Replace sid_string_static by sid_string_dbg in DEBUGs

(This used to be commit bb35e794ec129805e874ceba882bcc1e84791a09)

54 files changed, 330 insertions, 349 deletions

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index 0d4caecb2d..1e33869ea9 100644
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -669,7 +669,7 @@ NTSTATUS create_local_token(auth_serversupplied_info *server_info)
 
 		if (!sid_to_gid(sid, &gid)) {
 			DEBUG(10, ("Could not convert SID %s to gid, "
-				   "ignoring it\n", sid_string_static(sid)));
+				   "ignoring it\n", sid_string_dbg(sid)));
 			continue;
 		}
 		add_gid_to_array_unique(server_info, gid, &server_info->groups,
@@ -740,7 +740,7 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
 
 	if (!sid_to_uid(&user_sid, uid)) {
 		DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
-			  username, sid_string_static(&user_sid)));
+			  username, sid_string_dbg(&user_sid)));
 		goto done;
 	}
 
@@ -762,7 +762,7 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
 
 		if (!ret) {
 			DEBUG(1, ("pdb_getsampwsid(%s) for user %s failed\n",
-				  sid_string_static(&user_sid), username));
+				  sid_string_dbg(&user_sid), username));
 			DEBUGADD(1, ("Fall back to unix user %s\n", username));
 			goto unix_user;
 		}
@@ -864,7 +864,7 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
 
 		if (!sid_to_gid(&group_sids[0], gid)) {
 			DEBUG(1, ("sid_to_gid(%s) failed\n",
-				  sid_string_static(&group_sids[0])));
+				  sid_string_dbg(&group_sids[0])));
 			goto done;
 		}
 
diff --git a/source3/auth/token_util.c b/source3/auth/token_util.c
index 330acde6e4..2415a90b02 100644
--- a/source3/auth/token_util.c
+++ b/source3/auth/token_util.c
@@ -280,7 +280,8 @@ struct nt_user_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
 	NTSTATUS status;
 	gid_t gid;
 
-	DEBUG(10, ("Create local NT token for %s\n", sid_string_static(user_sid)));
+	DEBUG(10, ("Create local NT token for %s\n",
+		   sid_string_dbg(user_sid)));
 
 	if (!(result = TALLOC_ZERO_P(mem_ctx, NT_USER_TOKEN))) {
 		DEBUG(0, ("talloc failed\n"));
@@ -434,13 +435,13 @@ void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token)
 	
 	DEBUGC(dbg_class, dbg_lev,
 	       ("NT user token of user %s\n",
-		sid_string_static(&token->user_sids[0]) ));
+		sid_string_dbg(&token->user_sids[0]) ));
 	DEBUGADDC(dbg_class, dbg_lev,
 		  ("contains %lu SIDs\n", (unsigned long)token->num_sids));
 	for (i = 0; i < token->num_sids; i++)
 		DEBUGADDC(dbg_class, dbg_lev,
 			  ("SID[%3lu]: %s\n", (unsigned long)i, 
-			   sid_string_static(&token->user_sids[i])));
+			   sid_string_dbg(&token->user_sids[i])));
 
 	dump_se_priv( dbg_class, dbg_lev, &token->privileges );
 }
diff --git a/source3/groupdb/mapping.c b/source3/groupdb/mapping.c
index 78643da64e..3a3da0a128 100644
--- a/source3/groupdb/mapping.c
+++ b/source3/groupdb/mapping.c
@@ -538,7 +538,7 @@ NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
 	if ((map.sid_name_use != SID_NAME_ALIAS) &&
 	    (map.sid_name_use != SID_NAME_WKN_GRP)) {
 		DEBUG(2, ("%s is a %s, expected an alias\n",
-			  sid_string_static(sid),
+			  sid_string_dbg(sid),
 			  sid_type_lookup(map.sid_name_use)));
 		return NT_STATUS_NO_SUCH_ALIAS;
 	}
diff --git a/source3/groupdb/mapping_tdb.c b/source3/groupdb/mapping_tdb.c
index fa6e93cf9d..3e0ea61e9f 100644
--- a/source3/groupdb/mapping_tdb.c
+++ b/source3/groupdb/mapping_tdb.c
@@ -350,8 +350,9 @@ static bool enum_group_mapping(const DOM_SID *domsid, enum lsa_SidType sid_name_
 		/* Only check the domain if we were given one */
 
 		if ( domsid && !sid_equal( domsid, &grpsid ) ) {
-			DEBUG(11,("enum_group_mapping: group %s is not in domain %s\n", 
-				string_sid, sid_string_static(domsid)));
+			DEBUG(11,("enum_group_mapping: group %s is not in "
+				  "domain %s\n", string_sid,
+				  sid_string_dbg(domsid)));
 			continue;
 		}
 
diff --git a/source3/lib/afs.c b/source3/lib/afs.c
index a815c21907..a7d6f6c9f7 100644
--- a/source3/lib/afs.c
+++ b/source3/lib/afs.c
@@ -242,7 +242,7 @@ bool afs_login(connection_struct *conn)
 	afs_username = talloc_string_sub(talloc_tos(),
 					afs_username,
 					"%s",
-					sid_string_static(user_sid));
+					sid_string_tos(user_sid));
 	if (!afs_username) {
 		return false;
 	}
diff --git a/source3/lib/privileges.c b/source3/lib/privileges.c
index 839ce91a57..3e2c756849 100644
--- a/source3/lib/privileges.c
+++ b/source3/lib/privileges.c
@@ -59,8 +59,8 @@ static bool get_privileges( const DOM_SID *sid, SE_PRIV *mask )
 	data = tdb_fetch_bystring( tdb, keystr );
 	
 	if ( !data.dptr ) {
-		DEBUG(3,("get_privileges: No privileges assigned to SID [%s]\n",
-			sid_string_static(sid)));
+		DEBUG(3, ("get_privileges: No privileges assigned to SID "
+			  "[%s]\n", sid_string_dbg(sid)));
 		return False;
 	}
 	
@@ -123,8 +123,8 @@ bool get_privileges_for_sids(SE_PRIV *privileges, DOM_SID *slist, int scount)
 		if ( !get_privileges( &slist[i], &mask ) )
 			continue;
 
-		DEBUG(5,("get_privileges_for_sids: sid = %s\nPrivilege set:\n", 
-			sid_string_static(&slist[i])));
+		DEBUG(5,("get_privileges_for_sids: sid = %s\nPrivilege "
+			 "set:\n", sid_string_dbg(&slist[i])));
 		dump_se_priv( DBGC_ALL, 5, &mask );
 			
 		se_priv_add( privileges, &mask );
@@ -266,7 +266,7 @@ bool grant_privilege(const DOM_SID *sid, const SE_PRIV *priv_mask)
 
 	se_priv_add( &new_mask, priv_mask );
 
-	DEBUG(10,("grant_privilege: %s\n", sid_string_static(sid)));
+	DEBUG(10,("grant_privilege: %s\n", sid_string_dbg(sid)));
 	
 	DEBUGADD( 10, ("original privilege mask:\n"));
 	dump_se_priv( DBGC_ALL, 10, &old_mask );
@@ -307,7 +307,7 @@ bool revoke_privilege(const DOM_SID *sid, const SE_PRIV *priv_mask)
 	if ( !get_privileges( sid, &mask ) )
 		return True;
 	
-	DEBUG(10,("revoke_privilege: %s\n", sid_string_static(sid)));
+	DEBUG(10,("revoke_privilege: %s\n", sid_string_dbg(sid)));
 	
 	DEBUGADD( 10, ("original privilege mask:\n"));
 	dump_se_priv( DBGC_ALL, 10, &mask );
diff --git a/source3/lib/secdesc.c b/source3/lib/secdesc.c
index db299c4fe7..4a9785009b 100644
--- a/source3/lib/secdesc.c
+++ b/source3/lib/secdesc.c
@@ -93,24 +93,16 @@ bool sec_desc_equal(SEC_DESC *s1, SEC_DESC *s2)
 	/* Check owner and group */
 
 	if (!sid_equal(s1->owner_sid, s2->owner_sid)) {
-		fstring str1, str2;
-
-		sid_to_string(str1, s1->owner_sid);
-		sid_to_string(str2, s2->owner_sid);
-
 		DEBUG(10, ("sec_desc_equal(): owner differs (%s != %s)\n",
-			   str1, str2));
+			   sid_string_dbg(s1->owner_sid),
+			   sid_string_dbg(s2->owner_sid)));
 		return False;
 	}
 
 	if (!sid_equal(s1->group_sid, s2->group_sid)) {
-		fstring str1, str2;
-
-		sid_to_string(str1, s1->group_sid);
-		sid_to_string(str2, s2->group_sid);
-
 		DEBUG(10, ("sec_desc_equal(): group differs (%s != %s)\n",
-			   str1, str2));
+			   sid_string_dbg(s1->group_sid),
+			   sid_string_dbg(s2->group_sid)));
 		return False;
 	}
 
@@ -491,7 +483,6 @@ SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr,
 		SEC_ACE *new_ace = &new_ace_list[new_ace_list_ndx];
 		uint8 new_flags = 0;
 		bool inherit = False;
-		fstring sid_str;
 
 		/* The OBJECT_INHERIT_ACE flag causes the ACE to be
 		   inherited by non-container children objects.  Container
@@ -547,12 +538,12 @@ SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr,
 		init_sec_ace(new_ace, &ace->trustee, ace->type,
 			     new_ace->access_mask, new_flags);
 
-		sid_to_string(sid_str, &ace->trustee);
-
 		DEBUG(5, ("se_create_child_secdesc(): %s:%d/0x%02x/0x%08x "
-			  " inherited as %s:%d/0x%02x/0x%08x\n", sid_str,
+			  " inherited as %s:%d/0x%02x/0x%08x\n",
+			  sid_string_dbg(&ace->trustee),
 			  ace->type, ace->flags, ace->access_mask,
-			  sid_str, new_ace->type, new_ace->flags,
+			  sid_string_dbg(&ace->trustee),
+			  new_ace->type, new_ace->flags,
 			  new_ace->access_mask));
 
 		new_ace_list_ndx++;
diff --git a/source3/lib/util_seaccess.c b/source3/lib/util_seaccess.c
index ad05300079..0481eea5f0 100644
--- a/source3/lib/util_seaccess.c
+++ b/source3/lib/util_seaccess.c
@@ -215,7 +215,6 @@ bool se_access_check(const SEC_DESC *sd, const NT_USER_TOKEN *token,
 {
 	size_t i;
 	SEC_ACL *the_acl;
-	fstring sid_str;
 	uint32 tmp_acc_desired = acc_desired;
 
 	if (!status || !acc_granted)
@@ -227,9 +226,10 @@ bool se_access_check(const SEC_DESC *sd, const NT_USER_TOKEN *token,
 	*status = NT_STATUS_OK;
 	*acc_granted = 0;
 
-	DEBUG(10,("se_access_check: requested access 0x%08x, for NT token with %u entries and first sid %s.\n",
-		 (unsigned int)acc_desired, (unsigned int)token->num_sids,
-		sid_to_string(sid_str, &token->user_sids[0])));
+	DEBUG(10,("se_access_check: requested access 0x%08x, for NT token "
+		  "with %u entries and first sid %s.\n",
+		  (unsigned int)acc_desired, (unsigned int)token->num_sids,
+		  sid_string_dbg(&token->user_sids[0])));
 
 	/*
 	 * No security descriptor or security descriptor with no DACL
@@ -247,11 +247,13 @@ bool se_access_check(const SEC_DESC *sd, const NT_USER_TOKEN *token,
 
 	/* The user sid is the first in the token */
 	if (DEBUGLVL(3)) {
-		DEBUG(3, ("se_access_check: user sid is %s\n", sid_to_string(sid_str, &token->user_sids[PRIMARY_USER_SID_INDEX]) ));
+		DEBUG(3, ("se_access_check: user sid is %s\n",
+			  sid_string_dbg(
+				  &token->user_sids[PRIMARY_USER_SID_INDEX])));
 		
 		for (i = 1; i < token->num_sids; i++) {
 			DEBUGADD(3, ("se_access_check: also %s\n",
-				  sid_to_string(sid_str, &token->user_sids[i])));
+				     sid_string_dbg(&token->user_sids[i])));
 		}
 	}
 
@@ -282,11 +284,12 @@ bool se_access_check(const SEC_DESC *sd, const NT_USER_TOKEN *token,
 	for ( i = 0 ; i < the_acl->num_aces && tmp_acc_desired != 0; i++) {
 		SEC_ACE *ace = &the_acl->aces[i];
 
-		DEBUGADD(10,("se_access_check: ACE %u: type %d, flags = 0x%02x, SID = %s mask = %x, current desired = %x\n",
-			  (unsigned int)i, ace->type, ace->flags,
-			  sid_to_string(sid_str, &ace->trustee),
-			  (unsigned int) ace->access_mask, 
-			  (unsigned int)tmp_acc_desired ));
+		DEBUGADD(10,("se_access_check: ACE %u: type %d, flags = "
+			     "0x%02x, SID = %s mask = %x, current desired "
+			     "= %x\n", (unsigned int)i, ace->type, ace->flags,
+			     sid_string_dbg(&ace->trustee),
+			     (unsigned int) ace->access_mask,
+			     (unsigned int)tmp_acc_desired ));
 
 		tmp_acc_desired = check_ace( ace, token, tmp_acc_desired, status);
 		if (NT_STATUS_V(*status)) {
diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c
index 344784aee2..e27c72dbc4 100644
--- a/source3/lib/util_sid.c
+++ b/source3/lib/util_sid.c
@@ -750,7 +750,7 @@ NTSTATUS sid_array_from_info3(TALLOC_CTX *mem_ctx,
 		if (!add_sid_to_array(mem_ctx, &info3->other_sids[i].sid,
 				      &sid_array, &num_sids)) {
 			DEBUG(3, ("could not add SID to array: %s\n",
-				  sid_string_static(&info3->other_sids[i].sid)));
+				  sid_string_dbg(&info3->other_sids[i].sid)));
 			return NT_STATUS_NO_MEMORY;
 		}
 	}
diff --git a/source3/libads/authdata.c b/source3/libads/authdata.c
index db58cf0400..500f2d455e 100644
--- a/source3/libads/authdata.c
+++ b/source3/libads/authdata.c
@@ -742,14 +742,16 @@ void dump_pac_logon_info(int lvl, PAC_LOGON_INFO *logon_info)
 		DEBUGADD(lvl,("\tUser Flags: LOGON_EXTRA_SIDS 0x%x (%d)\n", LOGON_EXTRA_SIDS, LOGON_EXTRA_SIDS));
 	if (user_flgs & LOGON_RESOURCE_GROUPS)
 		DEBUGADD(lvl,("\tUser Flags: LOGON_RESOURCE_GROUPS 0x%x (%d)\n", LOGON_RESOURCE_GROUPS, LOGON_RESOURCE_GROUPS));
-	DEBUGADD(lvl,("\tUser SID: %s-%d\n", sid_string_static(&dom_sid), logon_info->info3.user_rid));
-	DEBUGADD(lvl,("\tGroup SID: %s-%d\n", sid_string_static(&dom_sid), logon_info->info3.group_rid));
+	DEBUGADD(lvl,("\tUser SID: %s-%d\n", sid_string_dbg(&dom_sid),
+		      logon_info->info3.user_rid));
+	DEBUGADD(lvl,("\tGroup SID: %s-%d\n", sid_string_dbg(&dom_sid),
+		      logon_info->info3.group_rid));
 
 	DEBUGADD(lvl,("\tGroup Membership (Global and Universal Groups of own domain):\n"));
 	for (i = 0; i < logon_info->info3.num_groups; i++) {
 		attr_string = pac_group_attr_string(logon_info->info3.gids[i].attr);
 		DEBUGADD(lvl,("\t\t%d: sid: %s-%d\n\t\t   attr: 0x%x == %s\n",
-			i, sid_string_static(&dom_sid), 
+			i, sid_string_dbg(&dom_sid),
 			logon_info->info3.gids[i].g_rid,
 			logon_info->info3.gids[i].attr,
 			attr_string));
@@ -760,7 +762,8 @@ void dump_pac_logon_info(int lvl, PAC_LOGON_INFO *logon_info)
 	for (i = 0; i < logon_info->info3.num_other_sids; i++) {
 		attr_string = pac_group_attr_string(logon_info->info3.other_sids_attrib[i]);
 		DEBUGADD(lvl,("\t\t%d: sid: %s\n\t\t   attr: 0x%x == %s\n",
-			i, sid_string_static(&logon_info->info3.other_sids[i].sid), 
+			i, sid_string_dbg(
+				&logon_info->info3.other_sids[i].sid),
 			logon_info->info3.other_sids_attrib[i],
 			attr_string));
 		SAFE_FREE(attr_string);
@@ -770,7 +773,7 @@ void dump_pac_logon_info(int lvl, PAC_LOGON_INFO *logon_info)
 	for (i = 0; i < logon_info->info3.res_group_count; i++) {
 		attr_string = pac_group_attr_string(logon_info->res_groups.group_membership[i].attrs);
 		DEBUGADD(lvl,("\t\t%d: sid: %s-%d\n\t\t   attr: 0x%x == %s\n",
-			i, sid_string_static(&res_group_dom_sid),
+			i, sid_string_dbg(&res_group_dom_sid),
 			logon_info->res_groups.group_membership[i].rid,
 			logon_info->res_groups.group_membership[i].attrs,
 			attr_string));
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index da4227b64c..a4532cd2ea 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -2367,8 +2367,8 @@ int ads_count_replies(ADS_STRUCT *ads, void *res)
 	for (i=0; values[i]; i++) {
 		ret = sid_parse(values[i]->bv_val, values[i]->bv_len, &(*sids)[count]);
 		if (ret) {
-			fstring sid;
-			DEBUG(10, ("pulling SID: %s\n", sid_to_string(sid, &(*sids)[count])));
+			DEBUG(10, ("pulling SID: %s\n",
+				   sid_string_dbg(&(*sids)[count])));
 			count++;
 		}
 	}
diff --git a/source3/libgpo/gpo_sec.c b/source3/libgpo/gpo_sec.c
index 72ef098fec..7f8324b994 100644
--- a/source3/libgpo/gpo_sec.c
+++ b/source3/libgpo/gpo_sec.c
@@ -100,7 +100,7 @@ static NTSTATUS gpo_sd_check_ace_denied_object(const SEC_ACE *ace,
 	    nt_token_check_sid(&ace->trustee, token)) {
 		DEBUG(10,("gpo_sd_check_ace_denied_object: "
 			"Access denied as of ace for %s\n",
-			sid_string_static(&ace->trustee)));
+			sid_string_dbg(&ace->trustee)));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -118,7 +118,7 @@ static NTSTATUS gpo_sd_check_ace_allowed_object(const SEC_ACE *ace,
 	    nt_token_check_sid(&ace->trustee, token)) {
 		DEBUG(10,("gpo_sd_check_ace_allowed_object: "
 			"Access granted as of ace for %s\n",
-			sid_string_static(&ace->trustee)));
+			sid_string_dbg(&ace->trustee)));
 		return NT_STATUS_OK;
 	}
 
diff --git a/source3/libsmb/trustdom_cache.c b/source3/libsmb/trustdom_cache.c
index be73381aa3..498a0221f2 100644
--- a/source3/libsmb/trustdom_cache.c
+++ b/source3/libsmb/trustdom_cache.c
@@ -123,7 +123,7 @@ bool trustdom_cache_store(char* name, char* alt_name, const DOM_SID *sid,
 		return False;
 
 	DEBUG(5, ("trustdom_store: storing SID %s of domain %s\n",
-	          sid_string_static(sid), name));
+	          sid_string_dbg(sid), name));
 
 	key = trustdom_cache_key(name);
 	alt_key = alt_name ? trustdom_cache_key(alt_name) : NULL;
diff --git a/source3/modules/nfs4_acls.c b/source3/modules/nfs4_acls.c
index 207c2ab537..edcc52261c 100644
--- a/source3/modules/nfs4_acls.c
+++ b/source3/modules/nfs4_acls.c
@@ -243,7 +243,7 @@ static bool smbacl4_nfs42win(TALLOC_CTX *mem_ctx, SMB4ACL_T *acl, /* in */
 			}
 		}
 		DEBUG(10, ("mapped %d to %s\n", ace->who.id,
-			sid_string_static(&sid)));
+			   sid_string_dbg(&sid)));
 
 		init_sec_access(&mask, ace->aceMask);
 		init_sec_ace(&nt_ace_list[good_aces++], &sid,
@@ -429,8 +429,7 @@ static int smbacl4_fill_ace4(
 	uid_t uid;
 	gid_t gid;
 
-	DEBUG(10, ("got ace for %s\n",
-		sid_string_static(&ace_nt->trustee)));
+	DEBUG(10, ("got ace for %s\n", sid_string_dbg(&ace_nt->trustee)));
 
 	memset(ace_v4, 0, sizeof(SMB_ACE4PROP_T));
 	ace_v4->aceType = ace_nt->type; /* only ACCESS|DENY supported right now */
@@ -452,7 +451,7 @@ static int smbacl4_fill_ace4(
 	} else {
 		if (!lookup_sid(mem_ctx, &ace_nt->trustee, &dom, &name, &type)) {
 			DEBUG(8, ("Could not find %s' type\n",
-				sid_string_static(&ace_nt->trustee)));
+				  sid_string_dbg(&ace_nt->trustee)));
 			errno = EINVAL;
 			return -1;
 		}
@@ -460,7 +459,7 @@ static int smbacl4_fill_ace4(
 		if (type == SID_NAME_USER) {
 			if (!sid_to_uid(&ace_nt->trustee, &uid)) {
 				DEBUG(2, ("Could not convert %s to uid\n",
-					sid_string_static(&ace_nt->trustee)));
+					  sid_string_dbg(&ace_nt->trustee)));
 				return -1;
 			}
 
@@ -473,7 +472,7 @@ static int smbacl4_fill_ace4(
 		} else { /* else group? - TODO check it... */
 			if (!sid_to_gid(&ace_nt->trustee, &gid)) {
 				DEBUG(2, ("Could not convert %s to gid\n",
-					sid_string_static(&ace_nt->trustee)));
+					  sid_string_dbg(&ace_nt->trustee)));
 				return -1;
 			}
 			ace_v4->aceFlags |= SMB_ACE4_IDENTIFIER_GROUP;
diff --git a/source3/modules/vfs_afsacl.c b/source3/modules/vfs_afsacl.c
index 3e57a88ed3..a923ce188f 100644
--- a/source3/modules/vfs_afsacl.c
+++ b/source3/modules/vfs_afsacl.c
@@ -726,7 +726,7 @@ static bool nt_to_afs_acl(const char *filename,
 
 		if (!mappable_sid(&ace->trustee)) {
 			DEBUG(10, ("Ignoring unmappable SID %s\n",
-				   sid_string_static(&ace->trustee)));
+				   sid_string_dbg(&ace->trustee)));
 			continue;
 		}
 
@@ -756,7 +756,8 @@ static bool nt_to_afs_acl(const char *filename,
 			if (!lookup_sid(talloc_tos(), &ace->trustee,
 					&dom_name, &name, &name_type)) {
 				DEBUG(1, ("AFSACL: Could not lookup SID %s on file %s\n",
-					  sid_string_static(&ace->trustee), filename));
+					  sid_string_dbg(&ace->trustee),
+					  filename));
 				continue;
 			}
 
@@ -778,7 +779,7 @@ static bool nt_to_afs_acl(const char *filename,
 				/* Expect all users/groups in pts as SIDs */
 				name = talloc_strdup(
 					talloc_tos(),
-					sid_string_static(&ace->trustee));
+					sid_string_tos(&ace->trustee));
 				if (name == NULL) {
 					return False;
 				}
diff --git a/source3/nsswitch/wb_client.c b/source3/nsswitch/wb_client.c
index 1fd1e025b6..b3392ed68a 100644
--- a/source3/nsswitch/wb_client.c
+++ b/source3/nsswitch/wb_client.c
@@ -106,7 +106,7 @@ bool winbind_lookup_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
 	*name_type = (enum lsa_SidType)response.data.name.type;
 
 	DEBUG(10, ("winbind_lookup_sid: SUCCESS: SID %s -> %s %s\n", 
-		   sid_string_static(sid), response.data.name.dom_name,
+		   sid_string_dbg(sid), response.data.name.dom_name,
 		   response.data.name.name));
 	return True;
 }
diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c
index bb54959e96..3096fde1ab 100644
--- a/source3/passdb/lookup_sid.c
+++ b/source3/passdb/lookup_sid.c
@@ -658,7 +658,7 @@ static bool check_dom_sid_to_level(const DOM_SID *sid, int level)
 
 	DEBUG(10, ("%s SID %s in level %d\n",
 		   ret ? "Accepting" : "Rejecting",
-		   sid_string_static(sid), level));
+		   sid_string_dbg(sid), level));
 	return ret;
 }
 
@@ -935,12 +935,10 @@ bool lookup_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
 
  done:
 	if (ret) {
-		DEBUG(10, ("Sid %s -> %s\\%s(%d)\n",
-			   sid_string_static(sid), domain->name,
-			   name->name, name->type));
+		DEBUG(10, ("Sid %s -> %s\\%s(%d)\n", sid_string_dbg(sid),
+			   domain->name, name->name, name->type));
 	} else {
-		DEBUG(10, ("failed to lookup sid %s\n",
-			   sid_string_static(sid)));
+		DEBUG(10, ("failed to lookup sid %s\n", sid_string_dbg(sid)));
 	}
 	TALLOC_FREE(tmp_ctx);
 	return ret;
@@ -988,7 +986,7 @@ static bool fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid)
 		if (pc->uid == uid) {
 			*psid = pc->sid;
 			DEBUG(3,("fetch sid from uid cache %u -> %s\n",
-				 (unsigned int)uid, sid_string_static(psid)));
+				 (unsigned int)uid, sid_string_dbg(psid)));
 			DLIST_PROMOTE(uid_sid_cache_head, pc);
 			return true;
 		}
@@ -1008,7 +1006,7 @@ static bool fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid )
 		if (sid_compare(&pc->sid, psid) == 0) {
 			*puid = pc->uid;
 			DEBUG(3,("fetch uid from cache %u -> %s\n",
-				 (unsigned int)*puid, sid_string_static(psid)));
+				 (unsigned int)*puid, sid_string_dbg(psid)));
 			DLIST_PROMOTE(uid_sid_cache_head, pc);
 			return true;
 		}
@@ -1065,7 +1063,7 @@ static bool fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid)
 		if (pc->gid == gid) {
 			*psid = pc->sid;
 			DEBUG(3,("fetch sid from gid cache %u -> %s\n",
-				 (unsigned int)gid, sid_string_static(psid)));
+				 (unsigned int)gid, sid_string_dbg(psid)));
 			DLIST_PROMOTE(gid_sid_cache_head, pc);
 			return true;
 		}
@@ -1085,7 +1083,7 @@ static bool fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
 		if (sid_compare(&pc->sid, psid) == 0) {
 			*pgid = pc->gid;
 			DEBUG(3,("fetch gid from cache %u -> %s\n",
-				 (unsigned int)*pgid, sid_string_static(psid)));
+				 (unsigned int)*pgid, sid_string_dbg(psid)));
 			DLIST_PROMOTE(gid_sid_cache_head, pc);
 			return true;
 		}
@@ -1128,8 +1126,8 @@ void store_gid_sid_cache(const DOM_SID *psid, gid_t gid)
 	sid_copy(&pc->sid, psid);
 	DLIST_ADD(gid_sid_cache_head, pc);
 
-	DEBUG(3,("store_gid_sid_cache: gid %u in cache -> %s\n", (unsigned int)gid,
-		sid_string_static(psid)));
+	DEBUG(3,("store_gid_sid_cache: gid %u in cache -> %s\n",
+		 (unsigned int)gid, sid_string_dbg(psid)));
 
 	n_gid_sid_cache++;
 }
@@ -1162,7 +1160,7 @@ static void legacy_uid_to_sid(DOM_SID *psid, uid_t uid)
 
  done:
 	DEBUG(10,("LEGACY: uid %u -> sid %s\n", (unsigned int)uid,
-		  sid_string_static(psid)));
+		  sid_string_dbg(psid)));
 
 	store_uid_sid_cache(psid, uid);
 	return;
@@ -1193,7 +1191,7 @@ static void legacy_gid_to_sid(DOM_SID *psid, gid_t gid)
 
  done:
 	DEBUG(10,("LEGACY: gid %u -> sid %s\n", (unsigned int)gid,
-		  sid_string_static(psid)));
+		  sid_string_dbg(psid)));
 
 	store_gid_sid_cache(psid, gid);
 	return;
@@ -1219,7 +1217,7 @@ static bool legacy_sid_to_uid(const DOM_SID *psid, uid_t *puid)
 		if (ret) {
 			if (type != SID_NAME_USER) {
 				DEBUG(5, ("sid %s is a %s, expected a user\n",
-					  sid_string_static(psid),
+					  sid_string_dbg(psid),
 					  sid_type_lookup(type)));
 				return false;
 			}
@@ -1230,12 +1228,13 @@ static bool legacy_sid_to_uid(const DOM_SID *psid, uid_t *puid)
 		/* This was ours, but it was not mapped.  Fail */
 	}
 
-	DEBUG(10,("LEGACY: mapping failed for sid %s\n", sid_string_static(psid)));
+	DEBUG(10,("LEGACY: mapping failed for sid %s\n",
+		  sid_string_dbg(psid)));
 	return false;
 
 done:
-	DEBUG(10,("LEGACY: sid %s -> uid %u\n", sid_string_static(psid),
-		(unsigned int)*puid ));
+	DEBUG(10,("LEGACY: sid %s -> uid %u\n", sid_string_dbg(psid),
+		  (unsigned int)*puid ));
 
 	store_uid_sid_cache(psid, *puid);
 	return true;
@@ -1265,7 +1264,8 @@ static bool legacy_sid_to_gid(const DOM_SID *psid, gid_t *pgid)
 			*pgid = map.gid;
 			goto done;
 		}
-		DEBUG(10,("LEGACY: mapping failed for sid %s\n", sid_string_static(psid)));
+		DEBUG(10,("LEGACY: mapping failed for sid %s\n",
+			  sid_string_dbg(psid)));
 		return false;
 	}
 
@@ -1279,8 +1279,8 @@ static bool legacy_sid_to_gid(const DOM_SID *psid, gid_t *pgid)
 		if (ret) {
 			if ((type != SID_NAME_DOM_GRP) &&
 			    (type != SID_NAME_ALIAS)) {
-				DEBUG(5, ("LEGACY: sid %s is a %s, expected a group\n",
-					  sid_string_static(psid),
+				DEBUG(5, ("LEGACY: sid %s is a %s, expected "
+					  "a group\n", sid_string_dbg(psid),
 					  sid_type_lookup(type)));
 				return false;
 			}
@@ -1291,11 +1291,12 @@ static bool legacy_sid_to_gid(const DOM_SID *psid, gid_t *pgid)
 		/* This was ours, but it was not mapped.  Fail */
 	}
 
-	DEBUG(10,("LEGACY: mapping failed for sid %s\n", sid_string_static(psid)));
+	DEBUG(10,("LEGACY: mapping failed for sid %s\n",
+		  sid_string_dbg(psid)));
 	return false;
 	
  done:
-	DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_static(psid),
+	DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_dbg(psid),
 		  (unsigned int)*pgid ));
 
 	store_gid_sid_cache(psid, *pgid);
@@ -1325,8 +1326,8 @@ void uid_to_sid(DOM_SID *psid, uid_t uid)
 		return;
 	}
 
-	DEBUG(10,("uid %u -> sid %s\n",
-		  (unsigned int)uid, sid_string_static(psid)));
+	DEBUG(10,("uid %u -> sid %s\n", (unsigned int)uid,
+		  sid_string_dbg(psid)));
 
 	store_uid_sid_cache(psid, uid);
 	return;
@@ -1354,8 +1355,8 @@ void gid_to_sid(DOM_SID *psid, gid_t gid)
 		return;
 	}
 
-	DEBUG(10,("gid %u -> sid %s\n",
-		  (unsigned int)gid, sid_string_static(psid)));
+	DEBUG(10,("gid %u -> sid %s\n", (unsigned int)gid,
+		  sid_string_dbg(psid)));
 	
 	store_gid_sid_cache(psid, gid);
 	return;
@@ -1384,7 +1385,7 @@ bool sid_to_uid(const DOM_SID *psid, uid_t *puid)
 		*puid = uid;
 
 		/* return here, don't cache */
-		DEBUG(10,("sid %s -> uid %u\n", sid_string_static(psid),
+		DEBUG(10,("sid %s -> uid %u\n", sid_string_dbg(psid),
 			(unsigned int)*puid ));
 		return true;
 	}
@@ -1395,14 +1396,14 @@ bool sid_to_uid(const DOM_SID *psid, uid_t *puid)
 		}
 
 		DEBUG(5, ("winbind failed to find a uid for sid %s\n",
-			  sid_string_static(psid)));
+			  sid_string_dbg(psid)));
 		return false;
 	}
 
 	/* TODO: Here would be the place to allocate both a gid and a uid for
 	 * the SID in question */
 
-	DEBUG(10,("sid %s -> uid %u\n", sid_string_static(psid),
+	DEBUG(10,("sid %s -> uid %u\n", sid_string_dbg(psid),
 		(unsigned int)*puid ));
 
 	store_uid_sid_cache(psid, *puid);
@@ -1432,7 +1433,7 @@ bool sid_to_gid(const DOM_SID *psid, gid_t *pgid)
 		*pgid = gid;
 
 		/* return here, don't cache */
-		DEBUG(10,("sid %s -> gid %u\n", sid_string_static(psid),
+		DEBUG(10,("sid %s -> gid %u\n", sid_string_dbg(psid),
 			(unsigned int)*pgid ));
 		return true;
 	}
@@ -1446,11 +1447,11 @@ bool sid_to_gid(const DOM_SID *psid, gid_t *pgid)
 		}
 
 		DEBUG(10,("winbind failed to find a gid for sid %s\n",
-					sid_string_static(psid)));
+			  sid_string_dbg(psid)));
 		return false;
 	}
 
-	DEBUG(10,("sid %s -> gid %u\n", sid_string_static(psid),
+	DEBUG(10,("sid %s -> gid %u\n", sid_string_dbg(psid),
 		  (unsigned int)*pgid ));
 
 	store_gid_sid_cache(psid, *pgid);
diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index c4248bb48e..9311b8a74e 100644
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -595,7 +595,7 @@ bool lookup_global_sam_name(const char *name, int flags, uint32_t *rid,
 		if (ret) {
 			if (!sid_check_is_in_our_domain(&user_sid)) {
 				DEBUG(0, ("User %s with invalid SID %s in passdb\n",
-					  name, sid_string_static(&user_sid)));
+					  name, sid_string_dbg(&user_sid)));
 				return False;
 			}
 
@@ -620,8 +620,7 @@ bool lookup_global_sam_name(const char *name, int flags, uint32_t *rid,
 	/* BUILTIN groups are looked up elsewhere */
 	if (!sid_check_is_in_our_domain(&map.sid)) {
 		DEBUG(10, ("Found group %s (%s) not in our domain -- "
-			   "ignoring.", name,
-			   sid_string_static(&map.sid)));
+			   "ignoring.", name, sid_string_dbg(&map.sid)));
 		return False;
 	}
 
diff --git a/source3/passdb/pdb_compat.c b/source3/passdb/pdb_compat.c
index 10fc170476..9967eb53ad 100644
--- a/source3/passdb/pdb_compat.c
+++ b/source3/passdb/pdb_compat.c
@@ -69,7 +69,7 @@ bool pdb_set_user_sid_from_rid (struct samu *sampass, uint32 rid, enum pdb_value
 		return False;
 
 	DEBUG(10, ("pdb_set_user_sid_from_rid:\n\tsetting user sid %s from rid %d\n", 
-		    sid_string_static(&u_sid),rid));
+		    sid_string_dbg(&u_sid),rid));
 
 	return True;
 }
@@ -96,7 +96,7 @@ bool pdb_set_group_sid_from_rid (struct samu *sampass, uint32 grid, enum pdb_val
 		return False;
 
 	DEBUG(10, ("pdb_set_group_sid_from_rid:\n\tsetting group sid %s from rid %d\n", 
-		    sid_string_static(&g_sid), grid));
+		    sid_string_dbg(&g_sid), grid));
 
 	return True;
 }
diff --git a/source3/passdb/pdb_get_set.c b/source3/passdb/pdb_get_set.c
index e8bea19152..3b55dd478f 100644
--- a/source3/passdb/pdb_get_set.c
+++ b/source3/passdb/pdb_get_set.c
@@ -506,7 +506,7 @@ bool pdb_set_user_sid(struct samu *sampass, const DOM_SID *u_sid, enum pdb_value
 	sid_copy(&sampass->user_sid, u_sid);
 
 	DEBUG(10, ("pdb_set_user_sid: setting user sid %s\n", 
-		    sid_string_static(&sampass->user_sid)));
+		    sid_string_dbg(&sampass->user_sid)));
 
 	return pdb_set_init_flags(sampass, PDB_USERSID, flag);
 }
@@ -564,7 +564,7 @@ bool pdb_set_group_sid(struct samu *sampass, const DOM_SID *g_sid, enum pdb_valu
 	}
 
 	DEBUG(10, ("pdb_set_group_sid: setting group sid %s\n", 
-		sid_string_static(sampass->group_sid)));
+		   sid_string_dbg(sampass->group_sid)));
 
 	return pdb_set_init_flags(sampass, PDB_GROUPSID, flag);
 }
diff --git a/source3/passdb/pdb_interface.c b/source3/passdb/pdb_interface.c
index 0159932e34..d455b7636c 100644
--- a/source3/passdb/pdb_interface.c
+++ b/source3/passdb/pdb_interface.c
@@ -1265,7 +1265,7 @@ static bool pdb_default_uid_to_rid(struct pdb_methods *methods, uid_t uid,
 
 	if (!ret) {
 		DEBUG(1, ("Could not peek rid out of sid %s\n",
-			  sid_string_static(&sid)));
+			  sid_string_dbg(&sid)));
 	}
 
 	return ret;
@@ -1332,13 +1332,13 @@ static bool pdb_default_sid_to_id(struct pdb_methods *methods,
 		GROUP_MAP map;
 		if (!NT_STATUS_IS_OK(methods->getgrsid(methods, &map, *sid))) {
 			DEBUG(10, ("Could not find map for sid %s\n",
-				   sid_string_static(sid)));
+				   sid_string_dbg(sid)));
 			goto done;
 		}
 		if ((map.sid_name_use != SID_NAME_ALIAS) &&
 		    (map.sid_name_use != SID_NAME_WKN_GRP)) {
 			DEBUG(10, ("Map for sid %s is a %s, expected an "
-				   "alias\n", sid_string_static(sid),
+				   "alias\n", sid_string_dbg(sid),
 				   sid_type_lookup(map.sid_name_use)));
 			goto done;
 		}
@@ -1350,7 +1350,7 @@ static bool pdb_default_sid_to_id(struct pdb_methods *methods,
 	}
 
 	DEBUG(5, ("Sid %s is neither ours, a Unix SID, nor builtin\n",
-		  sid_string_static(sid)));
+		  sid_string_dbg(sid)));
 
  done:
 
diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c
index 750b71fb1c..bb983a6086 100644
--- a/source3/passdb/pdb_ldap.c
+++ b/source3/passdb/pdb_ldap.c
@@ -1135,8 +1135,9 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 			case SCHEMAVER_SAMBAACCOUNT:
 				if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
 					DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n", 
-						  sid_string_static(user_sid),
-						  sid_string_static(&ldap_state->domain_sid)));
+						  sid_string_dbg(user_sid),
+						  sid_string_dbg(
+							  &ldap_state->domain_sid)));
 					return False;
 				}
 				if (asprintf(&temp, "%i", rid) < 0) {
@@ -1171,8 +1172,9 @@ static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
 			case SCHEMAVER_SAMBAACCOUNT:
 				if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
 					DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
-						  sid_string_static(group_sid),
-						  sid_string_static(&ldap_state->domain_sid)));
+						  sid_string_dbg(group_sid),
+						  sid_string_dbg(
+							  &ldap_state->domain_sid)));
 					return False;
 				}
 
@@ -1696,7 +1698,6 @@ static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, struct samu
 	LDAPMessage *entry = NULL;
 	int count;
 	int rc;
-	fstring sid_string;
 
 	rc = ldapsam_get_ldap_user_by_sid(ldap_state, 
 					  sid, &result); 
@@ -1706,13 +1707,14 @@ static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, struct samu
 	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
 	
 	if (count < 1) {
-		DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid),
-		       count));
+		DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] "
+			  "count=%d\n", sid_string_dbg(sid), count));
 		ldap_msgfree(result);
 		return NT_STATUS_NO_SUCH_USER;
 	}  else if (count > 1) {
-		DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid),
-		       count));
+		DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID "
+			  "[%s]. Failing. count=%d\n", sid_string_dbg(sid),
+			  count));
 		ldap_msgfree(result);
 		return NT_STATUS_NO_SUCH_USER;
 	}
@@ -2148,7 +2150,6 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, struct s
 	const DOM_SID 	*sid = pdb_get_user_sid(newpwd);
 	char *filter = NULL;
 	char *dn = NULL;
-	fstring         sid_string;
 	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 	TALLOC_CTX *ctx = talloc_init("ldapsam_add_sam_account");
 
@@ -2184,8 +2185,9 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, struct s
 						  sid, &result);
 		if (rc == LDAP_SUCCESS) {
 			if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
-				DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n", 
-					 sid_to_string(sid_string, sid)));
+				DEBUG(0,("ldapsam_add_sam_account: SID '%s' "
+					 "already in the base, with samba "
+					 "attributes\n", sid_string_dbg(sid)));
 				goto fn_exit;
 			}
 			ldap_msgfree(result);
@@ -2659,7 +2661,7 @@ static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
 
 	if (sid_compare_domain(&sid, domain_sid) != 0) {
 		DEBUG(10, ("SID %s is not in expected domain %s\n",
-			   str, sid_string_static(domain_sid)));
+			   str, sid_string_dbg(domain_sid)));
 		return False;
 	}
 
@@ -2719,7 +2721,7 @@ static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
 
 	if (count > 1) {
 		DEBUG(1, ("Found more than one groupmap entry for %s\n",
-			  sid_string_static(group)));
+			  sid_string_dbg(group)));
 		ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
 		goto done;
 	}
@@ -3138,8 +3140,7 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
 	    (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) > 0)) {
 
 		DEBUG(3, ("SID %s already present in LDAP, refusing to add "
-			  "group mapping entry\n",
-			  sid_string_static(&map->sid)));
+			  "group mapping entry\n", sid_string_dbg(&map->sid)));
 		result = NT_STATUS_GROUP_EXISTS;
 		goto done;
 	}
@@ -3158,7 +3159,7 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
 			&& !sid_check_is_in_builtin(&map->sid) ) 
 		{
 			DEBUG(3, ("Refusing to map sid %s as an alias, not in our domain\n",
-				  sid_string_static(&map->sid)));
+				  sid_string_dbg(&map->sid)));
 			result = NT_STATUS_INVALID_PARAMETER;
 			goto done;
 		}
@@ -3182,7 +3183,7 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
 
 	if (pdb_gid_to_sid(map->gid, &sid)) {
 		DEBUG(3, ("Gid %d is already mapped to SID %s, refusing to "
-			  "add\n", map->gid, sid_string_static(&sid)));
+			  "add\n", map->gid, sid_string_dbg(&sid)));
 		result = NT_STATUS_GROUP_EXISTS;
 		goto done;
 	}
@@ -3557,7 +3558,7 @@ static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
 
 	if (type == SID_NAME_USE_NONE) {
 		DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
-			  sid_string_static(alias)));
+			  sid_string_dbg(alias)));
 		return NT_STATUS_NO_SUCH_ALIAS;
 	}
 
@@ -3678,7 +3679,7 @@ static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
 
 	if (type == SID_NAME_USE_NONE) {
 		DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
-			  sid_string_static(alias)));
+			  sid_string_dbg(alias)));
 		return NT_STATUS_NO_SUCH_ALIAS;
 	}
 
@@ -3786,7 +3787,7 @@ static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
 
 	if (type == SID_NAME_USE_NONE) {
 		DEBUG(5, ("SID %s is neither builtin nor domain!\n",
-			  sid_string_static(domain_sid)));
+			  sid_string_dbg(domain_sid)));
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
@@ -4548,7 +4549,7 @@ static bool ldapuser2displayentry(struct ldap_search_state *state,
 
 	if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)) {
 		DEBUG(0, ("sid %s does not belong to our domain\n",
-			  sid_string_static(&sid)));
+			  sid_string_dbg(&sid)));
 		return False;
 	}
 
@@ -4701,7 +4702,7 @@ static bool ldapgroup2displayentry(struct ldap_search_state *state,
 				&& !sid_peek_check_rid(&global_sid_Builtin, &sid, &result->rid)) 
 			{
 				DEBUG(0, ("%s is not in our domain\n",
-					  sid_string_static(&sid)));
+					  sid_string_dbg(&sid)));
 				return False;
 			}
 			break;
@@ -6367,21 +6368,17 @@ NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
 						     &secrets_domain_sid);
 		if (!found_sid || !sid_equal(&secrets_domain_sid,
 					     &ldap_domain_sid)) {
-			fstring new_sid_str, old_sid_str;
 			DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain "
 				  "%s based on pdb_ldap results %s -> %s\n",
 				  ldap_state->domain_name,
-				  sid_to_string(old_sid_str,
-						&secrets_domain_sid),
-				  sid_to_string(new_sid_str,
-						&ldap_domain_sid)));
+				  sid_string_dbg(&secrets_domain_sid),
+				  sid_string_dbg(&ldap_domain_sid)));
 
 			/* reset secrets.tdb sid */
 			secrets_store_domain_sid(ldap_state->domain_name,
 						 &ldap_domain_sid);
 			DEBUG(1, ("New global sam SID: %s\n",
-				  sid_to_string(new_sid_str,
-						get_global_sam_sid())));
+				  sid_string_dbg(get_global_sam_sid())));
 		}
 		sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
 		TALLOC_FREE(domain_sid_string);
diff --git a/source3/passdb/pdb_smbpasswd.c b/source3/passdb/pdb_smbpasswd.c
index 139aa14155..6a3bdb80a2 100644
--- a/source3/passdb/pdb_smbpasswd.c
+++ b/source3/passdb/pdb_smbpasswd.c
@@ -1394,10 +1394,10 @@ static NTSTATUS smbpasswd_getsampwsid(struct pdb_methods *my_methods, struct sam
 	struct smbpasswd_privates *smbpasswd_state = (struct smbpasswd_privates*)my_methods->private_data;
 	struct smb_passwd *smb_pw;
 	FILE *fp = NULL;
-	fstring sid_str;
 	uint32 rid;
 	
-	DEBUG(10, ("smbpasswd_getsampwrid: search by sid: %s\n", sid_to_string(sid_str, sid)));
+	DEBUG(10, ("smbpasswd_getsampwrid: search by sid: %s\n",
+		   sid_string_dbg(sid)));
 
 	if (!sid_peek_check_rid(get_global_sam_sid(), sid, &rid))
 		return NT_STATUS_UNSUCCESSFUL;
@@ -1443,9 +1443,10 @@ static NTSTATUS smbpasswd_getsampwsid(struct pdb_methods *my_methods, struct sam
 
 	/* build_sam_account might change the SID on us, if the name was for the guest account */
 	if (NT_STATUS_IS_OK(nt_status) && !sid_equal(pdb_get_user_sid(sam_acct), sid)) {
-		fstring sid_string1, sid_string2;
-		DEBUG(1, ("looking for user with sid %s instead returned %s for account %s!?!\n",
-			  sid_to_string(sid_string1, sid), sid_to_string(sid_string2, pdb_get_user_sid(sam_acct)), pdb_get_username(sam_acct)));
+		DEBUG(1, ("looking for user with sid %s instead returned %s "
+			  "for account %s!?!\n", sid_string_dbg(sid),
+			  sid_string_dbg(pdb_get_user_sid(sam_acct)),
+			  pdb_get_username(sam_acct)));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
diff --git a/source3/passdb/secrets.c b/source3/passdb/secrets.c
index fde7fc0968..0ea3887378 100644
--- a/source3/passdb/secrets.c
+++ b/source3/passdb/secrets.c
@@ -891,7 +891,7 @@ NTSTATUS secrets_trusted_domains(TALLOC_CTX *mem_ctx, uint32 *num_domains,
 		if (pass.domain_sid.num_auths != 4) {
 			DEBUG(0, ("SID %s is not a domain sid, has %d "
 				  "auths instead of 4\n",
-				  sid_string_static(&pass.domain_sid),
+				  sid_string_dbg(&pass.domain_sid),
 				  pass.domain_sid.num_auths));
 			continue;
 		}
diff --git a/source3/passdb/util_wellknown.c b/source3/passdb/util_wellknown.c
index 3ac8c1453c..3a30ab0a65 100644
--- a/source3/passdb/util_wellknown.c
+++ b/source3/passdb/util_wellknown.c
@@ -123,8 +123,7 @@ bool lookup_wellknown_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
 	}
 
 	if (users == NULL) {
-		DEBUG(10, ("SID %s is no special sid\n",
-			   sid_string_static(sid)));
+		DEBUG(10, ("SID %s is no special sid\n", sid_string_dbg(sid)));
 		return False;
 	}
 
@@ -135,8 +134,7 @@ bool lookup_wellknown_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
 		}
 	}
 
-	DEBUG(10, ("RID of special SID %s not found\n",
-		   sid_string_static(sid)));
+	DEBUG(10, ("RID of special SID %s not found\n", sid_string_dbg(sid)));
 
 	return False;
 }
diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index 55dd63be78..ec4e8c59d5 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -5569,11 +5569,8 @@ bool nt_printing_getsec(TALLOC_CTX *ctx, const char *sharename, SEC_DESC_BUF **s
 			   sharename, the_acl->num_aces));
 
 		for (i = 0; i < the_acl->num_aces; i++) {
-			fstring sid_str;
-
-			sid_to_string(sid_str, &the_acl->aces[i].trustee);
-
-			DEBUG(10, ("%s %d %d 0x%08x\n", sid_str,
+			DEBUG(10, ("%s %d %d 0x%08x\n",
+				   sid_string_dbg(&the_acl->aces[i].trustee),
 				   the_acl->aces[i].type, the_acl->aces[i].flags, 
 				   the_acl->aces[i].access_mask)); 
 		}
diff --git a/source3/rpc_client/cli_samr.c b/source3/rpc_client/cli_samr.c
index b3168966b3..bf8313816c 100644
--- a/source3/rpc_client/cli_samr.c
+++ b/source3/rpc_client/cli_samr.c
@@ -145,7 +145,8 @@ NTSTATUS rpccli_samr_open_domain(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ct
 	SAMR_R_OPEN_DOMAIN r;
 	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 
-	DEBUG(10,("cli_samr_open_domain with sid %s\n", sid_string_static(domain_sid) ));
+	DEBUG(10,("cli_samr_open_domain with sid %s\n",
+		  sid_string_dbg(domain_sid) ));
 
 	ZERO_STRUCT(q);
 	ZERO_STRUCT(r);
diff --git a/source3/rpc_parse/parse_samr.c b/source3/rpc_parse/parse_samr.c
index 0085980ebf..614a80dd6f 100644
--- a/source3/rpc_parse/parse_samr.c
+++ b/source3/rpc_parse/parse_samr.c
@@ -6302,13 +6302,10 @@ NTSTATUS init_sam_user_info21A(SAM_USER_INFO_21 *usr, struct samu *pw, DOM_SID *
 	user_sid = pdb_get_user_sid(pw);
 	
 	if (!sid_peek_check_rid(domain_sid, user_sid, &user_rid)) {
-		fstring user_sid_string;
-		fstring domain_sid_string;
 		DEBUG(0, ("init_sam_user_info_21A: User %s has SID %s, \nwhich conflicts with "
 			  "the domain sid %s.  Failing operation.\n", 
-			  user_name, 
-			  sid_to_string(user_sid_string, user_sid),
-			  sid_to_string(domain_sid_string, domain_sid)));
+			  user_name, sid_string_dbg(user_sid),
+			  sid_string_dbg(domain_sid)));
 		data_blob_free(&munged_dial_blob);
 		return NT_STATUS_UNSUCCESSFUL;
 	}
@@ -6318,13 +6315,10 @@ NTSTATUS init_sam_user_info21A(SAM_USER_INFO_21 *usr, struct samu *pw, DOM_SID *
 	unbecome_root();
 
 	if (!sid_peek_check_rid(domain_sid, group_sid, &group_rid)) {
-		fstring group_sid_string;
-		fstring domain_sid_string;
 		DEBUG(0, ("init_sam_user_info_21A: User %s has Primary Group SID %s, \n"
 			  "which conflicts with the domain sid %s.  Failing operation.\n", 
-			  user_name, 
-			  sid_to_string(group_sid_string, group_sid),
-			  sid_to_string(domain_sid_string, domain_sid)));
+			  user_name, sid_string_dbg(group_sid),
+			  sid_string_dbg(domain_sid)));
 		data_blob_free(&munged_dial_blob);
 		return NT_STATUS_UNSUCCESSFUL;
 	}
diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index 20655082a5..43e4648fa8 100644
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -1692,8 +1692,9 @@ NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, prs_struct *ps, LSA_Q_ENUMPRIVS
 
 	if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
 
-		DEBUG(10,("_lsa_enum_privsaccount: %s has %d privileges\n", 
-			sid_string_static(&info->sid), privileges.count));
+		DEBUG(10,("_lsa_enum_privsaccount: %s has %d privileges\n",
+			  sid_string_dbg(&info->sid),
+			  privileges.count));
 
 		r_u->status = init_lsa_r_enum_privsaccount(ps->mem_ctx, r_u, privileges.set, privileges.count, 0);
 	}
@@ -1791,7 +1792,7 @@ NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u
 
 	if ( !grant_privilege( &info->sid, &mask ) ) {
 		DEBUG(3,("_lsa_addprivs: grant_privilege(%s) failed!\n",
-			sid_string_static(&info->sid) ));
+			 sid_string_dbg(&info->sid) ));
 		DEBUG(3,("Privilege mask:\n"));
 		dump_se_priv( DBGC_ALL, 3, &mask );
 		return NT_STATUS_NO_SUCH_PRIVILEGE;
@@ -1830,7 +1831,7 @@ NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEP
 
 	if ( !revoke_privilege( &info->sid, &mask ) ) {
 		DEBUG(3,("_lsa_removeprivs: revoke_privilege(%s) failed!\n",
-			sid_string_static(&info->sid) ));
+			 sid_string_dbg(&info->sid) ));
 		DEBUG(3,("Privilege mask:\n"));
 		dump_se_priv( DBGC_ALL, 3, &mask );
 		return NT_STATUS_NO_SUCH_PRIVILEGE;
@@ -2105,8 +2106,8 @@ NTSTATUS _lsa_enum_acct_rights(pipes_struct *p, LSA_Q_ENUM_ACCT_RIGHTS *q_u, LSA
 
 	if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
 
-		DEBUG(10,("_lsa_enum_acct_rights: %s has %d privileges\n", 
-			sid_string_static(&sid), privileges.count));
+		DEBUG(10,("_lsa_enum_acct_rights: %s has %d privileges\n",
+			  sid_string_dbg(&sid), privileges.count));
 
 		r_u->status = init_r_enum_acct_rights( r_u, &privileges );
 	}
diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c
index 29c60e07b5..218ce73444 100644
--- a/source3/rpc_server/srv_netlog_nt.c
+++ b/source3/rpc_server/srv_netlog_nt.c
@@ -958,8 +958,6 @@ static NTSTATUS _net_sam_logon_internal(pipes_struct *p,
 
 		int num_gids = 0;
 		const char *my_name;
-		fstring user_sid_string;
-		fstring group_sid_string;
 		unsigned char user_session_key[16];
 		unsigned char lm_session_key[16];
 		unsigned char pipe_session_key[16];
@@ -988,8 +986,8 @@ static NTSTATUS _net_sam_logon_internal(pipes_struct *p,
 				  "supported for NETLOGON calls\n",
 				  pdb_get_domain(sampw),
 				  pdb_get_username(sampw),
-				  sid_to_string(user_sid_string, user_sid),
-				  sid_to_string(group_sid_string, group_sid)));
+				  sid_string_dbg(user_sid),
+				  sid_string_dbg(group_sid)));
 			return NT_STATUS_UNSUCCESSFUL;
 		}
 
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 3cc8f01d2c..d013ec8f03 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -347,7 +347,7 @@ static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
 static void free_samr_cache(DISP_INFO *disp_info)
 {
 	DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
-		   sid_string_static(&disp_info->sid)));
+		   sid_string_dbg(&disp_info->sid)));
 
 	/* We need to become root here because the paged search might have to
 	 * tell the LDAP server we're not interested in the rest anymore. */
@@ -431,8 +431,7 @@ static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromno
 	TALLOC_FREE(disp_info->cache_timeout_event);
 
 	DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
-		  "SID %s for %u seconds\n",
-		  sid_string_static(&disp_info->sid),
+		  "SID %s for %u seconds\n", sid_string_dbg(&disp_info->sid),
 		  (unsigned int)secs_fromnow ));
 
 	disp_info->cache_timeout_event = event_add_timed(
@@ -702,7 +701,7 @@ NTSTATUS _samr_set_sec_obj(pipes_struct *p, SAMR_Q_SET_SEC_OBJ *q_u, SAMR_R_SET_
 	unbecome_root();
 
 	if (!ret) {
-		DEBUG(4, ("User %s not found\n", sid_string_static(&pol_sid)));
+		DEBUG(4, ("User %s not found\n", sid_string_dbg(&pol_sid)));
 		TALLOC_FREE(sampass);
 		return NT_STATUS_INVALID_HANDLE;
 	}
@@ -753,7 +752,7 @@ static bool check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
 	unbecome_root();
 
 	if (ret == False) {
-		DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
+		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
 		TALLOC_FREE(sampass);
 		return False;
 	}
@@ -776,7 +775,6 @@ static bool check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
 NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_QUERY_SEC_OBJ *r_u)
 {
 	DOM_SID pol_sid;
-	fstring str_sid;
 	SEC_DESC * psd = NULL;
 	uint32 acc_granted;
 	size_t sd_size;
@@ -787,7 +785,8 @@ NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_
 	if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &pol_sid, &acc_granted, NULL))
 		return NT_STATUS_INVALID_HANDLE;
 
-	DEBUG(10,("_samr_query_sec_obj: querying security on SID: %s\n", sid_to_string(str_sid, &pol_sid)));
+	DEBUG(10,("_samr_query_sec_obj: querying security on SID: %s\n",
+		  sid_string_dbg(&pol_sid)));
 
 	/* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
 
@@ -797,18 +796,21 @@ NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_
 		r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
 	} else if (sid_equal(&pol_sid,get_global_sam_sid())) { 
 		/* check if it is our domain SID */
-		DEBUG(5,("_samr_query_sec_obj: querying security on Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
+		DEBUG(5,("_samr_query_sec_obj: querying security on Domain "
+			 "with SID: %s\n", sid_string_dbg(&pol_sid)));
 		r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
 	} else if (sid_equal(&pol_sid,&global_sid_Builtin)) {
 		/* check if it is the Builtin  Domain */
 		/* TODO: Builtin probably needs a different SD with restricted write access*/
-		DEBUG(5,("_samr_query_sec_obj: querying security on Builtin Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
+		DEBUG(5,("_samr_query_sec_obj: querying security on Builtin "
+			 "Domain with SID: %s\n", sid_string_dbg(&pol_sid)));
 		r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
 	} else if (sid_check_is_in_our_domain(&pol_sid) ||
 	    	 sid_check_is_in_builtin(&pol_sid)) {
 		/* TODO: different SDs have to be generated for aliases groups and users.
 		         Currently all three get a default user SD  */
-		DEBUG(10,("_samr_query_sec_obj: querying security on Object with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
+		DEBUG(10,("_samr_query_sec_obj: querying security on Object "
+			  "with SID: %s\n", sid_string_dbg(&pol_sid)));
 		if (check_change_pw_access(p->mem_ctx, &pol_sid)) {
 			r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, 
 							  &pol_sid, SAMR_USR_RIGHTS_WRITE_PW);
@@ -1101,7 +1103,7 @@ NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, S
 		return r_u->status;
 
 	DEBUG(5,("samr_reply_enum_dom_aliases: sid %s\n",
-		 sid_string_static(&info->sid)));
+		 sid_string_dbg(&info->sid)));
 
 	become_root();
 
@@ -1466,7 +1468,6 @@ NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LO
 	int i;
 	int num_rids = q_u->num_names2;
 	DOM_SID pol_sid;
-	fstring sid_str;
 	uint32  acc_granted;
 
 	r_u->status = NT_STATUS_OK;
@@ -1490,7 +1491,8 @@ NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LO
 		DEBUG(5,("_samr_lookup_names: truncating entries to %d\n", num_rids));
 	}
 
-	DEBUG(5,("_samr_lookup_names: looking name on SID %s\n", sid_to_string(sid_str, &pol_sid)));
+	DEBUG(5,("_samr_lookup_names: looking name on SID %s\n",
+		 sid_string_dbg(&pol_sid)));
 	
 	for (i = 0; i < num_rids; i++) {
 		fstring name;
@@ -1861,7 +1863,7 @@ static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx, SAM_USER_INFO_7 *id7, DOM_S
 	unbecome_root();
 
 	if ( !ret ) {
-		DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
+		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
@@ -1892,7 +1894,7 @@ static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx, SAM_USER_INFO_9 * id9, DOM_
 	unbecome_root();
 
 	if (ret==False) {
-		DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
+		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
@@ -1924,7 +1926,7 @@ static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx, SAM_USER_INFO_16 *id16, DO
 	unbecome_root();
 
 	if (ret==False) {
-		DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
+		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
@@ -1968,7 +1970,7 @@ static NTSTATUS get_user_info_18(pipes_struct *p, TALLOC_CTX *mem_ctx, SAM_USER_
 	ret = pdb_getsampwsid(smbpass, user_sid);
 
 	if (ret == False) {
-		DEBUG(4, ("User %s not found\n", sid_string_static(user_sid)));
+		DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid)));
 		TALLOC_FREE(smbpass);
 		return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
 	}
@@ -2006,7 +2008,7 @@ static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx, SAM_USER_INFO_20 *id20, DO
 	unbecome_root();
 
 	if (ret == False) {
-		DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
+		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
@@ -2042,7 +2044,7 @@ static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx, SAM_USER_INFO_21 *id21,
 	unbecome_root();
 
 	if (ret == False) {
-		DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
+		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
@@ -2082,7 +2084,8 @@ NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_
 	if (!sid_check_is_in_our_domain(&info->sid))
 		return NT_STATUS_OBJECT_TYPE_MISMATCH;
 
-	DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info->sid)));
+	DEBUG(5,("_samr_query_userinfo: sid:%s\n",
+		 sid_string_dbg(&info->sid)));
 
 	ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_USERINFO_CTR);
 	if (!ctr)
@@ -2215,7 +2218,7 @@ NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, S
 
 	if (!ret) {
 		DEBUG(10, ("pdb_getsampwsid failed for %s\n",
-			   sid_string_static(&sid)));
+			   sid_string_dbg(&sid)));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
@@ -2234,13 +2237,13 @@ NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, S
 
 	if (!NT_STATUS_IS_OK(result)) {
 		DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
-			   sid_string_static(&sid)));
+			   sid_string_dbg(&sid)));
 		return result;
 	}
 
 	if ( !success ) {
 		DEBUG(5, ("Group sid %s for user %s not in our domain\n",
-			  sid_string_static(pdb_get_group_sid(sam_pass)),
+			  sid_string_dbg(pdb_get_group_sid(sam_pass)),
 			  pdb_get_username(sam_pass)));
 		TALLOC_FREE(sam_pass);
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -2259,7 +2262,7 @@ NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, S
 		if (!sid_peek_check_rid(get_global_sam_sid(),
 					&(sids[i]), &dom_gid.g_rid)) {
 			DEBUG(10, ("Found sid %s not in our domain\n",
-				   sid_string_static(&sids[i])));
+				   sid_string_dbg(&sids[i])));
 			continue;
 		}
 
@@ -2897,7 +2900,8 @@ NTSTATUS _samr_lookup_domain(pipes_struct *p, SAMR_Q_LOOKUP_DOMAIN *q_u, SAMR_R_
 		}
 	}
 
-	DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name, sid_string_static(&sid)));
+	DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name,
+		 sid_string_dbg(&sid)));
 
 	init_samr_r_lookup_domain(r_u, &sid, r_u->status);
 
@@ -3523,7 +3527,8 @@ NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SE
 		return r_u->status;
 	}
 
-	DEBUG(5, ("_samr_set_userinfo: sid:%s, level:%d\n", sid_string_static(&sid), switch_value));
+	DEBUG(5, ("_samr_set_userinfo: sid:%s, level:%d\n",
+		  sid_string_dbg(&sid), switch_value));
 
 	if (ctr == NULL) {
 		DEBUG(5, ("_samr_set_userinfo: NULL info level\n"));
@@ -3683,7 +3688,8 @@ NTSTATUS _samr_set_userinfo2(pipes_struct *p, SAMR_Q_SET_USERINFO2 *q_u, SAMR_R_
 		return r_u->status;
 	}
 
-	DEBUG(5, ("samr_reply_set_userinfo2: sid:%s\n", sid_string_static(&sid)));
+	DEBUG(5, ("samr_reply_set_userinfo2: sid:%s\n",
+		  sid_string_dbg(&sid)));
 
 	if (ctr == NULL) {
 		DEBUG(5, ("samr_reply_set_userinfo2: NULL info level\n"));
@@ -3879,7 +3885,7 @@ NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_
 		return r_u->status;
 	}
 
-	DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
+	DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
 
 	become_root();
 	status = pdb_enum_aliasmem(&alias_sid, &sids, &num_sids);
@@ -3917,7 +3923,6 @@ NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_
 NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_R_QUERY_GROUPMEM *r_u)
 {
 	DOM_SID group_sid;
-	fstring group_sid_str;
 	size_t i, num_members;
 
 	uint32 *rid=NULL;
@@ -3935,11 +3940,11 @@ NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_
 		return r_u->status;
 	}
 		
-	sid_to_string(group_sid_str, &group_sid);
-	DEBUG(10, ("sid is %s\n", group_sid_str));
+	DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
 
 	if (!sid_check_is_in_our_domain(&group_sid)) {
-		DEBUG(3, ("sid %s is not in our domain\n", group_sid_str));
+		DEBUG(3, ("sid %s is not in our domain\n",
+			  sid_string_dbg(&group_sid)));
 		return NT_STATUS_NO_SUCH_GROUP;
 	}
 
@@ -3991,7 +3996,7 @@ NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_AD
 		return r_u->status;
 	}
 		
-	DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
+	DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
 	
 	se_priv_copy( &se_rights, &se_add_users );
 	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
@@ -4037,7 +4042,7 @@ NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DE
 	}
 	
 	DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
-		   sid_string_static(&alias_sid)));
+		   sid_string_dbg(&alias_sid)));
 
 	se_priv_copy( &se_rights, &se_add_users );
 	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
@@ -4082,7 +4087,7 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD
 		return r_u->status;
 	}
 
-	DEBUG(10, ("sid is %s\n", sid_string_static(&group_sid)));
+	DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
 
 	if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
 				&group_rid)) {
@@ -4199,7 +4204,7 @@ NTSTATUS _samr_delete_dom_user(pipes_struct *p, SAMR_Q_DELETE_DOM_USER *q_u, SAM
 
 	if( !ret ) {
 		DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n", 
-			sid_string_static(&user_sid)));
+			sid_string_dbg(&user_sid)));
 		TALLOC_FREE(sam_pass);
 		return NT_STATUS_NO_SUCH_USER;
 	}
@@ -4267,7 +4272,7 @@ NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, S
 		return r_u->status;
 	}
 
-	DEBUG(10, ("sid is %s\n", sid_string_static(&group_sid)));
+	DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
 
 	if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
 				&group_rid)) {
@@ -4292,7 +4297,7 @@ NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, S
 	if ( !NT_STATUS_IS_OK(r_u->status) ) {
 		DEBUG(5,("_samr_delete_dom_group: Failed to delete mapping "
 			 "entry for group %s: %s\n",
-			 sid_string_static(&group_sid),
+			 sid_string_dbg(&group_sid),
 			 nt_errstr(r_u->status)));
 		return r_u->status;
 	}
@@ -4332,7 +4337,7 @@ NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, S
 		return r_u->status;
 	}
 
-	DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
+	DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
 
 	/* Don't let Windows delete builtin groups */
 
@@ -4907,12 +4912,12 @@ NTSTATUS _samr_remove_sid_foreign_domain(pipes_struct *p,
 	DISP_INFO *disp_info = NULL;
 
 	sid_copy( &delete_sid, &q_u->sid.sid );
-	
+
 	DEBUG(5,("_samr_remove_sid_foreign_domain: removing SID [%s]\n",
-		sid_string_static(&delete_sid)));
-		
+		sid_string_dbg(&delete_sid)));
+
 	/* Find the policy handle. Open a policy on it. */
-	
+
 	if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &domain_sid,
 				     &acc_granted, &disp_info)) 
 		return NT_STATUS_INVALID_HANDLE;
@@ -4923,8 +4928,8 @@ NTSTATUS _samr_remove_sid_foreign_domain(pipes_struct *p,
 	if (!NT_STATUS_IS_OK(result)) 
 		return result;
 			
-	DEBUG(8, ("_samr_remove_sid_foreign_domain:sid is %s\n", 
-		sid_string_static(&domain_sid)));
+	DEBUG(8, ("_samr_remove_sid_foreign_domain:sid is %s\n",
+		  sid_string_dbg(&domain_sid)));
 
 	/* we can only delete a user from a group since we don't have 
 	   nested groups anyways.  So in the latter case, just say OK */
@@ -4943,8 +4948,8 @@ NTSTATUS _samr_remove_sid_foreign_domain(pipes_struct *p,
 	if (!sid_check_is_builtin(&domain_sid)) {
 		DEBUG(1,("_samr_remove_sid_foreign_domain: domain_sid = %s, "
 			 "global_sam_sid() = %s\n",
-			 sid_string_static(&domain_sid),
-			 sid_string_static(get_global_sam_sid())));
+			 sid_string_dbg(&domain_sid),
+			 sid_string_dbg(get_global_sam_sid())));
 		DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
 		return NT_STATUS_OK;
 	}
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index c1e422657b..3758c8fd63 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -6044,11 +6044,8 @@ static WERROR update_printer_sec(POLICY_HND *handle, uint32 level,
 			   PRINTERNAME(snum), the_acl->num_aces));
 
 		for (i = 0; i < the_acl->num_aces; i++) {
-			fstring sid_str;
-
-			sid_to_string(sid_str, &the_acl->aces[i].trustee);
-
-			DEBUG(10, ("%s 0x%08x\n", sid_str,
+			DEBUG(10, ("%s 0x%08x\n", sid_string_dbg(
+					   &the_acl->aces[i].trustee),
 				  the_acl->aces[i].access_mask));
 		}
 
@@ -6059,11 +6056,8 @@ static WERROR update_printer_sec(POLICY_HND *handle, uint32 level,
 				   PRINTERNAME(snum), the_acl->num_aces));
 
 			for (i = 0; i < the_acl->num_aces; i++) {
-				fstring sid_str;
-
-				sid_to_string(sid_str, &the_acl->aces[i].trustee);
-
-				DEBUG(10, ("%s 0x%08x\n", sid_str,
+				DEBUG(10, ("%s 0x%08x\n", sid_string_dbg(
+						   &the_acl->aces[i].trustee),
 					   the_acl->aces[i].access_mask));
 			}
 		} else {
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 7df7de36dc..3ab216c062 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -2221,7 +2221,7 @@ static bool api_NetUserGetGroups(connection_struct *conn,uint16 vuid,
 
 	if ( !pdb_getsampwsid(sampw, &user_sid) ) {
 		DEBUG(10, ("pdb_getsampwsid(%s) failed for user %s\n",
-			   sid_string_static(&user_sid), UserName));
+			   sid_string_dbg(&user_sid), UserName));
 		goto done;
 	}
 
diff --git a/source3/smbd/ntquotas.c b/source3/smbd/ntquotas.c
index 96ca2bc656..fcccf9d9fc 100644
--- a/source3/smbd/ntquotas.c
+++ b/source3/smbd/ntquotas.c
@@ -88,7 +88,7 @@ int vfs_get_ntquota(files_struct *fsp, enum SMB_QUOTA_TYPE qtype, DOM_SID *psid,
 
 	if (psid && !sid_to_uid(psid, &id.uid)) {
 		DEBUG(0,("sid_to_uid: failed, SID[%s]\n",
-			sid_string_static(psid)));	
+			 sid_string_dbg(psid)));
 	}
 
 	ret = SMB_VFS_GET_QUOTA(fsp->conn, qtype, id, &D);
@@ -132,7 +132,7 @@ int vfs_set_ntquota(files_struct *fsp, enum SMB_QUOTA_TYPE qtype, DOM_SID *psid,
 
 	if (psid && !sid_to_uid(psid, &id.uid)) {
 		DEBUG(0,("sid_to_uid: failed, SID[%s]\n",
-			sid_string_static(psid)));	
+			 sid_string_dbg(psid)));
 	}
 
 	ret = SMB_VFS_SET_QUOTA(fsp->conn, qtype, id, &D);
@@ -188,12 +188,13 @@ int vfs_get_user_ntquota_list(files_struct *fsp, SMB_NTQUOTA_LIST **qt_list)
 
 		if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &tmp_qt)!=0) {
 			DEBUG(5,("no quota entry for sid[%s] path[%s]\n",
-				sid_string_static(&sid),fsp->conn->connectpath));
+				 sid_string_dbg(&sid),
+				 fsp->conn->connectpath));
 			continue;
 		}
 
 		DEBUG(15,("quota entry for id[%s] path[%s]\n",
-			sid_string_static(&sid),fsp->conn->connectpath));
+			  sid_string_dbg(&sid), fsp->conn->connectpath));
 
 		if ((tmp_list_ent=TALLOC_ZERO_P(mem_ctx,SMB_NTQUOTA_LIST))==NULL) {
 			DEBUG(0,("TALLOC_ZERO() failed\n"));
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 99b2bf65bb..641670c484 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -2033,11 +2033,12 @@ static void call_nt_transact_ioctl(connection_struct *conn,
 		/*unknown = IVAL(pdata,0);*/
 
 		sid_parse(pdata+4,sid_len,&sid);
-		DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid)));
+		DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
 
 		if (!sid_to_uid(&sid, &uid)) {
 			DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%lu]\n",
-				sid_string_static(&sid),(unsigned long)sid_len));
+				 sid_string_dbg(&sid),
+				 (unsigned long)sid_len));
 			uid = (-1);
 		}
 
@@ -2466,7 +2467,7 @@ static void call_nt_transact_set_user_quota(connection_struct *conn,
 #endif /* LARGE_SMB_OFF_T */
 
 	sid_parse(pdata+40,sid_len,&sid);
-	DEBUGADD(8,("SID: %s\n",sid_string_static(&sid)));
+	DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
 
 	/* 44 unknown bytes left... */
 
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 27953a2051..ccfed69721 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -546,10 +546,8 @@ static canon_ace *dup_canon_ace( canon_ace *src_ace)
 
 static void print_canon_ace(canon_ace *pace, int num)
 {
-	fstring str;
-
 	dbgtext( "canon_ace index %d. Type = %s ", num, pace->attr == ALLOW_ACE ? "allow" : "deny" );
-	dbgtext( "SID = %s ", sid_to_string( str, &pace->trustee));
+	dbgtext( "SID = %s ", sid_string_dbg(&pace->trustee));
 	if (pace->owner_type == UID_ACE) {
 		const char *u_name = uidtoname(pace->unix_ug.uid);
 		dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
@@ -962,7 +960,7 @@ NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_i
 			} else {
 				DEBUG(3,("unpack_nt_owners: unable to validate"
 					 " owner sid for %s\n",
-					 sid_string_static(&owner_sid)));
+					 sid_string_dbg(&owner_sid)));
 				return NT_STATUS_INVALID_OWNER;
 			}
 		}
@@ -1414,23 +1412,23 @@ static bool create_canon_ace_lists(files_struct *fsp, SMB_STRUCT_STAT *pst,
 			current_ace->owner_type = GID_ACE;
 			current_ace->type = SMB_ACL_GROUP;
 		} else {
-			fstring str;
-
 			/*
 			 * Silently ignore map failures in non-mappable SIDs (NT Authority, BUILTIN etc).
 			 */
 
 			if (non_mappable_sid(&psa->trustee)) {
-				DEBUG(10,("create_canon_ace_lists: ignoring non-mappable SID %s\n",
-					sid_to_string(str, &psa->trustee) ));
+				DEBUG(10, ("create_canon_ace_lists: ignoring "
+					   "non-mappable SID %s\n",
+					   sid_string_dbg(&psa->trustee)));
 				SAFE_FREE(current_ace);
 				continue;
 			}
 
 			free_canon_ace_list(file_ace);
 			free_canon_ace_list(dir_ace);
-			DEBUG(0,("create_canon_ace_lists: unable to map SID %s to uid or gid.\n",
-				sid_to_string(str, &current_ace->trustee) ));
+			DEBUG(0, ("create_canon_ace_lists: unable to map SID "
+				  "%s to uid or gid.\n",
+				  sid_string_dbg(&current_ace->trustee)));
 			SAFE_FREE(current_ace);
 			return False;
 		}
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index e98ce0f8c2..88ab9f0048 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -597,7 +597,7 @@ static NTSTATUS find_forced_group(bool force_user,
 
 	if (!sid_to_gid(&group_sid, &gid)) {
 		DEBUG(10, ("sid_to_gid(%s) for %s failed\n",
-			   sid_string_static(&group_sid), groupname));
+			   sid_string_dbg(&group_sid), groupname));
 		goto done;
 	}
 
@@ -885,7 +885,7 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser,
 			if (!sid_to_gid(sid, &gid)) {
 				DEBUG(10, ("Could not convert SID %s to gid, "
 					   "ignoring it\n",
-					   sid_string_static(sid)));
+					   sid_string_dbg(sid)));
 				continue;
 			}
 			if (!add_gid_to_array_unique(conn->mem_ctx, gid, &conn->groups,
diff --git a/source3/utils/net_rpc.c b/source3/utils/net_rpc.c
index 4db09676d8..1dd37888cd 100644
--- a/source3/utils/net_rpc.c
+++ b/source3/utils/net_rpc.c
@@ -5878,8 +5878,9 @@ static NTSTATUS vampire_trusted_domain(struct rpc_pipe_client *pipe_hnd,
 	}
 
 #ifdef DEBUG_PASSWORD
-	DEBUG(100,("sucessfully vampired trusted domain [%s], sid: [%s], password: [%s]\n",  
-		trusted_dom_name, sid_string_static(&dom_sid), cleartextpwd));
+	DEBUG(100,("sucessfully vampired trusted domain [%s], sid: [%s], "
+		   "password: [%s]\n", trusted_dom_name,
+		   sid_string_dbg(&dom_sid), cleartextpwd));
 #endif
 
 done:
diff --git a/source3/utils/net_rpc_rights.c b/source3/utils/net_rpc_rights.c
index e0dc57c734..2375bc9fcf 100644
--- a/source3/utils/net_rpc_rights.c
+++ b/source3/utils/net_rpc_rights.c
@@ -231,8 +231,8 @@ static NTSTATUS enum_accounts_for_privilege(struct rpc_pipe_client *pipe_hnd,
 		   printing the raw SID if necessary */
 		result = sid_to_name( pipe_hnd, ctx, &sids[i], name );
 		if ( !NT_STATUS_IS_OK (result) )
-			fstrcpy( name, sid_string_static(&sids[i]) );
-			
+			sid_to_string(name, &sids[i]);
+
 		d_printf("  %s\n", name);
 	}
 
@@ -267,7 +267,7 @@ static NTSTATUS enum_privileges_for_accounts(struct rpc_pipe_client *pipe_hnd,
 		   
 		result = sid_to_name(pipe_hnd, ctx, &sids[i], name );
 		if ( !NT_STATUS_IS_OK (result) )
-			fstrcpy( name, sid_string_static(&sids[i]) );
+			sid_to_string(name, &sids[i]);
 			
 		d_printf("%s\n", name);
 		
diff --git a/source3/winbindd/idmap.c b/source3/winbindd/idmap.c
index 6b4af10f6f..c1b4e10adf 100644
--- a/source3/winbindd/idmap.c
+++ b/source3/winbindd/idmap.c
@@ -912,7 +912,7 @@ static NTSTATUS idmap_can_map(const struct id_map *map,
 				   "our primary domain when <trusted domain "
 				   "only> is True\n"));
 			DEBUGADD(10, ("Leave [%s] unmapped\n",
-				      sid_string_static(map->sid)));
+				      sid_string_dbg(map->sid)));
 			return NT_STATUS_UNSUCCESSFUL;
 		}
 	}
@@ -921,7 +921,7 @@ static NTSTATUS idmap_can_map(const struct id_map *map,
 		/* huh, couldn't find a suitable domain,
 		 *  let's just leave it unmapped */
 		DEBUG(10, ("Could not find idmap backend for SID %s\n",
-			   sid_string_static(map->sid)));
+			   sid_string_dbg(map->sid)));
 		return NT_STATUS_NO_SUCH_DOMAIN;
 	}
 
@@ -929,7 +929,7 @@ static NTSTATUS idmap_can_map(const struct id_map *map,
 		/* ouch the domain is read only,
 		 *  let's just leave it unmapped */
 		DEBUG(10, ("idmap backend for SID %s is READONLY!\n",
-			   sid_string_static(map->sid)));
+			   sid_string_dbg(map->sid)));
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
@@ -983,7 +983,7 @@ static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
 	map->status = ID_MAPPED;
 
 	DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
-		   sid_string_static(map->sid),
+		   sid_string_dbg(map->sid),
 		   (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
 		   (unsigned long)map->xid.id));
 	ret = dom->methods->set_mapping(dom, map);
@@ -1006,7 +1006,7 @@ static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
 	NTSTATUS ret;
 
 	DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
-		   sid_string_static(map->sid),
+		   sid_string_dbg(map->sid),
 		   (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
 		   (unsigned long)map->xid.id));
 
@@ -1150,7 +1150,7 @@ static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
 		}
 
 		DEBUG(10,("SID %s is being handled by %s\n",
-			  sid_string_static(ids[i]->sid),
+			  sid_string_dbg(ids[i]->sid),
 			  dom ? dom->name : "none" ));
 
 		idx = find_idmap_domain_index( dom );
diff --git a/source3/winbindd/idmap_ad.c b/source3/winbindd/idmap_ad.c
index 50f7914f85..0d7c068844 100644
--- a/source3/winbindd/idmap_ad.c
+++ b/source3/winbindd/idmap_ad.c
@@ -441,8 +441,7 @@ again:
 		/* mapped */
 		map->status = ID_MAPPED;
 
-		DEBUG(10, ("Mapped %s -> %lu (%d)\n",
-			   sid_string_static(map->sid),
+		DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 			   (unsigned long)map->xid.id,
 			   map->xid.type));
 	}
@@ -628,8 +627,7 @@ again:
 		map->xid.id = id;
 		map->status = ID_MAPPED;
 
-		DEBUG(10, ("Mapped %s -> %lu (%d)\n",
-			   sid_string_static(map->sid),
+		DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 			   (unsigned long)map->xid.id,
 			   map->xid.type));
 	}
diff --git a/source3/winbindd/idmap_ldap.c b/source3/winbindd/idmap_ldap.c
index 17e9eefe43..fa80fae5d8 100644
--- a/source3/winbindd/idmap_ldap.c
+++ b/source3/winbindd/idmap_ldap.c
@@ -1065,8 +1065,7 @@ again:
 		/* mapped */
 		map->status = ID_MAPPED;
 
-		DEBUG(10, ("Mapped %s -> %lu (%d)\n",
-			   sid_string_static(map->sid),
+		DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 			   (unsigned long)map->xid.id, map->xid.type));
 	}
 
@@ -1298,8 +1297,7 @@ again:
 		map->xid.id = id;
 		map->status = ID_MAPPED;
 
-		DEBUG(10, ("Mapped %s -> %lu (%d)\n",
-			   sid_string_static(map->sid),
+		DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 			   (unsigned long)map->xid.id, map->xid.type));
 	}
 
diff --git a/source3/winbindd/idmap_rid.c b/source3/winbindd/idmap_rid.c
index 8e5f1302f7..f1cd77853c 100644
--- a/source3/winbindd/idmap_rid.c
+++ b/source3/winbindd/idmap_rid.c
@@ -237,7 +237,7 @@ static NTSTATUS idmap_rid_sids_to_unixids(struct idmap_domain *dom, struct id_ma
 		    ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 			/* some fatal error occurred, log it */
 			DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
-					sid_string_static(ids[i]->sid)));
+				  sid_string_dbg(ids[i]->sid)));
 		}
 	}
 
diff --git a/source3/winbindd/idmap_util.c b/source3/winbindd/idmap_util.c
index 077c599739..bf06cd8472 100644
--- a/source3/winbindd/idmap_util.c
+++ b/source3/winbindd/idmap_util.c
@@ -101,7 +101,7 @@ NTSTATUS idmap_sid_to_uid(DOM_SID *sid, uid_t *uid)
 	struct id_map map;
 	struct id_map *maps[2];
 
-	DEBUG(10,("idmap_sid_to_uid: sid = [%s]\n", sid_string_static(sid)));
+	DEBUG(10,("idmap_sid_to_uid: sid = [%s]\n", sid_string_dbg(sid)));
 
 	map.sid = sid;
 	map.xid.type = ID_TYPE_UID;	
@@ -112,13 +112,13 @@ NTSTATUS idmap_sid_to_uid(DOM_SID *sid, uid_t *uid)
 	ret = idmap_sids_to_unixids(maps);
 	if ( ! NT_STATUS_IS_OK(ret)) {
 		DEBUG(10, ("error mapping sid [%s] to uid\n", 
-			   sid_string_static(sid)));
+			   sid_string_dbg(sid)));
 		return ret;
 	}
 
 	if ((map.status != ID_MAPPED) || (map.xid.type != ID_TYPE_UID)) {
 		DEBUG(10, ("sid [%s] not mapped to an uid [%u,%u,%u]\n", 
-			   sid_string_static(sid), 
+			   sid_string_dbg(sid),
 			   map.status, 
 			   map.xid.type, 
 			   map.xid.id));
@@ -141,7 +141,7 @@ NTSTATUS idmap_sid_to_gid(DOM_SID *sid, gid_t *gid)
 	struct id_map map;
 	struct id_map *maps[2];
 
-	DEBUG(10,("idmap_sid_to_gid: sid = [%s]\n", sid_string_static(sid)));
+	DEBUG(10,("idmap_sid_to_gid: sid = [%s]\n", sid_string_dbg(sid)));
 
 	map.sid = sid;
 	map.xid.type = ID_TYPE_GID;
@@ -152,13 +152,13 @@ NTSTATUS idmap_sid_to_gid(DOM_SID *sid, gid_t *gid)
 	ret = idmap_sids_to_unixids(maps);
 	if ( ! NT_STATUS_IS_OK(ret)) {
 		DEBUG(10, ("error mapping sid [%s] to gid\n", 
-			   sid_string_static(sid)));
+			   sid_string_dbg(sid)));
 		return ret;
 	}
 
 	if ((map.status != ID_MAPPED) || (map.xid.type != ID_TYPE_GID)) {
 		DEBUG(10, ("sid [%s] not mapped to a gid [%u,%u,%u]\n", 
-			   sid_string_static(sid), 
+			   sid_string_dbg(sid),
 			   map.status, 
 			   map.xid.type, 
 			   map.xid.id));
diff --git a/source3/winbindd/winbindd_ads.c b/source3/winbindd/winbindd_ads.c
index 71ce3dd364..c9b2a52388 100644
--- a/source3/winbindd/winbindd_ads.c
+++ b/source3/winbindd/winbindd_ads.c
@@ -435,7 +435,7 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
 	{
 				
 		DEBUG(5,("query_user: Cache lookup succeeded for %s\n", 
-			sid_string_static(sid)));
+			 sid_string_dbg(sid)));
 
 		sid_compose(&info->user_sid, &domain->sid, user->user_rid);
 		sid_compose(&info->group_sid, &domain->sid, user->group_rid);
@@ -490,14 +490,14 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
 	free(sidstr);
 	if (!ADS_ERR_OK(rc) || !msg) {
 		DEBUG(1,("query_user(sid=%s) ads_search: %s\n",
-			 sid_string_static(sid), ads_errstr(rc)));
+			 sid_string_dbg(sid), ads_errstr(rc)));
 		goto done;
 	}
 
 	count = ads_count_replies(ads, msg);
 	if (count != 1) {
 		DEBUG(1,("query_user(sid=%s): Not found\n",
-			 sid_string_static(sid)));
+			 sid_string_dbg(sid)));
 		goto done;
 	}
 
@@ -513,7 +513,7 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
 
 	if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
 		DEBUG(1,("No primary group for %s !?\n",
-			 sid_string_static(sid)));
+			 sid_string_dbg(sid)));
 		goto done;
 	}
 
@@ -756,7 +756,6 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 	int i;
 	DOM_SID primary_group;
 	uint32 primary_group_rid;
-	fstring sid_string;
 	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 	size_t num_groups = 0;
 
@@ -790,8 +789,8 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 
 	if (!ADS_ERR_OK(rc)) {
 		status = ads_ntstatus(rc);
-		DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n", 
-			 sid_to_string(sid_string, sid), ads_errstr(rc)));
+		DEBUG(1, ("lookup_usergroups(sid=%s) ads_search tokenGroups: "
+			  "%s\n", sid_string_dbg(sid), ads_errstr(rc)));
 		goto done;
 	}
 	
@@ -800,13 +799,13 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 		status = NT_STATUS_UNSUCCESSFUL;
 		DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
 			 "invalid number of results (count=%d)\n", 
-			 sid_to_string(sid_string, sid), count));
+			 sid_string_dbg(sid), count));
 		goto done;
 	}
 
 	if (!msg) {
 		DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n", 
-			 sid_to_string(sid_string, sid)));
+			 sid_string_dbg(sid)));
 		status = NT_STATUS_UNSUCCESSFUL;
 		goto done;
 	}
@@ -819,7 +818,7 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 
 	if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
 		DEBUG(1,("%s: No primary group for sid=%s !?\n", 
-			 domain->name, sid_to_string(sid_string, sid)));
+			 domain->name, sid_string_dbg(sid)));
 		goto done;
 	}
 
@@ -885,7 +884,7 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 	status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 
 	DEBUG(3,("ads lookup_usergroups (tokenGroups) succeeded for sid=%s\n",
-		 sid_to_string(sid_string, sid)));
+		 sid_string_dbg(sid)));
 done:
 	ads_memfree(ads, user_dn);
 	ads_msgfree(ads, msg);
@@ -920,7 +919,7 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 	TALLOC_CTX *tmp_ctx = NULL;
 
 	DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name, 
-		  sid_string_static(group_sid)));
+		  sid_string_dbg(group_sid)));
 
 	*num_names = 0;
 
@@ -1018,8 +1017,8 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 	                goto done;
 		}
 		if (lookup_cached_sid(mem_ctx, &sid, &domain_name, &name, &name_type)) {
-			DEBUG(10,("ads: lookup_groupmem: got sid %s from cache\n",
-				 sid_string_static(&sid)));
+			DEBUG(10,("ads: lookup_groupmem: got sid %s from "
+				  "cache\n", sid_string_dbg(&sid)));
 			sid_copy(&(*sid_mem)[*num_names], &sid);
 			(*names)[*num_names] = talloc_asprintf(*names, "%s%c%s",
 							       domain_name,
@@ -1030,8 +1029,8 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 			(*num_names)++;
 		}
 		else {
-			DEBUG(10, ("ads: lookup_groupmem: sid %s not found in cache\n",
-				  sid_string_static(&sid)));
+			DEBUG(10, ("ads: lookup_groupmem: sid %s not found in "
+				   "cache\n", sid_string_dbg(&sid)));
 			sid_copy(&(sid_mem_nocache)[num_nocache], &sid);
 			num_nocache++;
 		}
@@ -1096,7 +1095,7 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 
 	status = NT_STATUS_OK;
 	DEBUG(3,("ads lookup_groupmem for sid=%s succeeded\n",
-		 sid_string_static(group_sid)));
+		 sid_string_dbg(group_sid)));
 
 done:
 
diff --git a/source3/winbindd/winbindd_async.c b/source3/winbindd/winbindd_async.c
index c0254412e5..6cd85a2694 100644
--- a/source3/winbindd/winbindd_async.c
+++ b/source3/winbindd/winbindd_async.c
@@ -202,7 +202,7 @@ void winbindd_lookupsid_async(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
 	domain = find_lookup_domain_from_sid(sid);
 	if (domain == NULL) {
 		DEBUG(5, ("Could not find domain for sid %s\n",
-			  sid_string_static(sid)));
+			  sid_string_dbg(sid)));
 		cont(private_data, False, NULL, NULL, SID_NAME_UNKNOWN);
 		return;
 	}
@@ -788,7 +788,7 @@ void winbindd_gettoken_async(TALLOC_CTX *mem_ctx, const DOM_SID *user_sid,
 	domain = find_domain_from_sid_noinit(user_sid);
 	if (domain == NULL) {
 		DEBUG(5, ("Could not find domain from SID %s\n",
-			  sid_string_static(user_sid)));
+			  sid_string_dbg(user_sid)));
 		cont(private_data, False, NULL, 0);
 		return;
 	}
diff --git a/source3/winbindd/winbindd_cache.c b/source3/winbindd/winbindd_cache.c
index 7ec8208f4b..c4554a2ad4 100644
--- a/source3/winbindd/winbindd_cache.c
+++ b/source3/winbindd/winbindd_cache.c
@@ -855,8 +855,8 @@ static void wcache_save_name_to_sid(struct winbindd_domain *domain,
 	fstrcpy(uname, name);
 	strupper_m(uname);
 	centry_end(centry, "NS/%s/%s", domain_name, uname);
-	DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name, uname,
-		  sid_string_static(sid), nt_errstr(status)));
+	DEBUG(10,("wcache_save_name_to_sid: %s\\%s -> %s (%s)\n", domain_name,
+		  uname, sid_string_dbg(sid), nt_errstr(status)));
 	centry_free(centry);
 }
 
@@ -1010,7 +1010,7 @@ NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
 	centry = wcache_fetch(cache, domain, "CRED/%s", sid_string_static(sid));
 	if (!centry) {
 		DEBUG(10,("wcache_get_creds: entry for [CRED/%s] not found\n", 
-				sid_string_static(sid)));
+			  sid_string_dbg(sid)));
 		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
 
@@ -1023,7 +1023,9 @@ NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
 
 	*cached_nt_pass = (const uint8 *)centry_hash16(centry, mem_ctx);
 	if (*cached_nt_pass == NULL) {
-		const char *sidstr = sid_string_static(sid);
+		fstring sidstr;
+
+		sid_to_string(sidstr, sid);
 
 		/* Bad (old) cred cache. Delete and pretend we
 		   don't have it. */
@@ -1049,7 +1051,7 @@ NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
 	status = centry->status;
 
 	DEBUG(10,("wcache_get_creds: [Cached] - cached creds for user %s status: %s\n",
-		sid_string_static(sid), nt_errstr(status) ));
+		  sid_string_dbg(sid), nt_errstr(status) ));
 
 	centry_free(centry);
 	return status;
@@ -3696,7 +3698,7 @@ bool wcache_tdc_add_domain( struct winbindd_domain *domain )
 	DEBUG(10,("wcache_tdc_add_domain: Adding domain %s (%s), SID %s, "
 		  "flags = 0x%x, attributes = 0x%x, type = 0x%x\n",
 		  domain->name, domain->alt_name, 
-		  sid_string_static(&domain->sid),
+		  sid_string_dbg(&domain->sid),
 		  domain->domain_flags,
 		  domain->domain_trust_attribs,
 		  domain->domain_type));	
@@ -3815,7 +3817,7 @@ static void wcache_save_user_pwinfo(struct winbindd_domain *domain,
 	
 	centry_end(centry, "NSS/PWINFO/%s", sid_string_static(user_sid) );
 
-	DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_static(user_sid) ));
+	DEBUG(10,("wcache_save_user_pwinfo: %s\n", sid_string_dbg(user_sid) ));
 
 	centry_free(centry);
 }
@@ -3847,7 +3849,7 @@ NTSTATUS nss_get_info_cached( struct winbindd_domain *domain,
 	centry_free(centry);
 
 	DEBUG(10,("nss_get_info_cached: [Cached] - user_sid %s\n",
-		  sid_string_static(user_sid)));
+		  sid_string_dbg(user_sid)));
 
 	return NT_STATUS_OK;
 
diff --git a/source3/winbindd/winbindd_group.c b/source3/winbindd/winbindd_group.c
index 30e274ff86..dc8cebf92f 100644
--- a/source3/winbindd/winbindd_group.c
+++ b/source3/winbindd/winbindd_group.c
@@ -77,7 +77,7 @@ static void add_expanded_sid(const DOM_SID *sid, char **pp_members, size_t *p_nu
 
 	if (domain == NULL) {
 		DEBUG(3, ("Could not find domain for sid %s\n",
-			  sid_string_static(sid)));
+			  sid_string_dbg(sid)));
 		goto done;
 	}
 
@@ -86,7 +86,7 @@ static void add_expanded_sid(const DOM_SID *sid, char **pp_members, size_t *p_nu
 
 	if (!NT_STATUS_IS_OK(result)) {
 		DEBUG(3, ("sid_to_name failed for sid %s\n",
-			  sid_string_static(sid)));
+			  sid_string_dbg(sid)));
 		goto done;
 	}
 
@@ -109,7 +109,7 @@ static void add_expanded_sid(const DOM_SID *sid, char **pp_members, size_t *p_nu
 
 	if (domain == NULL) {
 		DEBUG(3, ("Could not find domain from SID %s\n",
-			  sid_string_static(sid)));
+			  sid_string_dbg(sid)));
 		goto done;
 	}
 
@@ -126,7 +126,7 @@ static void add_expanded_sid(const DOM_SID *sid, char **pp_members, size_t *p_nu
 
 	for (i=0; i<num_names; i++) {
 		DEBUG(10, ("Adding group member SID %s\n",
-			   sid_string_static(&sid_mem[i])));
+			   sid_string_dbg(&sid_mem[i])));
 
 		if (types[i] != SID_NAME_USER) {
 			DEBUG(1, ("Hmmm. Member %s of group %s is no user. "
@@ -234,7 +234,7 @@ static bool fill_grent_mem_domusers( TALLOC_CTX *mem_ctx,
 				pquerying_user_sid = &querying_user_sid;
 				DEBUG(10,("fill_grent_mem_domain_users: querying uid %u -> %s\n",
 					  (unsigned int)ret_uid,
-					  sid_string_static(pquerying_user_sid) ));
+					  sid_string_dbg(pquerying_user_sid)));
 			}
 		}
 	}
@@ -244,7 +244,7 @@ static bool fill_grent_mem_domusers( TALLOC_CTX *mem_ctx,
 	    (sid_compare_domain(pquerying_user_sid, &domain->sid) == 0)) {
 		
 		DEBUG(10,("fill_grent_mem_domain_users: querying user = %s\n",
-			  sid_string_static(pquerying_user_sid) ));
+			  sid_string_dbg(pquerying_user_sid) ));
 		
 		status = domain->methods->lookup_usergroups(domain,
 							    mem_ctx,
@@ -254,7 +254,7 @@ static bool fill_grent_mem_domusers( TALLOC_CTX *mem_ctx,
 		if (!NT_STATUS_IS_OK(status)) {
 			DEBUG(1, ("fill_grent_mem_domain_users: lookup_usergroups failed "
 				  "for sid %s in domain %s (error: %s)\n", 
-				  sid_string_static(pquerying_user_sid),
+				  sid_string_dbg(pquerying_user_sid),
 				  domain->name,
 				  nt_errstr(status)));
 		        return False;			
@@ -278,7 +278,8 @@ static bool fill_grent_mem_domusers( TALLOC_CTX *mem_ctx,
 		enum lsa_SidType type;
 		
 		DEBUG(10,("fill_grent_mem_domain_users: sid %s in 'Domain Users' in domain %s\n",
-			  sid_string_static(pquerying_user_sid), domain->name ));
+			  sid_string_dbg(pquerying_user_sid),
+			  domain->name ));
 		
 		status = domain->methods->sid_to_name(domain, mem_ctx,
 						      pquerying_user_sid,
@@ -288,7 +289,7 @@ static bool fill_grent_mem_domusers( TALLOC_CTX *mem_ctx,
 		if (!NT_STATUS_IS_OK(status)) {
 			DEBUG(1, ("could not lookup username for user "
 				  "sid %s in domain %s (error: %s)\n", 
-				  sid_string_static(pquerying_user_sid),
+				  sid_string_dbg(pquerying_user_sid),
 				  domain->name,
 				  nt_errstr(status)));
 			return False;			
@@ -488,7 +489,7 @@ static bool fill_grent_mem(struct winbindd_domain *domain,
 	if (!(mem_ctx = talloc_init("fill_grent_mem(%s)", domain->name)))
 		return False;
 
-	DEBUG(10, ("group SID %s\n", sid_string_static(group_sid)));
+	DEBUG(10, ("group SID %s\n", sid_string_dbg(group_sid)));
 
 	/* Initialize with no members */
 
@@ -511,8 +512,8 @@ static bool fill_grent_mem(struct winbindd_domain *domain,
 	       ((group_name_type==SID_NAME_ALIAS) && domain->primary)) )
 	{
 		DEBUG(1, ("SID %s in domain %s isn't a domain group (%d)\n", 
-			  sid_string_static(group_sid), domain->name, 
-			  group_name_type));
+			  sid_string_dbg(group_sid),
+			  domain->name, group_name_type));
                 goto done;
 	}
 
@@ -836,7 +837,7 @@ static void winbindd_getgrsid( struct winbindd_cli_state *state, const DOM_SID g
 
 	if ( (s->domain = find_domain_from_sid_noinit(&group_sid)) == NULL ) {
 		DEBUG(3, ("Could not find domain for sid %s\n",
-			  sid_string_static(&group_sid)));
+			  sid_string_dbg(&group_sid)));
 		request_error(state);
 		return;
 	}
@@ -1191,7 +1192,7 @@ void winbindd_getgrent(struct winbindd_cli_state *state)
 			enum lsa_SidType type;
 
 			DEBUG(10, ("SID %s not in idmap\n",
-				   sid_string_static(&group_sid)));
+				   sid_string_dbg(&group_sid)));
 
 			if (!pdb_sid_to_id(&group_sid, &id, &type)) {
 				DEBUG(1, ("could not look up gid for group "
@@ -1690,7 +1691,7 @@ void winbindd_getuserdomgroups(struct winbindd_cli_state *state)
 	/* Get info for the domain */	
 	if ((domain = find_domain_from_sid_noinit(&user_sid)) == NULL) {
 		DEBUG(0,("could not find domain entry for sid %s\n", 
-			 sid_string_static(&user_sid)));
+			 sid_string_dbg(&user_sid)));
 		request_error(state);
 		return;
 	}
diff --git a/source3/winbindd/winbindd_idmap.c b/source3/winbindd/winbindd_idmap.c
index 6f7b562415..ebea6a7495 100644
--- a/source3/winbindd/winbindd_idmap.c
+++ b/source3/winbindd/winbindd_idmap.c
@@ -385,7 +385,9 @@ enum winbindd_result winbindd_dual_sid2gid(struct winbindd_domain *domain,
 
 	result = idmap_sid_to_gid(&sid, &state->response.data.gid);
 
-	DEBUG(10, ("winbindd_dual_sid2gid: 0x%08x - %s - %u\n", NT_STATUS_V(result), sid_string_static(&sid), state->response.data.gid));
+	DEBUG(10, ("winbindd_dual_sid2gid: 0x%08x - %s - %u\n",
+		   NT_STATUS_V(result), sid_string_dbg(&sid),
+		   state->response.data.gid));
 
 	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
index 4eda0fcada..8a372a3a8c 100644
--- a/source3/winbindd/winbindd_pam.c
+++ b/source3/winbindd/winbindd_pam.c
@@ -304,7 +304,7 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 	debug_nt_user_token(DBGC_CLASS, 10, token);
 
 	for (i=0; i<num_require_membership_of_sid; i++) {
-		DEBUG(10, ("Checking SID %s\n", sid_string_static(
+		DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
 				   &require_membership_of_sid[i])));
 		if (nt_token_check_sid(&require_membership_of_sid[i],
 				       token)) {
diff --git a/source3/winbindd/winbindd_passdb.c b/source3/winbindd/winbindd_passdb.c
index f925ac2153..29db8be857 100644
--- a/source3/winbindd/winbindd_passdb.c
+++ b/source3/winbindd/winbindd_passdb.c
@@ -132,7 +132,7 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain,
 {
 	const char *dom, *nam;
 
-	DEBUG(10, ("Converting SID %s\n", sid_string_static(sid)));
+	DEBUG(10, ("Converting SID %s\n", sid_string_dbg(sid)));
 
 	/* Paranoia check */
 	if (!sid_check_is_in_builtin(sid) &&
@@ -144,7 +144,7 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain,
 	    !sid_check_is_in_wellknown_domain(sid))
 	{
 		DEBUG(0, ("Possible deadlock: Trying to lookup SID %s with "
-			  "passdb backend\n", sid_string_static(sid)));
+			  "passdb backend\n", sid_string_dbg(sid)));
 		return NT_STATUS_NONE_MAPPED;
 	}
 
diff --git a/source3/winbindd/winbindd_rpc.c b/source3/winbindd/winbindd_rpc.c
index dd45060412..ffb47692cb 100644
--- a/source3/winbindd/winbindd_rpc.c
+++ b/source3/winbindd/winbindd_rpc.c
@@ -313,8 +313,8 @@ NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
 	struct rpc_pipe_client *cli;
 	POLICY_HND lsa_policy;
 
-	DEBUG(3,("sid_to_name [rpc] %s for domain %s\n", sid_string_static(sid),
-			domain->name ));
+	DEBUG(3,("sid_to_name [rpc] %s for domain %s\n", sid_string_dbg(sid),
+		 domain->name ));
 
 	result = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
 	if (!NT_STATUS_IS_OK(result)) {
@@ -409,13 +409,11 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
 	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 	POLICY_HND dom_pol, user_pol;
 	SAM_USERINFO_CTR *ctr;
-	fstring sid_string;
 	uint32 user_rid;
 	NET_USER_INFO_3 *user;
 	struct rpc_pipe_client *cli;
 
-	DEBUG(3,("rpc: query_user sid=%s\n",
-		 sid_to_string(sid_string, user_sid)));
+	DEBUG(3,("rpc: query_user sid=%s\n", sid_string_dbg(user_sid)));
 
 	if (!sid_peek_check_rid(&domain->sid, user_sid, &user_rid))
 		return NT_STATUS_UNSUCCESSFUL;
@@ -430,7 +428,7 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
 	{
 				
 		DEBUG(5,("query_user: Cache lookup succeeded for %s\n", 
-			sid_string_static(user_sid)));
+			sid_string_dbg(user_sid)));
 
 		sid_compose(&user_info->user_sid, &domain->sid, user->user_rid);
 		sid_compose(&user_info->group_sid, &domain->sid,
@@ -506,12 +504,10 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 	uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED;
 	DOM_GID *user_groups;
 	unsigned int i;
-	fstring sid_string;
 	uint32 user_rid;
 	struct rpc_pipe_client *cli;
 
-	DEBUG(3,("rpc: lookup_usergroups sid=%s\n",
-		 sid_to_string(sid_string, user_sid)));
+	DEBUG(3,("rpc: lookup_usergroups sid=%s\n", sid_string_dbg(user_sid)));
 
 	if (!sid_peek_check_rid(&domain->sid, user_sid, &user_rid))
 		return NT_STATUS_UNSUCCESSFUL;
@@ -677,12 +673,11 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 	uint32 *rid_mem = NULL;
 	uint32 group_rid;
 	unsigned int j;
-	fstring sid_string;
 	struct rpc_pipe_client *cli;
 	unsigned int orig_timeout;
 
 	DEBUG(10,("rpc: lookup_groupmem %s sid=%s\n", domain->name,
-		  sid_to_string(sid_string, group_sid)));
+		  sid_string_dbg(group_sid)));
 
 	if ( !winbindd_can_contact_domain( domain ) ) {
 		DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
diff --git a/source3/winbindd/winbindd_user.c b/source3/winbindd/winbindd_user.c
index 01cdd0a9d3..6241d84fe6 100644
--- a/source3/winbindd/winbindd_user.c
+++ b/source3/winbindd/winbindd_user.c
@@ -73,7 +73,6 @@ static bool winbindd_fill_pwent(char *dom_name, char *user_name,
 				struct winbindd_pw *pw)
 {
 	fstring output_username;
-	fstring sid_string;
 	
 	if (!pw || !dom_name || !user_name)
 		return False;
@@ -81,14 +80,16 @@ static bool winbindd_fill_pwent(char *dom_name, char *user_name,
 	/* Resolve the uid number */
 
 	if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid, &pw->pw_uid))) {
-		DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string, user_sid)));
+		DEBUG(1, ("error getting user id for sid %s\n",
+			  sid_string_dbg(user_sid)));
 		return False;
 	}
 	
 	/* Resolve the gid number */   
 
 	if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid, &pw->pw_gid))) {
-		DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string, group_sid)));
+		DEBUG(1, ("error getting group id for sid %s\n",
+			  sid_string_dbg(group_sid)));
 		return False;
 	}
 
@@ -146,7 +147,7 @@ enum winbindd_result winbindd_dual_userinfo(struct winbindd_domain *domain,
 					     &sid, &user_info);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(1, ("error getting user info for sid %s\n",
-			  sid_string_static(&sid)));
+			  sid_string_dbg(&sid)));
 		return WINBINDD_ERROR;
 	}
 
@@ -158,7 +159,7 @@ enum winbindd_result winbindd_dual_userinfo(struct winbindd_domain *domain,
 	if (!sid_peek_check_rid(&domain->sid, &user_info.group_sid,
 				&state->response.data.user_info.group_rid)) {
 		DEBUG(1, ("Could not extract group rid out of %s\n",
-			  sid_string_static(&sid)));
+			  sid_string_dbg(&sid)));
 		return WINBINDD_ERROR;
 	}
 
@@ -203,7 +204,7 @@ static void winbindd_getpwsid(struct winbindd_cli_state *state,
 	s->domain = find_domain_from_sid_noinit(sid);
 	if (s->domain == NULL) {
 		DEBUG(3, ("Could not find domain for sid %s\n",
-			  sid_string_static(sid)));
+			  sid_string_dbg(sid)));
 		goto error;
 	}
 
@@ -230,8 +231,8 @@ static void getpwsid_queryuser_recv(void *private_data, bool success,
 		talloc_get_type_abort(private_data, struct getpwsid_state);
 
 	if (!success) {
-		DEBUG(5, ("Could not query domain %s SID %s\n", s->domain->name,
-			  sid_string_static(&s->user_sid)));
+		DEBUG(5, ("Could not query domain %s SID %s\n",
+			  s->domain->name, sid_string_dbg(&s->user_sid)));
 		request_error(s->state);
 		return;
 	}
@@ -247,7 +248,7 @@ static void getpwsid_queryuser_recv(void *private_data, bool success,
 		domain = find_lookup_domain_from_sid(&s->user_sid);
 		if (domain == NULL) {
 			DEBUG(5, ("find_lookup_domain_from_sid(%s) failed\n",
-				  sid_string_static(&s->user_sid)));
+				  sid_string_dbg(&s->user_sid)));
 			request_error(s->state);
 			return;			
 		}
@@ -258,7 +259,7 @@ static void getpwsid_queryuser_recv(void *private_data, bool success,
 		/* If this still fails we ar4e done.  Just error out */
 		if ( !user_name ) {
 			DEBUG(5,("Could not obtain a name for SID %s\n",
-				 sid_string_static(&s->user_sid)));			
+				 sid_string_dbg(&s->user_sid)));
 			request_error(s->state);
 			return;			
 		}
diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index 2389a4be13..b552aac709 100644
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -193,7 +193,7 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const
         
 	DEBUG(2,("Added domain %s %s %s\n", 
 		 domain->name, domain->alt_name,
-		 &domain->sid?sid_string_static(&domain->sid):""));
+		 &domain->sid?sid_string_dbg(&domain->sid):""));
         
 	return domain;
 }
@@ -922,8 +922,7 @@ struct winbindd_domain *find_lookup_domain_from_sid(const DOM_SID *sid)
 	 * one to contact the external DC's. On member servers the internal
 	 * domains are different: These are part of the local SAM. */
 
-	DEBUG(10, ("find_lookup_domain_from_sid(%s)\n",
-		   sid_string_static(sid)));
+	DEBUG(10, ("find_lookup_domain_from_sid(%s)\n", sid_string_dbg(sid)));
 
 	if (IS_DC || is_internal_domain(sid) || is_in_internal_domain(sid)) {
 		DEBUG(10, ("calling find_domain_from_sid\n"));