherMobile $ primaryInternationalISDNNumber $ ipPhone $ otherIpPhone $ otherHomePhone $ homePhone $ otherFacsimileTelephoneNumber $ personalTitle $ middleName $ otherMailbox $ ou $ o $ mhsORAddress $ msDS-AllowedToDelegateTo $ manager $ thumbnailLogo $ l $ internationalISDNNumber $ initials $ givenName $ generationQualifier $ facsimileTelephoneNumber $ employeeID $ mail $ division $ destinationIndicator $ department $ c $ countryCode $ company $ assistant $ streetAddress $ houseIdentifier $ msExchHouseIdentifier $ homePostalAddress ) )
 objectClasses: ( 1.2.840.113556.1.3.14 NAME 'attributeSchema' SUP top STRUCTURAL MUST ( schemaIDGUID $ oMSyntax $ lDAPDisplayName $ isSingleValued $ cn $ attributeSyntax $ attributeID ) MAY ( systemOnly $ searchFlags $ schemaFlagsEx $ rangeUpper $ rangeLower $ oMObjectClass $ msDs-Schema-Extensions $ msDS-IntId $ mAPIID $ linkID $ isMemberOfPartialAttributeSet $ isEphemeral $ isDefunct $ extendedCharsAllowed $ classDisplayName $ attributeSecurityGUID ) )
@@ -10681,6 +10950,7 @@ objectClasses: ( 1.2.840.113556.1.5.72 NAME 'nTDSService' SUP top STRUCTURAL MAY
 objectClasses: ( 1.2.840.113556.1.5.7000.48 NAME 'serversContainer' SUP top STRUCTURAL )
 objectClasses: ( 1.2.840.113556.1.3.30 NAME 'computer' SUP user STRUCTURAL MAY ( volumeCount $ siteGUID $ rIDSetReferences $ policyReplicationFlags $ physicalLocationObject $ operatingSystemVersion $ operatingSystemServicePack $ operatingSystemHotfix $ operatingSystem $ networkAddress $ netbootSIFFile $ netbootMirrorDataFile $ netbootMachineFilePath $ netbootInitialization $ netbootGUID $ msDS-AdditionalSamAccountName $ msDS-AdditionalDnsHostName $ managedBy $ machineRole $ location $ localPolicyFlags $ dNSHostName $ defaultLocalPolicyObject $ cn $ catalogs ) )
 objectClasses: ( 2.5.6.6 NAME 'person' SUP top MUST ( cn ) MAY ( userPassword $ telephoneNumber $ sn $ serialNumber $ seeAlso $ attributeCertificateAttribute ) )
+objectClasses: ( 1.2.840.113556.1.5.98 NAME 'ipsecPolicy' SUP ipsecBase STRUCTURAL MAY ( ipsecNFAReference $ ipsecISAKMPReference ) )
 objectClasses: ( 1.2.840.113556.1.3.23 NAME 'container' SUP top STRUCTURAL MUST ( cn ) MAY ( schemaVersion $ defaultClassStore $ msDS-ObjectReference ) )
 objectClasses: ( 1.2.840.113556.1.5.31 NAME 'site' SUP top STRUCTURAL MAY ( notificationList $ mSMQSiteID $ mSMQSiteForeign $ mSMQNt4Stub $ mSMQInterval2 $ mSMQInterval1 $ managedBy $ location $ gPOptions $ gPLink ) )
 objectClasses: ( 2.5.6.4 NAME 'organization' SUP top STRUCTURAL MUST ( o ) MAY ( x121Address $ userPassword $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ street $ st $ seeAlso $ searchGuide $ registeredAddress $ preferredDeliveryMethod $ postalCode $ postalAddress $ postOfficeBox $ physicalDeliveryOfficeName $ l $ internationalISDNNumber $ facsimileTelephoneNumber $ destinationIndicator $ businessCategory ) )
@@ -10825,6 +11095,7 @@ attributeTypes: ( 2.5.4.20 NAME 'telephoneNumber' SYNTAX '1.3.6.1.4.1.1466.115.1
 attributeTypes: ( 1.2.840.113556.1.2.141 NAME 'department' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.639 NAME 'isMemberOfPartialAttributeSet' SYNTAX '1.3.6.1.4.1.1466.115.121.1.7' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.633 NAME 'policyReplicationFlags' SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113556.1.4.626 NAME 'ipsecISAKMPReference' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.218 NAME 'applicationName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.196 NAME 'systemMayContain' SYNTAX '1.3.6.1.4.1.1466.115.121.1.38' NO-USER-MODIFICATION )
 attributeTypes: ( 1.2.840.113556.1.4.1191 NAME 'msRASSavedFramedRoute' SYNTAX '1.3.6.1.4.1.1466.115.121.1.26' )
@@ -10866,6 +11137,7 @@ attributeTypes: ( 1.2.840.113556.1.4.1412 NAME 'primaryGroupToken' SYNTAX '1.3.6
 attributeTypes: ( 1.2.840.113556.1.2.469 NAME 'USNIntersite' SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.876 NAME 'fRSMemberReferenceBL' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' NO-USER-MODIFICATION )
 attributeTypes: ( 1.2.840.113556.1.4.1711 NAME 'msDS-SDReferenceDomain' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113556.1.4.621 NAME 'ipsecID' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.843 NAME 'lDAPAdminLimits' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
 attributeTypes: ( 1.2.840.113556.1.4.519 NAME 'lastBackupRestorationTime' SYNTAX '1.2.840.113556.1.4.906' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.660 NAME 'treeName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE NO-USER-MODIFICATION )
@@ -10884,6 +11156,7 @@ attributeTypes: ( 1.2.840.113556.1.2.227 NAME 'extensionName' SYNTAX '1.3.6.1.4.
 attributeTypes: ( 1.2.840.113556.1.4.1663 NAME 'msDS-Replication-Notify-First-DSA-Delay' SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.74 NAME 'maxPwdAge' SYNTAX '1.2.840.113556.1.4.906' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.722 NAME 'otherIpPhone' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
+attributeTypes: ( 1.2.840.113556.1.4.627 NAME 'ipsecNFAReference' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
 attributeTypes: ( 0.9.2342.19200300.100.1.21 NAME 'secretary' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
 attributeTypes: ( 1.2.840.113556.1.4.138 NAME 'userParameters' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.134 NAME 'trustPosixOffset' SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )
@@ -11098,6 +11371,7 @@ attributeTypes: ( 1.2.840.113556.1.4.644 NAME 'showInAddressBook' SYNTAX '1.3.6.
 attributeTypes: ( 1.2.840.113556.1.2.2 NAME 'whenCreated' SYNTAX '1.3.6.1.4.1.1466.115.121.1.24' SINGLE-VALUE NO-USER-MODIFICATION )
 attributeTypes: ( 1.2.840.113556.1.4.1357 NAME 'dSCorePropagationData' SYNTAX '1.3.6.1.4.1.1466.115.121.1.24' NO-USER-MODIFICATION )
 attributeTypes: ( 1.2.840.113556.1.2.353 NAME 'displayNamePrintable' SYNTAX '1.3.6.1.4.1.1466.115.121.1.26' SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113556.1.4.624 NAME 'ipsecOwnersReference' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
 attributeTypes: ( 2.5.4.8 NAME 'st' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.515 NAME 'serverReference' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.1820 NAME 'msDS-HasDomainNCs' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' NO-USER-MODIFICATION )
@@ -11126,6 +11400,7 @@ attributeTypes: ( 1.2.840.113556.1.4.1424 NAME 'msCOM-PartitionSetLink' SYNTAX '
 attributeTypes: ( 2.5.4.3 NAME 'cn' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.1789 NAME 'msDS-AllUsersTrustQuota' SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.480 NAME 'defaultGroup' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113556.1.4.629 NAME 'ipsecFilterReference' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
 attributeTypes: ( 1.2.840.113556.1.4.156 NAME 'comment' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.1440 NAME 'msDs-Schema-Extensions' SYNTAX '1.3.6.1.4.1.1466.115.121.1.40' NO-USER-MODIFICATION )
 attributeTypes: ( 1.2.840.113556.1.4.56 NAME 'localPolicyFlags' SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )
@@ -11141,6 +11416,8 @@ attributeTypes: ( 1.2.840.113556.1.2.436 NAME 'directReports' SYNTAX '1.3.6.1.4.
 attributeTypes: ( 1.2.840.113556.1.4.3 NAME 'replPropertyMetaData' SYNTAX '1.3.6.1.4.1.1466.115.121.1.40' SINGLE-VALUE NO-USER-MODIFICATION )
 attributeTypes: ( 1.2.840.113556.1.4.910 NAME 'fromEntry' SYNTAX '1.3.6.1.4.1.1466.115.121.1.7' NO-USER-MODIFICATION )
 attributeTypes: ( 1.2.840.113556.1.4.471 NAME 'trustParent' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113556.1.4.622 NAME 'ipsecDataType' SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )
+attributeTypes: ( 1.2.840.113556.1.4.623 NAME 'ipsecData' SYNTAX '1.3.6.1.4.1.1466.115.121.1.40' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.368 NAME 'rIDManagerReference' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' SINGLE-VALUE NO-USER-MODIFICATION )
 attributeTypes: ( 1.2.840.113556.1.4.73 NAME 'lockoutThreshold' SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.346 NAME 'desktopProfile' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
@@ -11164,7 +11441,9 @@ attributeTypes: ( 1.2.840.113556.1.4.532 NAME 'superiorDNSRoot' SYNTAX '1.3.6.1.
 attributeTypes: ( 1.2.840.113556.1.4.674 NAME 'rootTrust' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
 attributeTypes: ( 1.2.840.113556.1.4.615 NAME 'shellContextMenu' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
 attributeTypes: ( 1.2.840.113556.1.4.610 NAME 'classDisplayName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
+attributeTypes: ( 1.2.840.113556.1.4.620 NAME 'ipsecName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
 attributeTypes: ( 2.5.4.37 NAME 'cACertificate' SYNTAX '1.3.6.1.4.1.1466.115.121.1.40' )
+attributeTypes: ( 1.2.840.113556.1.4.628 NAME 'ipsecNegotiationPolicyReference' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' SINGLE-VALUE )
 attributeTypes: ( 1.2.840.113556.1.4.650 NAME 'mhsORAddress' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
 attributeTypes: ( 1.2.840.113556.1.4.94 NAME 'ntPwdHistory' SYNTAX '1.3.6.1.4.1.1466.115.121.1.40' )
 attributeTypes: ( 1.2.840.113556.1.4.786 NAME 'mailAddress' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )
diff --git a/source4/setup/secrets_dc.ldif b/source4/setup/secrets_dc.ldif
index 64469352bb..71c7fc2f5b 100644
--- a/source4/setup/secrets_dc.ldif
+++ b/source4/setup/secrets_dc.ldif
@@ -7,8 +7,6 @@ realm: ${REALM}
 secret:: ${MACHINEPASS_B64}
 secureChannelType: 6
 sAMAccountName: ${NETBIOSNAME}$
-whenCreated: ${LDAPTIME}
-whenChanged: ${LDAPTIME}
 msDS-KeyVersionNumber: 1
 objectSid: ${DOMAINSID}
 privateKeytab: ${SECRETS_KEYTAB}
@@ -22,8 +20,6 @@ objectClass: kerberosSecret
 flatname: ${DOMAIN}
 realm: ${REALM}
 sAMAccountName: krbtgt
-whenCreated: ${LDAPTIME}
-whenChanged: ${LDAPTIME}
 objectSid: ${DOMAINSID}
 servicePrincipalName: kadmin/changepw
 krb5Keytab: HDB:ldb:${SAM_LDB}:
@@ -36,8 +32,6 @@ objectClass: top
 objectClass: secret
 objectClass: kerberosSecret
 realm: ${REALM}
-whenCreated: ${LDAPTIME}
-whenChanged: ${LDAPTIME}
 servicePrincipalName: DNS/${DNSDOMAIN}
 privateKeytab: ${DNS_KEYTAB}
 secret:: ${DNSPASS_B64}
diff --git a/source4/setup/upgrade.py b/source4/setup/upgrade.py
index ea6f83d7de..960cd1b9e2 100755
--- a/source4/setup/upgrade.py
+++ b/source4/setup/upgrade.py
@@ -7,14 +7,14 @@
 import getopt
 import optparse
 import os, sys
-sys.path.append("scripting/python")
 import param
 import samba
 import samba.getopt as options
 from auth import system_session
 
 parser = optparse.OptionParser("upgrade [options] <libdir> <smbconf>")
-parser.add_option_group(options.SambaOptions(parser))
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
 parser.add_option_group(options.VersionOptions(parser))
 credopts = options.CredentialsOptions(parser)
 parser.add_option_group(credopts)
@@ -59,15 +59,13 @@ if setup_dir is None:
 	setup_dir = "setup"
 
 creds = credopts.get_credentials()
-lp = param.LoadParm()
-if opts.configfile:
-    lp.load(opts.configfile)
+lp = sambaopts.get_loadparm()
 if opts.targetdir is not None:
     if not os.path.exists(opts.targetdir):
         os.mkdir(opts.targetdir)
     lp.set("private dir", os.path.abspath(opts.targetdir))
     lp.set("lock dir", os.path.abspath(opts.targetdir))
 paths = provision_paths_from_lp(lp, "")
-paths.smbconf = opts.configfile
+paths.smbconf = sambaopts.get_loadparm_path()
 upgrade_provision(samba3, setup_dir, message, credentials=creds, session_info=system_session(), 
                   lp=lp, paths=paths)
diff --git a/source4/setup/vampire.py b/source4/setup/vampire.py
index 392cd2d4fb..728c53146a 100755
--- a/source4/setup/vampire.py
+++ b/source4/setup/vampire.py
@@ -26,7 +26,8 @@ from auth import system_session
 import sys
 
 parser = optparse.OptionParser("vampire [options] <domain>")
-parser.add_option_group(options.SambaOptions(parser))
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
 parser.add_option_group(options.VersionOptions(parser))
 credopts = options.CredentialsOptions(parser)
 parser.add_option_group(credopts)
@@ -47,8 +48,6 @@ def vampire(domain, session_info, credentials, lp):
     ctx.samsync_ldb(vampire_ctx, machine_creds=machine_creds, 
                     session_info=session_info)
 
-lp = param.LoadParm()
-if opts.configfile:
-    lp.load(opts.configfile)
+lp = sambaopts.get_loadparm()
 vampire(args[0], session_info=system_session(), 
         credentials=credopts.get_credentials(), lp=lp)
diff --git a/source4/smb_server/smb/nttrans.c b/source4/smb_server/smb/nttrans.c
index fe65b7a667..dd2ec15e39 100644
--- a/source4/smb_server/smb/nttrans.c
+++ b/source4/smb_server/smb/nttrans.c
@@ -527,7 +527,7 @@ static void reply_nttrans_send(struct ntvfs_request *ntvfs)
 			this_req = req;
 		}
 
-		req_grow_data(req, this_param + this_data + (align1 + align2));
+		req_grow_data(this_req, this_param + this_data + (align1 + align2));
 
 		SSVAL(this_req->out.vwv, 0, 0); /* reserved */
 		SCVAL(this_req->out.vwv, 2, 0); /* reserved */
diff --git a/source4/smb_server/smb_server.c b/source4/smb_server/smb_server.c
index cbff585e21..9a8a8cf5c4 100644
--- a/source4/smb_server/smb_server.c
+++ b/source4/smb_server/smb_server.c
@@ -250,20 +250,8 @@ failed:
 	task_server_terminate(task, "Failed to startup smb server task");	
 }
 
-/*
-  called on startup of the smb server service It's job is to start
-  listening on all configured sockets
-*/
-static NTSTATUS smbsrv_init(struct event_context *event_context, 
-			    struct loadparm_context *lp_ctx,
-			    const struct model_ops *model_ops)
-{	
-	return task_server_startup(event_context, lp_ctx, 
-				   model_ops, smbsrv_task_init);
-}
-
 /* called at smbd startup - register ourselves as a server service */
 NTSTATUS server_service_smb_init(void)
 {
-	return register_server_service("smb", smbsrv_init);
+	return register_server_service("smb", smbsrv_task_init);
 }
diff --git a/source4/smbd/process_model.h b/source4/smbd/process_model.h
index c2a5c9e9e8..796c8ee17b 100644
--- a/source4/smbd/process_model.h
+++ b/source4/smbd/process_model.h
@@ -25,7 +25,7 @@
 #define __PROCESS_MODEL_H__
 
 #include "lib/socket/socket.h"
-#include "smbd/service_task.h"
+#include "smbd/service.h"
 
 /* modules can use the following to determine if the interface has changed
  * please increment the version number after each interface change
@@ -56,6 +56,7 @@ struct model_ops {
 	/* function to create a task */
 	void (*new_task)(struct event_context *, 
 			 struct loadparm_context *lp_ctx, 
+			 const char *service_name,
 			 void (*)(struct event_context *, 
 				  struct loadparm_context *, struct server_id, 
 				  void *),
diff --git a/source4/smbd/process_model.mk b/source4/smbd/process_model.mk
index d6b7698e74..5201a2e46e 100644
--- a/source4/smbd/process_model.mk
+++ b/source4/smbd/process_model.mk
@@ -32,6 +32,16 @@ PRIVATE_DEPENDENCIES = PTHREAD
 # End MODULE process_model_thread
 ################################################
 
+################################################
+# Start MODULE process_model_prefork
+[MODULE::process_model_prefork]
+INIT_FUNCTION = process_model_prefork_init 
+SUBSYSTEM = process_model
+OBJ_FILES = \
+		process_prefork.o
+# End MODULE process_model_thread
+################################################
+
 [SUBSYSTEM::process_model]
 PRIVATE_PROTO_HEADER = process_model_proto.h
 OBJ_FILES = \
diff --git a/source4/smbd/process_prefork.c b/source4/smbd/process_prefork.c
new file mode 100644
index 0000000000..839c7209d2
--- /dev/null
+++ b/source4/smbd/process_prefork.c
@@ -0,0 +1,222 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   process model: prefork (n client connections per process)
+
+   Copyright (C) Andrew Tridgell 1992-2005
+   Copyright (C) James J Myers 2003 <myersjj@samba.org>
+   Copyright (C) Stefan (metze) Metzmacher 2004
+   Copyright (C) Andrew Bartlett 2008 <abartlet@samba.org>
+   Copyright (C) David Disseldorp 2008 <ddiss@sgi.com>
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "lib/events/events.h"
+#include "lib/tdb/include/tdb.h"
+#include "lib/socket/socket.h"
+#include "smbd/process_model.h"
+#include "param/secrets.h"
+#include "system/filesys.h"
+#include "cluster/cluster.h"
+#include "param/param.h"
+
+#ifdef HAVE_SETPROCTITLE
+#ifdef HAVE_SETPROCTITLE_H
+#include <setproctitle.h>
+#endif
+#else
+#define setproctitle none_setproctitle
+static int none_setproctitle(const char *fmt, ...) PRINTF_ATTRIBUTE(1, 2);
+static int none_setproctitle(const char *fmt, ...)
+{
+	return 0;
+}
+#endif
+
+/*
+  called when the process model is selected
+*/
+static void prefork_model_init(struct event_context *ev)
+{
+	signal(SIGCHLD, SIG_IGN);
+}
+
+static void prefork_reload_after_fork(void)
+{
+	/* tdb needs special fork handling */
+	if (tdb_reopen_all(1) == -1) {
+		DEBUG(0,("prefork_reload_after_fork: tdb_reopen_all failed.\n"));
+	}
+
+	/* Ensure that the forked children do not expose identical random streams */
+	set_need_random_reseed();
+}
+
+/*
+  called when a listening socket becomes readable. 
+*/
+static void prefork_accept_connection(struct event_context *ev, 
+				      struct loadparm_context *lp_ctx,
+				      struct socket_context *listen_socket,
+				       void (*new_conn)(struct event_context *,
+							struct loadparm_context *, struct socket_context *, 
+							struct server_id , void *), 
+				       void *private)
+{
+	NTSTATUS status;
+	struct socket_context *connected_socket;
+	pid_t pid = getpid();
+
+	/* accept an incoming connection. */
+	status = socket_accept(listen_socket, &connected_socket);
+	if (!NT_STATUS_IS_OK(status)) {
+		return;
+	}
+
+	talloc_steal(private, connected_socket);
+
+	new_conn(ev, lp_ctx, connected_socket, cluster_id(pid, socket_get_fd(connected_socket)), private);
+}
+
+/*
+  called to create a new server task
+*/
+static void prefork_new_task(struct event_context *ev, 
+			     struct loadparm_context *lp_ctx,
+			     const char *service_name,
+			     void (*new_task_fn)(struct event_context *, struct loadparm_context *lp_ctx, struct server_id , void *), 
+			     void *private)
+{
+	pid_t pid;
+	int i, num_children;
+
+	struct event_context *ev2, *ev_parent;
+
+	pid = fork();
+
+	if (pid != 0) {
+		/* parent or error code ... go back to the event loop */
+		return;
+	}
+
+	pid = getpid();
+
+	/* This is now the child code. We need a completely new event_context to work with */
+	ev2 = event_context_init(NULL);
+
+	/* the service has given us a private pointer that
+	   encapsulates the context it needs for this new connection -
+	   everything else will be freed */
+	talloc_steal(ev2, private);
+
+	/* this will free all the listening sockets and all state that
+	   is not associated with this new connection */
+	talloc_free(ev);
+
+	setproctitle("task %s server_id[%d]", service_name, pid);
+
+	prefork_reload_after_fork();
+
+	/* setup this new connection: process will bind to it's sockets etc */
+	new_task_fn(ev2, lp_ctx, cluster_id(pid, 0), private);
+
+	num_children = lp_parm_int(lp_ctx, NULL, "prefork children", service_name, 0);
+	if (num_children == 0) {
+
+		/* We don't want any kids hanging around for this one,
+		 * let the parent do all the work */
+		event_loop_wait(ev2);
+		
+		talloc_free(ev2);
+		exit(0);
+	}
+
+	/* We are now free to spawn some child proccesses */
+
+	for (i=0; i < num_children; i++) {
+
+		pid = fork();
+		if (pid > 0) {
+			continue;
+		} else if (pid == -1) {
+			return;
+		} else {
+			pid = getpid();
+			setproctitle("task %s server_id[%d]", service_name, pid);
+
+			prefork_reload_after_fork();
+
+			/* we can't return to the top level here, as that event context is gone,
+			   so we now process events in the new event context until there are no
+			   more to process */	   
+			event_loop_wait(ev2);
+			
+			talloc_free(ev2);
+			exit(0);
+		}
+	}
+
+	/* Don't listen on the sockets we just gave to the children */
+	talloc_free(ev2);
+	
+	/* But we need a events system to handle reaping children */
+	ev_parent = event_context_init(NULL);
+	
+	/* TODO: Handle some events... */
+	
+	/* we can't return to the top level here, as that event context is gone,
+	   so we now process events in the new event context until there are no
+	   more to process */	   
+	event_loop_wait(ev_parent);
+	
+	talloc_free(ev_parent);
+	exit(0);
+
+}
+
+
+/* called when a task goes down */
+_NORETURN_ static void prefork_terminate(struct event_context *ev, const char *reason) 
+{
+	DEBUG(2,("prefork_terminate: reason[%s]\n",reason));
+}
+
+/* called to set a title of a task or connection */
+static void prefork_set_title(struct event_context *ev, const char *title) 
+{
+	if (title) {
+		setproctitle("%s", title);
+	} else {
+		setproctitle(NULL);
+	}
+}
+
+static const struct model_ops prefork_ops = {
+	.name			= "prefork",
+	.model_init		= prefork_model_init,
+	.accept_connection	= prefork_accept_connection,
+	.new_task               = prefork_new_task,
+	.terminate              = prefork_terminate,
+	.set_title              = prefork_set_title,
+};
+
+/*
+  initialise the prefork process model, registering ourselves with the process model subsystem
+ */
+NTSTATUS process_model_prefork_init(void)
+{
+	return register_process_model(&prefork_ops);
+}
diff --git a/source4/smbd/process_single.c b/source4/smbd/process_single.c
index 5d3c36adb9..a7a27ef9e0 100644
--- a/source4/smbd/process_single.c
+++ b/source4/smbd/process_single.c
@@ -38,7 +38,7 @@ static void single_model_init(struct event_context *ev)
 */
 static void single_accept_connection(struct event_context *ev, 
 				     struct loadparm_context *lp_ctx,
-				     struct socket_context *sock,
+				     struct socket_context *listen_socket,
 				     void (*new_conn)(struct event_context *, 
 						      struct loadparm_context *,
 						      struct socket_context *, 
@@ -46,25 +46,33 @@ static void single_accept_connection(struct event_context *ev,
 				     void *private)
 {
 	NTSTATUS status;
-	struct socket_context *sock2;
+	struct socket_context *connected_socket;
 
 	/* accept an incoming connection. */
-	status = socket_accept(sock, &sock2);
+	status = socket_accept(listen_socket, &connected_socket);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(0,("single_accept_connection: accept: %s\n", nt_errstr(status)));
-		/* this looks strange, but is correct. We need to
-		   throttle things until the system clears enough
-		   resources to handle this new socket. If we don't
-		   then we will spin filling the log and causing more
-		   problems. We don't panic as this is probably a
-		   temporary resource constraint */
+		/* this looks strange, but is correct. 
+
+		   We can only be here if woken up from select, due to
+		   an incomming connection.
+
+		   We need to throttle things until the system clears
+		   enough resources to handle this new socket. 
+
+		   If we don't then we will spin filling the log and
+		   causing more problems. We don't panic as this is
+		   probably a temporary resource constraint */
 		sleep(1);
 		return;
 	}
 
-	talloc_steal(private, sock);
+	talloc_steal(private, connected_socket);
 
-	new_conn(ev, lp_ctx, sock2, cluster_id(socket_get_fd(sock2)), private);
+	/* The cluster_id(0, fd) cannot collide with the incrementing
+	 * task below, as the first component is 0, not 1 */
+	new_conn(ev, lp_ctx, connected_socket, 
+		 cluster_id(0, socket_get_fd(connected_socket)), private);
 }
 
 /*
@@ -72,11 +80,17 @@ static void single_accept_connection(struct event_context *ev,
 */
 static void single_new_task(struct event_context *ev, 
 			    struct loadparm_context *lp_ctx, 
+			    const char *service_name,
 			    void (*new_task)(struct event_context *, struct loadparm_context *, struct server_id, void *), 
 			    void *private)
 {
-	static uint32_t taskid = 0x10000000;
-	new_task(ev, lp_ctx, cluster_id(taskid++), private);
+	static uint32_t taskid = 0;
+       
+	/* We use 1 so we cannot collide in with cluster ids generated
+	 * in the accept connection above, and unlikly to collide with
+	 * PIDs from process modal standard (don't run samba as
+	 * init) */
+	new_task(ev, lp_ctx, cluster_id(1, taskid++), private);
 }
 
 
diff --git a/source4/smbd/process_standard.c b/source4/smbd/process_standard.c
index c088ea3b1a..deb44c0a68 100644
--- a/source4/smbd/process_standard.c
+++ b/source4/smbd/process_standard.c
@@ -127,8 +127,8 @@ static void standard_accept_connection(struct event_context *ev,
 	talloc_free(c);
 	talloc_free(s);
 
-	/* setup this new connection */
-	new_conn(ev2, lp_ctx, sock2, cluster_id(pid), private);
+	/* setup this new connection.  Cluster ID is PID based for this process modal */
+	new_conn(ev2, lp_ctx, sock2, cluster_id(pid, 0), private);
 
 	/* we can't return to the top level here, as that event context is gone,
 	   so we now process events in the new event context until there are no
@@ -144,6 +144,7 @@ static void standard_accept_connection(struct event_context *ev,
 */
 static void standard_new_task(struct event_context *ev, 
 			      struct loadparm_context *lp_ctx,
+			      const char *service_name,
 			      void (*new_task)(struct event_context *, struct loadparm_context *lp_ctx, struct server_id , void *), 
 			      void *private)
 {
@@ -179,10 +180,10 @@ static void standard_new_task(struct event_context *ev,
 	/* Ensure that the forked children do not expose identical random streams */
 	set_need_random_reseed();
 
-	setproctitle("task server_id[%d]", pid);
+	setproctitle("task %s server_id[%d]", service_name, pid);
 
-	/* setup this new connection */
-	new_task(ev2, lp_ctx, cluster_id(pid), private);
+	/* setup this new task.  Cluster ID is PID based for this process modal */
+	new_task(ev2, lp_ctx, cluster_id(pid, 0), private);
 
 	/* we can't return to the top level here, as that event context is gone,
 	   so we now process events in the new event context until there are no
diff --git a/source4/smbd/process_thread.c b/source4/smbd/process_thread.c
index 6c5f4816c0..5a45cdfeac 100644
--- a/source4/smbd/process_thread.c
+++ b/source4/smbd/process_thread.c
@@ -148,6 +148,7 @@ static void *thread_task_fn(void *thread_parm)
 */
 static void thread_new_task(struct event_context *ev, 
 			    struct loadparm_context *lp_ctx,
+			    const char *service_name,
 			    void (*new_task)(struct event_context *, 
 					     struct loadparm_context *,
 					     uint32_t , void *), 
@@ -178,10 +179,10 @@ static void thread_new_task(struct event_context *ev,
 	rc = pthread_create(&thread_id, &thread_attr, thread_task_fn, state);
 	pthread_attr_destroy(&thread_attr);
 	if (rc == 0) {
-		DEBUG(4,("thread_new_task: created thread_id=%lu\n", 
-			 (unsigned long int)thread_id));
+		DEBUG(4,("thread_new_task: created %s thread_id=%lu\n", 
+			 service_name, (unsigned long int)thread_id));
 	} else {
-		DEBUG(0,("thread_new_task: thread create failed rc=%d\n", rc));
+		DEBUG(0,("thread_new_task: thread create for %s failed rc=%d\n", service_name, rc));
 		talloc_free(ev2);
 	}
 }
diff --git a/source4/smbd/service.c b/source4/smbd/service.c
index 525b245616..2b1fcc4bd8 100644
--- a/source4/smbd/service.c
+++ b/source4/smbd/service.c
@@ -30,20 +30,20 @@
 static struct registered_server {
 	struct registered_server *next, *prev;
 	const char *service_name;
-	NTSTATUS (*service_init)(struct event_context *, struct loadparm_context *lp_ctx, const struct model_ops *);
+	void (*task_init)(struct task_server *);
 } *registered_servers;
 
 /*
   register a server service. 
 */
 NTSTATUS register_server_service(const char *name,
-				 NTSTATUS (*service_init)(struct event_context *, struct loadparm_context *lp_ctx, const struct model_ops *))
+				 void (*task_init)(struct task_server *))
 {
 	struct registered_server *srv;
 	srv = talloc(talloc_autofree_context(), struct registered_server);
 	NT_STATUS_HAVE_NO_MEMORY(srv);
 	srv->service_name = name;
-	srv->service_init = service_init;
+	srv->task_init = task_init;
 	DLIST_ADD_END(registered_servers, srv, struct registered_server *);
 	return NT_STATUS_OK;
 }
@@ -53,14 +53,15 @@ NTSTATUS register_server_service(const char *name,
   initialise a server service
 */
 static NTSTATUS server_service_init(const char *name,
-				    struct event_context *event_ctx,
+				    struct event_context *event_context,
 				    struct loadparm_context *lp_ctx,
 				    const struct model_ops *model_ops)
 {
 	struct registered_server *srv;
 	for (srv=registered_servers; srv; srv=srv->next) {
 		if (strcasecmp(name, srv->service_name) == 0) {
-			return srv->service_init(event_ctx, lp_ctx, model_ops);
+			return task_server_startup(event_context, lp_ctx, srv->service_name,
+						   model_ops, srv->task_init);
 		}
 	}
 	return NT_STATUS_INVALID_SYSTEM_SERVICE;
diff --git a/source4/smbd/service_stream.c b/source4/smbd/service_stream.c
index 0d6f1b7281..7e1f6493ee 100644
--- a/source4/smbd/service_stream.c
+++ b/source4/smbd/service_stream.c
@@ -136,7 +136,7 @@ NTSTATUS stream_new_connection_merge(struct event_context *ev,
 	srv_conn->private       = private_data;
 	srv_conn->model_ops     = model_ops;
 	srv_conn->socket	= sock;
-	srv_conn->server_id	= cluster_id(0);
+	srv_conn->server_id	= cluster_id(0, 0);
 	srv_conn->ops           = stream_ops;
 	srv_conn->msg_ctx	= msg_ctx;
 	srv_conn->event.ctx	= ev;
@@ -274,8 +274,11 @@ NTSTATUS stream_setup_socket(struct event_context *event_context,
 		NT_STATUS_NOT_OK_RETURN(status);
 	}
 
-	/* TODO: set socket ACL's here when they're implemented */
+	/* TODO: set socket ACL's (host allow etc) here when they're
+	 * implemented */
 
+	/* Some sockets don't have a port, or are just described from
+	 * the string.  We are indicating this by having port == NULL */
 	if (!port) {
 		socket_address = socket_address_from_strings(stream_socket, 
 							     stream_socket->sock->backend_name,
@@ -314,9 +317,16 @@ NTSTATUS stream_setup_socket(struct event_context *event_context,
 		return status;
 	}
 
-	/* we will close the socket using the events system */
+	/* By specifying EVENT_FD_AUTOCLOSE below, we indicate that we
+	 * will close the socket using the events system.  This avoids
+	 * nasty interactions with waiting for talloc to close the socket. */
+
 	socket_set_flags(stream_socket->sock, SOCKET_FLAG_NOCLOSE);
 
+	/* Add the FD from the newly created socket into the event
+	 * subsystem.  it will call the accept handler whenever we get
+	 * new connections */
+
 	event_add_fd(event_context, stream_socket->sock, 
 		     socket_get_fd(stream_socket->sock), 
 		     EVENT_FD_READ|EVENT_FD_AUTOCLOSE, 
diff --git a/source4/smbd/service_task.c b/source4/smbd/service_task.c
index 08588464cc..2274685059 100644
--- a/source4/smbd/service_task.c
+++ b/source4/smbd/service_task.c
@@ -85,6 +85,7 @@ static void task_server_callback(struct event_context *event_ctx,
 */
 NTSTATUS task_server_startup(struct event_context *event_ctx, 
 			     struct loadparm_context *lp_ctx,
+			     const char *service_name, 
 			     const struct model_ops *model_ops, 
 			     void (*task_init)(struct task_server *))
 {
@@ -96,7 +97,7 @@ NTSTATUS task_server_startup(struct event_context *event_ctx,
 	state->task_init = task_init;
 	state->model_ops = model_ops;
 	
-	model_ops->new_task(event_ctx, lp_ctx, task_server_callback, state);
+	model_ops->new_task(event_ctx, lp_ctx, service_name, task_server_callback, state);
 
 	return NT_STATUS_OK;
 }
diff --git a/source4/torture/config.mk b/source4/torture/config.mk
index dd0ca83f7d..e9ef18ac07 100644
--- a/source4/torture/config.mk
+++ b/source4/torture/config.mk
@@ -1,8 +1,8 @@
 # TORTURE subsystem
 [LIBRARY::torture]
-DESCRIPTION = Samba torture (test) suite
 SO_VERSION = 0
 VERSION = 0.0.1
+PC_FILE = torture.pc
 PUBLIC_HEADERS = torture.h ui.h
 PUBLIC_PROTO_HEADER = proto.h
 OBJ_FILES = \
@@ -14,7 +14,7 @@ PUBLIC_DEPENDENCIES = \
 		LIBTALLOC 
 
 [SUBSYSTEM::TORTURE_UTIL]
-OBJ_FILES = util.o util_smb.o
+OBJ_FILES = util_smb.o
 PRIVATE_DEPENDENCIES = LIBCLI_RAW
 PUBLIC_PROTO_HEADER = util.h
 PUBLIC_DEPENDENCIES = POPT_CREDENTIALS
@@ -88,7 +88,8 @@ OBJ_FILES = \
 		raw/samba3hide.o \
 		raw/samba3misc.o \
 		raw/composite.o \
-		raw/raw.o
+		raw/raw.o \
+		raw/offline.o
 PRIVATE_DEPENDENCIES = \
 		LIBCLI_SMB LIBCLI_LSA LIBCLI_SMB_COMPOSITE \
 		POPT_CREDENTIALS TORTURE_UTIL
@@ -296,7 +297,8 @@ PRIVATE_DEPENDENCIES = \
 		LIBSAMBA-NET \
 		smbcalls \
 		POPT_CREDENTIALS \
-		torture_rpc
+		torture_rpc \
+		LIBPYTHON
 # End SUBSYSTEM TORTURE_NET
 #################################
 
diff --git a/source4/torture/libnet/libnet_BecomeDC.c b/source4/torture/libnet/libnet_BecomeDC.c
index 10625b25de..0ef6a03a6a 100644
--- a/source4/torture/libnet/libnet_BecomeDC.c
+++ b/source4/torture/libnet/libnet_BecomeDC.c
@@ -60,7 +60,9 @@ struct test_become_dc_state {
 		const char *configdn_ldb;
 		const char *schemadn_ldb;
 		const char *secrets_ldb;
+		const char *templates_ldb;
 		const char *secrets_keytab;
+		const char *dns_keytab;
 	} path;
 };
 
@@ -88,7 +90,6 @@ static NTSTATUS test_become_dc_check_options(void *private_data,
 	return NT_STATUS_OK;
 }
 
-#ifndef PROVISION_PYTHON
 #include "lib/appweb/ejs/ejs.h"
 #include "lib/appweb/ejs/ejsInternal.h"
 #include "scripting/ejs/smbcalls.h"
@@ -146,14 +147,16 @@ failed:
 	return ejs_error;
 }
 
-static NTSTATUS test_become_dc_prepare_db(void *private_data,
-					  const struct libnet_BecomeDC_PrepareDB *p)
+static NTSTATUS test_become_dc_prepare_db_ejs(void *private_data,
+					      const struct libnet_BecomeDC_PrepareDB *p)
 {
 	struct test_become_dc_state *s = talloc_get_type(private_data, struct test_become_dc_state);
 	char *ejs;
 	int ret;
 	bool ok;
 
+	DEBUG(0,("Provision for Become-DC test using EJS\n"));
+
 	DEBUG(0,("New Server[%s] in Site[%s]\n",
 		p->dest_dsa->dns_name, p->dest_dsa->site_name));
 
@@ -195,26 +198,10 @@ static NTSTATUS test_become_dc_prepare_db(void *private_data,
 		"subobj.SCHEMADN     = \"%s\";\n"
 		"subobj.SCHEMADN_LDB = \"%s\";\n"
 		"subobj.HOSTNAME     = \"%s\";\n"
-		"subobj.DNSNAME      = \"%s\";\n"
+		"subobj.REALM        = \"%s\";\n"
+		"subobj.DOMAIN       = \"%s\";\n"
 		"subobj.DEFAULTSITE  = \"%s\";\n"
 		"\n"
-		"modules_list        = new Array(\"rootdse\",\n"
-		"                                \"kludge_acl\",\n"
-		"                                \"paged_results\",\n"
-		"                                \"server_sort\",\n"
-		"                                \"extended_dn\",\n"
-		"                                \"asq\",\n"
-		"                                \"samldb\",\n"
-		"                                \"operational\",\n"
-		"                                \"objectclass\",\n"
-		"                                \"rdn_name\",\n"
-		"                                \"show_deleted\",\n"
-		"                                \"partition\");\n"
-		"subobj.MODULES_LIST = join(\",\", modules_list);\n"
-		"subobj.DOMAINDN_MOD = \"pdc_fsmo,password_hash,repl_meta_data\";\n"
-		"subobj.CONFIGDN_MOD = \"naming_fsmo,repl_meta_data\";\n"
-		"subobj.SCHEMADN_MOD = \"schema_fsmo,repl_meta_data\";\n"
-		"\n"
 		"subobj.KRBTGTPASS   = \"_NOT_USED_\";\n"
 		"subobj.MACHINEPASS  = \"%s\";\n"
 		"subobj.ADMINPASS    = \"_NOT_USED_\";\n"
@@ -222,7 +209,9 @@ static NTSTATUS test_become_dc_prepare_db(void *private_data,
 		"var paths = provision_default_paths(subobj);\n"
 		"paths.samdb = \"%s\";\n"
 		"paths.secrets = \"%s\";\n"
+		"paths.templates = \"%s\";\n"
 		"paths.keytab = \"%s\";\n"
+		"paths.dns_keytab = \"%s\";\n"
 		"\n"
 		"var system_session = system_session();\n"
 		"\n"
@@ -238,12 +227,15 @@ static NTSTATUS test_become_dc_prepare_db(void *private_data,
 		p->forest->schema_dn_str,	/* subobj.SCHEMADN */
 		s->path.schemadn_ldb,		/* subobj.SCHEMADN_LDB */
 		p->dest_dsa->netbios_name,	/* subobj.HOSTNAME */
-		p->dest_dsa->dns_name,		/* subobj.DNSNAME */
+		torture_join_dom_dns_name(s->tj),/* subobj.REALM */
+		torture_join_dom_netbios_name(s->tj),/* subobj.DOMAIN */
 		p->dest_dsa->site_name,		/* subobj.DEFAULTSITE */
 		cli_credentials_get_password(s->machine_account),/* subobj.MACHINEPASS */
 		s->path.samdb_ldb,		/* paths.samdb */
+		s->path.templates_ldb,		/* paths.templates */
 		s->path.secrets_ldb,		/* paths.secrets */
-		s->path.secrets_keytab);	/* paths.keytab */
+		s->path.secrets_keytab,	        /* paths.keytab */
+		s->path.dns_keytab);	        /* paths.dns_keytab */
 	NT_STATUS_HAVE_NO_MEMORY(ejs);
 
 	ret = test_run_ejs(ejs);
@@ -283,18 +275,20 @@ static NTSTATUS test_become_dc_prepare_db(void *private_data,
 	return NT_STATUS_OK;
 }
 
-#else 
+#ifdef HAVE_WORKING_PYTHON
 #include "param/param.h"
 #include <Python.h>
 #include "scripting/python/modules.h"
 
-static NTSTATUS test_become_dc_prepare_db(void *private_data,
-					  const struct libnet_BecomeDC_PrepareDB *p)
+static NTSTATUS test_become_dc_prepare_db_py(void *private_data,
+					     const struct libnet_BecomeDC_PrepareDB *p)
 {
 	struct test_become_dc_state *s = talloc_get_type(private_data, struct test_become_dc_state);
 	bool ok;
 	PyObject *provision_fn, *result, *parameters;
 
+	DEBUG(0,("Provision for Become-DC test using PYTHON\n"));
+
 	py_load_samba_modules();
 	Py_Initialize();
 
@@ -387,8 +381,7 @@ static NTSTATUS test_become_dc_prepare_db(void *private_data,
 
 	return NT_STATUS_OK;
 }
-
-#endif
+#endif /* HAVE_WORKING_PYTHON */
 
 static NTSTATUS test_apply_schema(struct test_become_dc_state *s,
 				  const struct libnet_BecomeDC_StoreChunk *c)
@@ -854,8 +847,12 @@ bool torture_net_become_dc(struct torture_context *torture)
 	if (!s->path.schemadn_ldb) return false;
 	s->path.secrets_ldb	= talloc_asprintf(s, "%s_secrets.ldb", s->netbios_name);
 	if (!s->path.secrets_ldb) return false;
+	s->path.templates_ldb	= talloc_asprintf(s, "%s_templates.ldb", s->netbios_name);
+	if (!s->path.templates_ldb) return false;
 	s->path.secrets_keytab	= talloc_asprintf(s, "%s_secrets.keytab", s->netbios_name);
 	if (!s->path.secrets_keytab) return false;
+	s->path.dns_keytab	= talloc_asprintf(s, "%s_dns.keytab", s->netbios_name);
+	if (!s->path.dns_keytab) return false;
 
 	/* Join domain as a member server. */
 	s->tj = torture_join_domain(torture, s->netbios_name,
@@ -881,7 +878,12 @@ bool torture_net_become_dc(struct torture_context *torture)
 
 	b.in.callbacks.private_data	= s;
 	b.in.callbacks.check_options	= test_become_dc_check_options;
-	b.in.callbacks.prepare_db	= test_become_dc_prepare_db;
+	b.in.callbacks.prepare_db	= test_become_dc_prepare_db_ejs;
+#ifdef HAVE_WORKING_PYTHON
+	if (getenv("PROVISION_PYTHON")) {
+		b.in.callbacks.prepare_db = test_become_dc_prepare_db_py;
+	}
+#endif
 	b.in.callbacks.schema_chunk	= test_become_dc_schema_chunk;
 	b.in.callbacks.config_chunk	= test_become_dc_store_chunk;
 	b.in.callbacks.domain_chunk	= test_become_dc_store_chunk;
diff --git a/source4/torture/raw/offline.c b/source4/torture/raw/offline.c
new file mode 100644
index 0000000000..1340692faa
--- /dev/null
+++ b/source4/torture/raw/offline.c
@@ -0,0 +1,508 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   Copyright (C) Andrew Tridgell 2008
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/*
+  test offline files
+ */
+
+#include "includes.h"
+#include "torture/torture.h"
+#include "libcli/raw/libcliraw.h"
+#include "system/time.h"
+#include "system/filesys.h"
+#include "libcli/libcli.h"
+#include "torture/util.h"
+#include "lib/events/events.h"
+#include "lib/cmdline/popt_common.h"
+#include "libcli/composite/composite.h"
+#include "libcli/smb_composite/smb_composite.h"
+#include "libcli/resolve/resolve.h"
+#include "param/param.h"
+
+#define BASEDIR "\\testoffline"
+
+static int nconnections;
+static int numstates;
+static int num_connected;
+static int test_failed;
+extern int torture_numops;
+extern int torture_entries;
+static bool test_finished;
+
+enum offline_op {OP_LOADFILE, OP_SAVEFILE, OP_SETOFFLINE, OP_GETOFFLINE, OP_ENDOFLIST};
+
+static double latencies[OP_ENDOFLIST];
+static double worst_latencies[OP_ENDOFLIST];
+
+#define FILE_SIZE 8192
+
+
+struct offline_state {
+	struct torture_context *tctx;
+	struct event_context *ev;
+	struct smbcli_tree *tree;
+	TALLOC_CTX *mem_ctx;
+	int client;
+	int fnum;
+	uint32_t count;
+	uint32_t lastcount;
+	uint32_t fnumber;
+	uint32_t offline_count;
+	uint32_t online_count;
+	char *fname;
+	struct smb_composite_loadfile *loadfile;
+	struct smb_composite_savefile *savefile;
+	struct smbcli_request *req;
+	enum offline_op op;
+	struct timeval tv_start;
+};
+
+static void test_offline(struct offline_state *state);
+
+
+static char *filename(TALLOC_CTX *ctx, int i)
+{
+	char *s = talloc_asprintf(ctx, BASEDIR "\\file%u.dat", i);
+	return s;
+}
+
+
+/*
+  called when a loadfile completes
+ */
+static void loadfile_callback(struct composite_context *ctx) 
+{
+	struct offline_state *state = ctx->async.private_data;
+	NTSTATUS status;
+	int i;
+
+	status = smb_composite_loadfile_recv(ctx, state->mem_ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		printf("Failed to read file '%s' - %s\n", 
+		       state->loadfile->in.fname, nt_errstr(status));
+		test_failed++;
+	}
+
+	/* check the data is correct */
+	if (state->loadfile->out.size != FILE_SIZE) {
+		printf("Wrong file size %u - expected %u\n", 
+		       state->loadfile->out.size, FILE_SIZE);
+		test_failed++;
+		return;
+	}
+
+	for (i=0;i<FILE_SIZE;i++) {
+		if (state->loadfile->out.data[i] != state->fnumber % 256) {
+			printf("Bad data in file %u\n", state->fnumber);
+			test_failed++;
+			return;
+		}
+	}
+	
+	talloc_steal(state->loadfile, state->loadfile->out.data);
+
+	state->count++;
+	talloc_free(state->loadfile);
+	state->loadfile = NULL;
+
+	if (!test_finished) {
+		test_offline(state);
+	}
+}
+
+
+/*
+  called when a savefile completes
+ */
+static void savefile_callback(struct composite_context *ctx) 
+{
+	struct offline_state *state = ctx->async.private_data;
+	NTSTATUS status;
+
+	status = smb_composite_savefile_recv(ctx);
+	if (!NT_STATUS_IS_OK(status)) {
+		printf("Failed to save file '%s' - %s\n", 
+		       state->savefile->in.fname, nt_errstr(status));
+		test_failed++;
+	}
+
+	state->count++;
+	talloc_free(state->savefile);
+	state->savefile = NULL;
+
+	if (!test_finished) {
+		test_offline(state);
+	}
+}
+
+
+/*
+  called when a setoffline completes
+ */
+static void setoffline_callback(struct smbcli_request *req) 
+{
+	struct offline_state *state = req->async.private;
+	NTSTATUS status;
+
+	status = smbcli_request_simple_recv(req);
+	if (!NT_STATUS_IS_OK(status)) {
+		printf("Failed to set offline file '%s' - %s\n", 
+		       state->fname, nt_errstr(status));
+		test_failed++;
+	}
+
+	state->req = NULL;
+	state->count++;
+
+	if (!test_finished) {
+		test_offline(state);
+	}
+}
+
+
+/*
+  called when a getoffline completes
+ */
+static void getoffline_callback(struct smbcli_request *req) 
+{
+	struct offline_state *state = req->async.private;
+	NTSTATUS status;
+	union smb_fileinfo io;
+
+	io.getattr.level = RAW_FILEINFO_GETATTR;
+	
+	status = smb_raw_pathinfo_recv(req, state->mem_ctx, &io);
+	if (!NT_STATUS_IS_OK(status)) {
+		printf("Failed to get offline file '%s' - %s\n", 
+		       state->fname, nt_errstr(status));
+		test_failed++;
+	}
+
+	if (io.getattr.out.attrib & FILE_ATTRIBUTE_OFFLINE) {
+		state->offline_count++;
+	} else {
+		state->online_count++;
+	}
+
+	state->req = NULL;
+	state->count++;
+
+	if (!test_finished) {
+		test_offline(state);
+	}
+}
+
+
+/*
+  send the next offline file fetch request
+*/
+static void test_offline(struct offline_state *state)
+{
+	struct composite_context *ctx;
+	double lat;
+
+	lat = timeval_elapsed(&state->tv_start);
+	if (latencies[state->op] < lat) {
+		latencies[state->op] = lat;
+	}
+
+	state->op = (enum offline_op) (random() % OP_ENDOFLIST);
+	
+	state->fnumber = random() % torture_numops;
+	talloc_free(state->fname);
+	state->fname = filename(state->mem_ctx, state->fnumber);
+
+	state->tv_start = timeval_current();
+
+	switch (state->op) {
+	case OP_LOADFILE:
+		state->loadfile = talloc_zero(state->mem_ctx, struct smb_composite_loadfile);
+		state->loadfile->in.fname = state->fname;
+	
+		ctx = smb_composite_loadfile_send(state->tree, state->loadfile);
+		if (ctx == NULL) {
+			printf("Failed to setup loadfile for %s\n", state->fname);
+			test_failed = true;
+		}
+
+		talloc_steal(state->loadfile, ctx);
+
+		ctx->async.fn = loadfile_callback;
+		ctx->async.private_data = state;
+		break;
+
+	case OP_SAVEFILE:
+		state->savefile = talloc_zero(state->mem_ctx, struct smb_composite_savefile);
+
+		state->savefile->in.fname = state->fname;
+		state->savefile->in.data  = talloc_size(state->savefile, FILE_SIZE);
+		state->savefile->in.size  = FILE_SIZE;
+		memset(state->savefile->in.data, state->fnumber, FILE_SIZE);
+	
+		ctx = smb_composite_savefile_send(state->tree, state->savefile);
+		if (ctx == NULL) {
+			printf("Failed to setup savefile for %s\n", state->fname);
+			test_failed = true;
+		}
+
+		talloc_steal(state->savefile, ctx);
+
+		ctx->async.fn = savefile_callback;
+		ctx->async.private_data = state;
+		break;
+
+	case OP_SETOFFLINE: {
+		union smb_setfileinfo io;
+		ZERO_STRUCT(io);
+		io.setattr.level = RAW_SFILEINFO_SETATTR;
+		io.setattr.in.attrib = FILE_ATTRIBUTE_OFFLINE;
+		io.setattr.in.file.path = state->fname;
+		/* make the file 1 hour old, to get past mininum age restrictions 
+		   for HSM systems */
+		io.setattr.in.write_time = time(NULL) - 60*60;
+
+		state->req = smb_raw_setpathinfo_send(state->tree, &io);
+		if (state->req == NULL) {
+			printf("Failed to setup setoffline for %s\n", state->fname);
+			test_failed = true;
+		}
+		
+		state->req->async.fn = setoffline_callback;
+		state->req->async.private = state;
+		break;
+	}
+
+	case OP_GETOFFLINE: {
+		union smb_fileinfo io;
+		ZERO_STRUCT(io);
+		io.getattr.level = RAW_FILEINFO_GETATTR;
+		io.getattr.in.file.path = state->fname;
+
+		state->req = smb_raw_pathinfo_send(state->tree, &io);
+		if (state->req == NULL) {
+			printf("Failed to setup getoffline for %s\n", state->fname);
+			test_failed = true;
+		}
+		
+		state->req->async.fn = getoffline_callback;
+		state->req->async.private = state;
+		break;
+	}
+
+	default:
+		printf("bad operation??\n");
+		break;
+	}
+}
+
+
+
+
+static void echo_completion(struct smbcli_request *req)
+{
+	struct offline_state *state = (struct offline_state *)req->async.private;
+	NTSTATUS status = smbcli_request_simple_recv(req);
+	if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE) ||
+	    NT_STATUS_EQUAL(status, NT_STATUS_LOCAL_DISCONNECT)) {
+		talloc_free(state->tree);
+		state->tree = NULL;
+		num_connected--;	
+		DEBUG(0,("lost connection\n"));
+		test_failed++;
+	}
+}
+
+static void report_rate(struct event_context *ev, struct timed_event *te, 
+			struct timeval t, void *private_data)
+{
+	struct offline_state *state = talloc_get_type(private_data, 
+							struct offline_state);
+	int i;
+	uint32_t total=0, total_offline=0, total_online=0;
+	for (i=0;i<numstates;i++) {
+		total += state[i].count - state[i].lastcount;
+		if (timeval_elapsed(&state[i].tv_start) > latencies[state[i].op]) {
+			latencies[state[i].op] = timeval_elapsed(&state[i].tv_start);
+		}
+		state[i].lastcount = state[i].count;		
+		total_online += state[i].online_count;
+		total_offline += state[i].offline_count;
+	}
+	printf("ops/s=%4u  offline=%5u online=%4u  set_lat=%.1f get_lat=%.1f save_lat=%.1f load_lat=%.1f\r",
+	       total, total_offline, total_online,
+	       latencies[OP_SETOFFLINE],
+	       latencies[OP_GETOFFLINE],
+	       latencies[OP_SAVEFILE],
+	       latencies[OP_LOADFILE]);
+	fflush(stdout);
+	event_add_timed(ev, state, timeval_current_ofs(1, 0), report_rate, state);
+
+	for (i=0;i<OP_ENDOFLIST;i++) {
+		if (latencies[i] > worst_latencies[i]) {
+			worst_latencies[i] = latencies[i];
+		}
+		latencies[i] = 0;
+	}
+
+	/* send an echo on each interface to ensure it stays alive - this helps
+	   with IP takeover */
+	for (i=0;i<numstates;i++) {
+		struct smb_echo p;
+		struct smbcli_request *req;
+
+		if (!state[i].tree) {
+			continue;
+		}
+
+		p.in.repeat_count = 1;
+		p.in.size = 0;
+		p.in.data = NULL;
+		req = smb_raw_echo_send(state[i].tree->session->transport, &p);
+		req->async.private = &state[i];
+		req->async.fn      = echo_completion;
+	}
+}
+
+/* 
+   test offline file handling
+*/
+bool torture_test_offline(struct torture_context *torture)
+{
+	bool ret = true;
+	TALLOC_CTX *mem_ctx = talloc_new(torture);
+	int i;
+	int timelimit = torture_setting_int(torture, "timelimit", 10);
+	struct timeval tv;
+	struct event_context *ev = event_context_find(mem_ctx);
+	struct offline_state *state;
+	struct smbcli_state *cli;
+	bool progress;
+	progress = torture_setting_bool(torture, "progress", true);
+
+	nconnections = torture_setting_int(torture, "nprocs", 4);
+	numstates = nconnections * torture_entries;
+
+	state = talloc_zero_array(mem_ctx, struct offline_state, numstates);
+
+	printf("Opening %d connections with %d simultaneous operations and %u files\n", nconnections, numstates, torture_numops);
+	for (i=0;i<nconnections;i++) {
+		state[i].tctx = torture;
+		state[i].mem_ctx = talloc_new(state);
+		state[i].ev = ev;
+		if (!torture_open_connection_ev(&cli, i, torture, ev)) {
+			return false;
+		}
+		state[i].tree = cli->tree;
+		state[i].client = i;
+		/* allow more time for offline files */
+		state[i].tree->session->transport->options.request_timeout = 200;
+	}
+
+	/* the others are repeats on the earlier connections */
+	for (i=nconnections;i<numstates;i++) {
+		state[i].tctx = torture;
+		state[i].mem_ctx = talloc_new(state);
+		state[i].ev = ev;
+		state[i].tree = state[i % nconnections].tree;
+		state[i].client = i;
+	}
+
+	num_connected = i;
+
+	if (!torture_setup_dir(cli, BASEDIR)) {
+		goto failed;
+	}
+
+	/* pre-create files */
+	printf("Pre-creating %u files ....\n", torture_numops);
+	for (i=0;i<torture_numops;i++) {
+		int fnum;
+		char *fname = filename(mem_ctx, i);
+		char buf[FILE_SIZE];
+		NTSTATUS status;
+
+		memset(buf, i % 256, sizeof(buf));
+
+		fnum = smbcli_open(state[0].tree, fname, O_RDWR|O_CREAT, DENY_NONE);
+		if (fnum == -1) {
+			printf("Failed to open %s on connection %d\n", fname, i);
+			goto failed;
+		}
+
+		if (smbcli_write(state[0].tree, fnum, 0, buf, 0, sizeof(buf)) != sizeof(buf)) {
+			printf("Failed to write file of size %u\n", FILE_SIZE);
+			goto failed;
+		}
+
+		status = smbcli_close(state[0].tree, fnum);
+		if (!NT_STATUS_IS_OK(status)) {
+			printf("Close failed - %s\n", nt_errstr(status));
+			goto failed;
+		}
+
+		talloc_free(fname);
+	}
+
+	/* start the async ops */
+	for (i=0;i<numstates;i++) {
+		state[i].tv_start = timeval_current();
+		test_offline(&state[i]);
+	}
+
+	tv = timeval_current();	
+
+	if (progress) {
+		event_add_timed(ev, state, timeval_current_ofs(1, 0), report_rate, state);
+	}
+
+	printf("Running for %d seconds\n", timelimit);
+	while (timeval_elapsed(&tv) < timelimit) {
+		event_loop_once(ev);
+
+		if (test_failed) {
+			DEBUG(0,("test failed\n"));
+			goto failed;
+		}
+	}
+
+	printf("\nWaiting for completion\n");
+	test_finished = true;
+	for (i=0;i<numstates;i++) {
+		while (state[i].loadfile || 
+		       state[i].savefile ||
+		       state[i].req) {
+			event_loop_once(ev);
+		}
+	}	
+
+	printf("worst latencies: set_lat=%.1f get_lat=%.1f save_lat=%.1f load_lat=%.1f\n",
+	       worst_latencies[OP_SETOFFLINE],
+	       worst_latencies[OP_GETOFFLINE],
+	       worst_latencies[OP_SAVEFILE],
+	       worst_latencies[OP_LOADFILE]);
+
+	smbcli_deltree(state[0].tree, BASEDIR);
+	talloc_free(mem_ctx);
+	printf("\n");
+	return ret;
+
+failed:
+	talloc_free(mem_ctx);
+	return false;
+}
diff --git a/source4/torture/raw/open.c b/source4/torture/raw/open.c
index 47f32b619b..76bc0ca53d 100644
--- a/source4/torture/raw/open.c
+++ b/source4/torture/raw/open.c
@@ -1367,7 +1367,7 @@ static bool test_raw_open_multi(struct torture_context *tctx)
 		return false;
 	}
 
-	cli->tree->session->transport->options.request_timeout = 60000;
+	cli->tree->session->transport->options.request_timeout = 60;
 
 	for (i=0; i<num_files; i++) {
 		if (!torture_open_connection_share(mem_ctx, &(clients[i]),
@@ -1375,8 +1375,7 @@ static bool test_raw_open_multi(struct torture_context *tctx)
 			DEBUG(0, ("Could not open %d'th connection\n", i));
 			return false;
 		}
-		clients[i]->tree->session->transport->
-			options.request_timeout = 60000;
+		clients[i]->tree->session->transport->options.request_timeout = 60;
 	}
 
 	/* cleanup */
diff --git a/source4/torture/raw/raw.c b/source4/torture/raw/raw.c
index 112c34d299..bb3dde728f 100644
--- a/source4/torture/raw/raw.c
+++ b/source4/torture/raw/raw.c
@@ -33,6 +33,7 @@ NTSTATUS torture_raw_init(void)
 	torture_suite_add_simple_test(suite, "PING-PONG", torture_ping_pong);
 	torture_suite_add_simple_test(suite, "BENCH-LOCK", torture_bench_lock);
 	torture_suite_add_simple_test(suite, "BENCH-OPEN", torture_bench_open);
+	torture_suite_add_simple_test(suite, "OFFLINE", torture_test_offline);
 	torture_suite_add_1smb_test(suite, "QFSINFO", torture_raw_qfsinfo);
 	torture_suite_add_1smb_test(suite, "QFILEINFO", torture_raw_qfileinfo);
 	torture_suite_add_1smb_test(suite, "QFILEINFO-IPC", torture_raw_qfileinfo_pipe);
diff --git a/source4/torture/rpc/spoolss_notify.c b/source4/torture/rpc/spoolss_notify.c
index 0065101447..96db7d1ec5 100644
--- a/source4/torture/rpc/spoolss_notify.c
+++ b/source4/torture/rpc/spoolss_notify.c
@@ -69,7 +69,8 @@ static NTSTATUS spoolss__op_ndr_pull(struct dcesrv_call_state *dce_call, TALLOC_
 	return NT_STATUS_OK;
 }
 
-/* FIXME: What context does this belong in ? -- JRV20070903 */
+/* Note that received_packets are allocated in talloc_autofree_context(), 
+ * because no other context appears to stay around long enough. */
 static struct received_packet {
 	uint16_t opnum;
 	void *r;
@@ -82,9 +83,9 @@ static NTSTATUS spoolss__op_dispatch(struct dcesrv_call_state *dce_call, TALLOC_
 	uint16_t opnum = dce_call->pkt.u.request.opnum;
 	struct received_packet *rp;
 
-	rp = talloc_zero(mem_ctx, struct received_packet);
+	rp = talloc_zero(talloc_autofree_context(), struct received_packet);
 	rp->opnum = opnum;
-	rp->r = talloc_reference(mem_ctx, r);
+	rp->r = talloc_reference(rp, r);
 
 	DLIST_ADD_END(received_packets, rp, struct received_packet *);
 
@@ -195,6 +196,8 @@ static bool test_RFFPCNEx(struct torture_context *tctx,
 	const char *address;
 	struct interface *ifaces;
 
+	received_packets = NULL;
+
 	ntvfs_init(tctx->lp_ctx);
 
 	ZERO_STRUCT(q);
@@ -239,7 +242,6 @@ static bool test_RFFPCNEx(struct torture_context *tctx,
 	torture_assert_ntstatus_ok(tctx, status, 
 				   "unable to initialize DCE/RPC server");
 
-
 	r.in.flags = 0;
 	r.in.str = talloc_asprintf(tctx, "\\\\%s", address);
 	r.in.options = 0;
@@ -261,7 +263,6 @@ static bool test_RFFPCNEx(struct torture_context *tctx,
 	r.in.t1 = &t1;
 	r.in.handle = &handle;
 
-
 	status = dcerpc_spoolss_RemoteFindFirstPrinterChangeNotifyEx(p, tctx, &r);
 
 	torture_assert_ntstatus_ok(tctx, status, "FFPCNEx failed");
diff --git a/source4/torture/torture.pc.in b/source4/torture/torture.pc.in
new file mode 100644
index 0000000000..6582816cb5
--- /dev/null
+++ b/source4/torture/torture.pc.in
@@ -0,0 +1,12 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+modulesdir=${prefix}/modules/torture
+
+Name: torture
+Description: Samba torture (test) suite
+Requires: talloc
+Version: 0.0.1
+Libs: -L${libdir} -ltorture 
+Cflags: -I${includedir}  -DHAVE_IMMEDIATE_STRUCTURES=1
diff --git a/source4/torture/util.c b/source4/torture/util.c
deleted file mode 100644
index 0e9dda42fa..0000000000
--- a/source4/torture/util.c
+++ /dev/null
@@ -1,73 +0,0 @@
-/* 
-   Unix SMB/CIFS implementation.
-   SMB torture tester utility functions
-   Copyright (C) Jelmer Vernooij 2006
-   
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 3 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-#include "includes.h"
-#include "system/filesys.h"
-#include "system/wait.h"
-#include "torture/torture.h"
-#include "libcli/raw/interfaces.h"
-#include "libcli/raw/libcliraw.h"
-
-/**
-  check if 2 NTTIMEs are equal.
-*/
-bool nt_time_equal(NTTIME *t1, NTTIME *t2)
-{
-	return *t1 == *t2;
-}
-
-NTSTATUS torture_second_tcon(TALLOC_CTX *mem_ctx,
-			     struct smbcli_session *session,
-			     const char *sharename,
-			     struct smbcli_tree **res)
-{
-	union smb_tcon tcon;
-	struct smbcli_tree *result;
-	TALLOC_CTX *tmp_ctx;
-	NTSTATUS status;
-
-	if ((tmp_ctx = talloc_new(mem_ctx)) == NULL) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	result = smbcli_tree_init(session, tmp_ctx, false);
-	if (result == NULL) {
-		talloc_free(tmp_ctx);
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	tcon.generic.level = RAW_TCON_TCONX;
-	tcon.tconx.in.flags = 0;
-
-	/* Ignore share mode security here */
-	tcon.tconx.in.password = data_blob(NULL, 0);
-	tcon.tconx.in.path = sharename;
-	tcon.tconx.in.device = "?????";
-
-	status = smb_raw_tcon(result, tmp_ctx, &tcon);
-	if (!NT_STATUS_IS_OK(status)) {
-		talloc_free(tmp_ctx);
-		return status;
-	}
-
-	result->tid = tcon.tconx.out.tid;
-	*res = talloc_steal(mem_ctx, result);
-	talloc_free(tmp_ctx);
-	return NT_STATUS_OK;
-}
diff --git a/source4/torture/util_smb.c b/source4/torture/util_smb.c
index de7303bac8..ddf7b85c63 100644
--- a/source4/torture/util_smb.c
+++ b/source4/torture/util_smb.c
@@ -863,3 +863,42 @@ _PUBLIC_ struct torture_test *torture_suite_add_1smb_test(
 }
 
 
+NTSTATUS torture_second_tcon(TALLOC_CTX *mem_ctx,
+			     struct smbcli_session *session,
+			     const char *sharename,
+			     struct smbcli_tree **res)
+{
+	union smb_tcon tcon;
+	struct smbcli_tree *result;
+	TALLOC_CTX *tmp_ctx;
+	NTSTATUS status;
+
+	if ((tmp_ctx = talloc_new(mem_ctx)) == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	result = smbcli_tree_init(session, tmp_ctx, false);
+	if (result == NULL) {
+		talloc_free(tmp_ctx);
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	tcon.generic.level = RAW_TCON_TCONX;
+	tcon.tconx.in.flags = 0;
+
+	/* Ignore share mode security here */
+	tcon.tconx.in.password = data_blob(NULL, 0);
+	tcon.tconx.in.path = sharename;
+	tcon.tconx.in.device = "?????";
+
+	status = smb_raw_tcon(result, tmp_ctx, &tcon);
+	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(tmp_ctx);
+		return status;
+	}
+
+	result->tid = tcon.tconx.out.tid;
+	*res = talloc_steal(mem_ctx, result);
+	talloc_free(tmp_ctx);
+	return NT_STATUS_OK;
+}
diff --git a/testprogs/blackbox/test_nmblookup.sh b/source4/utils/tests/test_nmblookup.sh
index ad9b3ba799..ad9b3ba799 100755
--- a/testprogs/blackbox/test_nmblookup.sh
+++ b/source4/utils/tests/test_nmblookup.sh
diff --git a/source4/web_server/web_server.c b/source4/web_server/web_server.c
index 9ff67f78f3..ac83a3384d 100644
--- a/source4/web_server/web_server.c
+++ b/source4/web_server/web_server.c
@@ -290,20 +290,8 @@ failed:
 }
 
 
-/*
-  called on startup of the web server service It's job is to start
-  listening on all configured sockets
-*/
-static NTSTATUS websrv_init(struct event_context *event_context, 
-			    struct loadparm_context *lp_ctx,
-			    const struct model_ops *model_ops)
-{	
-	return task_server_startup(event_context, lp_ctx, 
-				   model_ops, websrv_task_init);
-}
-
 /* called at smbd startup - register ourselves as a server service */
 NTSTATUS server_service_web_init(void)
 {
-	return register_server_service("web", websrv_init);
+	return register_server_service("web", websrv_task_init);
 }
diff --git a/source4/winbind/wb_server.c b/source4/winbind/wb_server.c
index eaba6609f3..9b303f3615 100644
--- a/source4/winbind/wb_server.c
+++ b/source4/winbind/wb_server.c
@@ -202,20 +202,9 @@ nomem:
 }
 
 /*
-  initialise the winbind server
- */
-static NTSTATUS winbind_init(struct event_context *event_ctx,
-			     struct loadparm_context *lp_ctx,
-			     const struct model_ops *model_ops)
-{
-	return task_server_startup(event_ctx, lp_ctx, 
-				   model_ops, winbind_task_init);
-}
-
-/*
   register ourselves as a available server
 */
 NTSTATUS server_service_winbind_init(void)
 {
-	return register_server_service("winbind", winbind_init);
+	return register_server_service("winbind", winbind_task_init);
 }
diff --git a/source4/wrepl_server/wrepl_server.c b/source4/wrepl_server/wrepl_server.c
index 50ef7e8550..e750d9355a 100644
--- a/source4/wrepl_server/wrepl_server.c
+++ b/source4/wrepl_server/wrepl_server.c
@@ -453,6 +453,10 @@ static void wreplsrv_task_init(struct task_server *task)
 	NTSTATUS status;
 	struct wreplsrv_service *service;
 
+	if (!lp_wins_support(task->lp_ctx)) {
+		return;
+	}
+
 	task_server_set_title(task, "task[wreplsrv]");
 
 	service = talloc_zero(task, struct wreplsrv_service);
@@ -502,22 +506,9 @@ static void wreplsrv_task_init(struct task_server *task)
 }
 
 /*
-  initialise the WREPL server
- */
-static NTSTATUS wreplsrv_init(struct event_context *event_ctx, struct loadparm_context *lp_ctx, const struct model_ops *model_ops)
-{
-	if (!lp_wins_support(lp_ctx)) {
-		return NT_STATUS_OK;
-	}
-
-	return task_server_startup(event_ctx, lp_ctx, 
-				   model_ops, wreplsrv_task_init);
-}
-
-/*
   register ourselves as a available server
 */
 NTSTATUS server_service_wrepl_init(void)
 {
-	return register_server_service("wrepl", wreplsrv_init);
+	return register_server_service("wrepl", wreplsrv_task_init);
 }
diff --git a/testprogs/blackbox/test_kinit.sh b/testprogs/blackbox/test_kinit.sh
index db12fba2f8..d4eff07c8d 100755
--- a/testprogs/blackbox/test_kinit.sh
+++ b/testprogs/blackbox/test_kinit.sh
@@ -56,7 +56,7 @@ test_smbclient() {
 	return $status
 }
 
-KRB5CCNAME=`pwd`/tmpccache
+KRB5CCNAME="$PREFIX/tmpccache"
 export KRB5CCNAME
 
 echo $PASSWORD > ./tmppassfile
diff --git a/testprogs/ejs/ldap.js b/testprogs/ejs/ldap.js
index 836b726ad9..090f93b6ca 100755
--- a/testprogs/ejs/ldap.js
+++ b/testprogs/ejs/ldap.js
@@ -240,7 +240,7 @@ servicePrincipalName: host/ldaptest2computer29
 	    var attrs = new Array("servicePrincipalName;range=0-*");
 	    var res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs);
 	    if (res.error != 0 || res.msgs.length != 1) {
-		    println("Could not find (cn=ldaptest2computer)");
+		    println("Could not find (cn=ldaptest2computer) for servicePrincipalName;range=0-*");
 		    assert(res.error == 0);
 		    assert(res.msgs.length == 1);
 	    }
@@ -250,7 +250,7 @@ servicePrincipalName: host/ldaptest2computer29
 	    var attrs = new Array("servicePrincipalName;range=0-19");
 	    var res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs);
 	    if (res.error != 0 || res.msgs.length != 1) {
-		    println("Could not find (cn=ldaptest2computer)");
+		    println("Could not find (cn=ldaptest2computer) for servicePrincipalName;range=0-19");
 		    assert(res.error == 0);
 		    assert(res.msgs.length == 1);
 	    }
@@ -260,7 +260,7 @@ servicePrincipalName: host/ldaptest2computer29
 	    var attrs = new Array("servicePrincipalName;range=0-30");
 	    var res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs);
 	    if (res.error != 0 || res.msgs.length != 1) {
-		    println("Could not find (cn=ldaptest2computer)");
+		    println("Could not find (cn=ldaptest2computer) at servicePrincipalName;range=0-19");
 		    assert(res.error == 0);
 		    assert(res.msgs.length == 1);
 	    }
@@ -269,7 +269,7 @@ servicePrincipalName: host/ldaptest2computer29
 	    var attrs = new Array("servicePrincipalName;range=0-40");
 	    var res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs);
 	    if (res.error != 0 || res.msgs.length != 1) {
-		    println("Could not find (cn=ldaptest2computer)");
+		    println("Could not find (cn=ldaptest2computer) at servicePrincipalName;range=0-40");
 		    assert(res.error == 0);
 		    assert(res.msgs.length == 1);
 	    }
@@ -278,7 +278,7 @@ servicePrincipalName: host/ldaptest2computer29
 	    var attrs = new Array("servicePrincipalName;range=30-40");
 	    var res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs);
 	    if (res.error != 0 || res.msgs.length != 1) {
-		    println("Could not find (cn=ldaptest2computer)");
+		    println("Could not find (cn=ldaptest2computer) at servicePrincipalName;range=30-40");
 		    assert(res.error == 0);
 		    assert(res.msgs.length == 1);
 	    }
@@ -287,7 +287,7 @@ servicePrincipalName: host/ldaptest2computer29
 	    var attrs = new Array("servicePrincipalName;range=10-40");
 	    var res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs);
 	    if (res.error != 0 || res.msgs.length != 1) {
-		    println("Could not find (cn=ldaptest2computer)");
+		    println("Could not find (cn=ldaptest2computer) at servicePrincipalName;range=10-40");
 		    assert(res.error == 0);
 		    assert(res.msgs.length == 1);
 	    }
@@ -297,7 +297,7 @@ servicePrincipalName: host/ldaptest2computer29
 	    var attrs = new Array("servicePrincipalName;range=11-40");
 	    var res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs);
 	    if (res.error != 0 || res.msgs.length != 1) {
-		    println("Could not find (cn=ldaptest2computer)");
+		    println("Could not find (cn=ldaptest2computer) at servicePrincipalName;range=10-*");
 		    assert(res.error == 0);
 		    assert(res.msgs.length == 1);
 	    }
@@ -309,7 +309,7 @@ servicePrincipalName: host/ldaptest2computer29
 	    var attrs = new Array("servicePrincipalName;range=11-15");
 	    var res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs);
 	    if (res.error != 0 || res.msgs.length != 1) {
-		    println("Could not find (cn=ldaptest2computer)");
+		    println("Could not find (cn=ldaptest2computer) at servicePrincipalName;range=11-15");
 		    assert(res.error == 0);
 		    assert(res.msgs.length == 1);
 	    }
@@ -319,7 +319,7 @@ servicePrincipalName: host/ldaptest2computer29
 	    var attrs = new Array("servicePrincipalName");
 	    var res = ldb.search("(cn=ldaptest2computer))", base_dn, ldb.SCOPE_SUBTREE, attrs);
 	    if (res.error != 0 || res.msgs.length != 1) {
-		    println("Could not find (cn=ldaptest2computer)");
+		    println("Could not find (cn=ldaptest2computer) at servicePrincipalName");
 		    assert(res.error == 0);
 		    assert(res.msgs.length == 1);
 	    }
diff --git a/testprogs/ejs/minschema_classes.txt b/testprogs/ejs/minschema_classes.txt
index 0479438fa5..30f5b8ce96 100644
--- a/testprogs/ejs/minschema_classes.txt
+++ b/testprogs/ejs/minschema_classes.txt
@@ -34,3 +34,8 @@ attributeSchema
 subSchema
 queryPolicy
 groupPolicyContainer
+ipsecPolicy
+ipsecISAKMPPolicy
+ipsecNFA
+ipsecFilter
+ipsecNegotiationPolicy
diff --git a/testprogs/win32/midltests/midltests.acf b/testprogs/win32/midltests/midltests.acf
new file mode 100644
index 0000000000..a04bb5dcd9
--- /dev/null
+++ b/testprogs/win32/midltests/midltests.acf
@@ -0,0 +1,6 @@
+[
+        implicit_handle (handle_t midltests_IfHandle)
+]
+interface midltests
+{
+}
diff --git a/testprogs/win32/midltests/midltests.c b/testprogs/win32/midltests/midltests.c
new file mode 100644
index 0000000000..61d4ce0812
--- /dev/null
+++ b/testprogs/win32/midltests/midltests.c
@@ -0,0 +1,42 @@
+/*
+   MIDLTESTS client.
+
+   Copyright (C) Stefan Metzmacher 2008
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include "midltests.h"
+
+#define MIDLTESTS_C_CODE 1
+#include "midltests.idl"
+
+int main(int argc, char **argv)
+{
+	int ret;
+
+	midltests_IfHandle = NULL;
+
+	RpcTryExcept {
+		midltests();
+	} RpcExcept(1) {
+		ret = RpcExceptionCode();
+		printf("Runtime error 0x%x\n", ret);
+	} RpcEndExcept
+
+	return ret;
+}
diff --git a/testprogs/win32/midltests/midltests.idl b/testprogs/win32/midltests/midltests.idl
new file mode 100644
index 0000000000..1932549c56
--- /dev/null
+++ b/testprogs/win32/midltests/midltests.idl
@@ -0,0 +1,27 @@
+#ifndef MIDLTESTS_C_CODE
+
+[
+  uuid("225b9fcb-eb3d-497b-8b0b-591f049a2507"),
+  pointer_default(unique)
+]
+interface midltests
+{
+	long midltests_fn(
+	);
+}
+
+#elif MIDLTESTS_C_CODE
+
+static void midltests(void)
+{
+	cli_midltests_fn();
+}
+
+long srv_midltests_fn(void)
+{
+	printf("srv_midltests_fn: Start\n");
+	printf("srv_midltests_fn: End\n");
+	return 0x65757254;
+}
+
+#endif
\ No newline at end of file
diff --git a/testprogs/win32/midltests/midltests_c_m.c b/testprogs/win32/midltests/midltests_c_m.c
new file mode 100644
index 0000000000..facf735304
--- /dev/null
+++ b/testprogs/win32/midltests/midltests_c_m.c
@@ -0,0 +1,2 @@
+#include "midltests_marshall.h"
+#include "midltests_c.c"
diff --git a/testprogs/win32/midltests/midltests_marshall.c b/testprogs/win32/midltests/midltests_marshall.c
new file mode 100644
index 0000000000..e772afd03d
--- /dev/null
+++ b/testprogs/win32/midltests/midltests_marshall.c
@@ -0,0 +1,121 @@
+/*
+   MIDLTESTS client.
+
+   Copyright (C) Stefan Metzmacher 2008
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include "midltests.h"
+
+#define MIN(a,b) ((a)<(b)?(a):(b))
+static void print_asc(const unsigned char *buf,int len)
+{
+        int i;
+        for (i=0;i<len;i++)
+                printf("%c", isprint(buf[i])?buf[i]:'.');
+}
+
+static void dump_data(const unsigned char *buf1,int len)
+{
+        const unsigned char *buf = (const unsigned char *)buf1;
+        int i=0;
+        if (len<=0) return;
+
+        printf("[%03X] ",i);
+        for (i=0;i<len;) {
+                printf("%02X ",(int)buf[i]);
+                i++;
+                if (i%8 == 0) printf(" ");
+                if (i%16 == 0) {
+                        print_asc(&buf[i-16],8); printf(" ");
+                        print_asc(&buf[i-8],8); printf("\n");
+                        if (i<len) printf("[%03X] ",i);
+                }
+        }
+        if (i%16) {
+                int n;
+                n = 16 - (i%16);
+                printf(" ");
+                if (n>8) printf(" ");
+                while (n--) printf("   ");
+                n = MIN(8,i%16);
+                print_asc(&buf[i-(i%16)],n); printf( " " );
+                n = (i%16) - n;
+                if (n>0) print_asc(&buf[i-n],n);
+                printf("\n");
+        }
+}
+
+void NdrGetBufferMarshall(PMIDL_STUB_MESSAGE stubmsg, unsigned long len, RPC_BINDING_HANDLE hnd)
+{
+	stubmsg->RpcMsg->Buffer = HeapAlloc(GetProcessHeap(), 0, len);
+	memset(stubmsg->RpcMsg->Buffer, 0xef, len);
+	stubmsg->RpcMsg->BufferLength = len;
+	stubmsg->Buffer = stubmsg->RpcMsg->Buffer;
+	stubmsg->BufferLength = stubmsg->RpcMsg->BufferLength;
+	stubmsg->fBufferValid = TRUE;
+}
+
+void __RPC_STUB midltests_midltests_fn(PRPC_MESSAGE _pRpcMessage);
+
+void NdrSendReceiveMarshall(PMIDL_STUB_MESSAGE StubMsg, unsigned char *buffer)
+{
+	unsigned long DataRepresentation;
+
+	StubMsg->RpcMsg->BufferLength = buffer - (unsigned char *)StubMsg->RpcMsg->Buffer;
+
+	printf("[in] Buffer[%d/%d]\n",
+		StubMsg->RpcMsg->BufferLength, StubMsg->BufferLength);
+	dump_data(StubMsg->RpcMsg->Buffer, StubMsg->RpcMsg->BufferLength);
+
+	DataRepresentation = StubMsg->RpcMsg->DataRepresentation;
+	StubMsg->RpcMsg->DataRepresentation = NDR_LOCAL_DATA_REPRESENTATION;
+	midltests_midltests_fn(StubMsg->RpcMsg);
+	StubMsg->RpcMsg->DataRepresentation = DataRepresentation;
+
+	StubMsg->BufferLength = StubMsg->RpcMsg->BufferLength;
+	StubMsg->BufferStart = StubMsg->RpcMsg->Buffer;
+	StubMsg->BufferEnd = StubMsg->BufferStart + StubMsg->BufferLength;
+	StubMsg->Buffer = StubMsg->BufferStart;
+
+	printf("[out] Buffer[%d]\n",
+		StubMsg->RpcMsg->BufferLength);
+	dump_data(StubMsg->RpcMsg->Buffer, StubMsg->RpcMsg->BufferLength);
+}
+
+void NdrServerInitializeNewMarshall(PRPC_MESSAGE pRpcMsg,
+				    PMIDL_STUB_MESSAGE pStubMsg,
+				    PMIDL_STUB_DESC pStubDesc)
+{
+	memset(pStubMsg, 0, sizeof(*pStubMsg));
+	pStubMsg->RpcMsg = pRpcMsg;
+	pStubMsg->Buffer = pStubMsg->BufferStart = pRpcMsg->Buffer;
+	pStubMsg->BufferEnd = pStubMsg->Buffer + pRpcMsg->BufferLength;
+	pStubMsg->BufferLength = pRpcMsg->BufferLength;
+	pStubMsg->pfnAllocate = pStubDesc->pfnAllocate;
+	pStubMsg->pfnFree = pStubDesc->pfnFree;
+	pStubMsg->StubDesc = pStubDesc;
+	pStubMsg->dwDestContext = MSHCTX_DIFFERENTMACHINE;
+}
+
+RPC_STATUS WINAPI I_RpcGetBufferMarshall(PRPC_MESSAGE RpcMsg)
+{
+	RpcMsg->Buffer = HeapAlloc(GetProcessHeap(), 0, RpcMsg->BufferLength);
+	memset(RpcMsg->Buffer, 0xcd, RpcMsg->BufferLength);
+	return 0;
+}
diff --git a/testprogs/win32/midltests/midltests_marshall.h b/testprogs/win32/midltests/midltests_marshall.h
new file mode 100644
index 0000000000..0c6aed2721
--- /dev/null
+++ b/testprogs/win32/midltests/midltests_marshall.h
@@ -0,0 +1,16 @@
+#include "rpc.h"
+#include "rpcndr.h"
+#define NdrSendReceive NdrSendReceiveMarshall
+void NdrSendReceiveMarshall(PMIDL_STUB_MESSAGE stubmsg, unsigned char *buffer);
+#define NdrGetBuffer NdrGetBufferMarshall
+void NdrGetBufferMarshall(PMIDL_STUB_MESSAGE stubmsg, unsigned long len, RPC_BINDING_HANDLE hnd);
+#define NdrServerInitializeNew NdrServerInitializeNewMarshall
+void NdrServerInitializeNewMarshall(PRPC_MESSAGE pRpcMsg,
+				    PMIDL_STUB_MESSAGE pStubMsg,
+				    PMIDL_STUB_DESC pStubDesc);
+#define I_RpcGetBuffer I_RpcGetBufferMarshall
+RPC_STATUS WINAPI I_RpcGetBufferMarshall(PRPC_MESSAGE pMsg);
+
+
+
+
diff --git a/testprogs/win32/midltests/midltests_s_m.c b/testprogs/win32/midltests/midltests_s_m.c
new file mode 100644
index 0000000000..7e0862dc69
--- /dev/null
+++ b/testprogs/win32/midltests/midltests_s_m.c
@@ -0,0 +1,2 @@
+#include "midltests_marshall.h"
+#include "midltests_s.c"
diff --git a/testprogs/win32/midltests/utils.c b/testprogs/win32/midltests/utils.c
new file mode 100644
index 0000000000..8c4833ddb4
--- /dev/null
+++ b/testprogs/win32/midltests/utils.c
@@ -0,0 +1,32 @@
+/*
+   MIDLTESTS utility functions.
+
+   Copyright (C) Tim Potter 2003
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "midltests.h"
+
+/* MIDL allocate and free functions */
+
+void __RPC_FAR *__RPC_USER midl_user_allocate(size_t len)
+{
+		return(malloc(len));
+}
+
+void __RPC_USER midl_user_free(void __RPC_FAR *ptr)
+{
+	free(ptr);
+}