s3: Attempt to fix bug 7665

Quite a few of our internal routines put stuff on talloc_tos() these days.
In top-level netapi routines, properly allocate a stackframe and clean it
again. Also, don't leak memory in the rpccli_ callers onto the libnetapi
context.

11 files changed, 295 insertions, 136 deletions

diff --git a/source3/lib/netapi/file.c b/source3/lib/netapi/file.c
index 1c3ef6d78f..6d76be0500 100644
--- a/source3/lib/netapi/file.c
+++ b/source3/lib/netapi/file.c
@@ -42,7 +42,7 @@ WERROR NetFileClose_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_srvsvc_NetFileClose(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetFileClose(pipe_cli, talloc_tos(),
 					    r->in.server_name,
 					    r->in.fileid,
 					    &werr);
@@ -136,7 +136,7 @@ WERROR NetFileGetInfo_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_srvsvc_NetFileGetInfo(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetFileGetInfo(pipe_cli, talloc_tos(),
 					      r->in.server_name,
 					      r->in.fileid,
 					      r->in.level,
@@ -216,7 +216,7 @@ WERROR NetFileEnum_r(struct libnetapi_ctx *ctx,
 			break;
 	}
 
-	status = rpccli_srvsvc_NetFileEnum(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetFileEnum(pipe_cli, talloc_tos(),
 					   r->in.server_name,
 					   r->in.base_path,
 					   r->in.user_name,
diff --git a/source3/lib/netapi/getdc.c b/source3/lib/netapi/getdc.c
index 904270242a..faf2672a14 100644
--- a/source3/lib/netapi/getdc.c
+++ b/source3/lib/netapi/getdc.c
@@ -51,7 +51,7 @@ WERROR NetGetDCName_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_netr_GetDcName(pipe_cli, ctx,
+	status = rpccli_netr_GetDcName(pipe_cli, talloc_tos(),
 				       r->in.server_name,
 				       r->in.domain_name,
 				       (const char **)r->out.buffer,
@@ -91,7 +91,7 @@ WERROR NetGetAnyDCName_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_netr_GetAnyDCName(pipe_cli, ctx,
+	status = rpccli_netr_GetAnyDCName(pipe_cli, talloc_tos(),
 					  r->in.server_name,
 					  r->in.domain_name,
 					  (const char **)r->out.buffer,
diff --git a/source3/lib/netapi/group.c b/source3/lib/netapi/group.c
index 6a926953c0..9b9d8f0855 100644
--- a/source3/lib/netapi/group.c
+++ b/source3/lib/netapi/group.c
@@ -107,7 +107,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 			break;
 	}
 
-	status = rpccli_samr_CreateDomainGroup(pipe_cli, ctx,
+	status = rpccli_samr_CreateDomainGroup(pipe_cli, talloc_tos(),
 					       &domain_handle,
 					       &lsa_group_name,
 					       SEC_STD_DELETE |
@@ -126,7 +126,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 				init_lsa_String(&info.description,
 						info1->grpi1_comment);
 
-				status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+				status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 								  &group_handle,
 								  GROUPINFODESCRIPTION,
 								  &info);
@@ -137,7 +137,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 				init_lsa_String(&info.description,
 						info2->grpi2_comment);
 
-				status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+				status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 								  &group_handle,
 								  GROUPINFODESCRIPTION,
 								  &info);
@@ -149,7 +149,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 
 			if (info2->grpi2_attributes != 0) {
 				info.attributes.attributes = info2->grpi2_attributes;
-				status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+				status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 								  &group_handle,
 								  GROUPINFOATTRIBUTES,
 								  &info);
@@ -161,7 +161,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 				init_lsa_String(&info.description,
 						info3->grpi3_comment);
 
-				status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+				status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 								  &group_handle,
 								  GROUPINFODESCRIPTION,
 								  &info);
@@ -173,7 +173,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 
 			if (info3->grpi3_attributes != 0) {
 				info.attributes.attributes = info3->grpi3_attributes;
-				status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+				status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 								  &group_handle,
 								  GROUPINFOATTRIBUTES,
 								  &info);
@@ -192,12 +192,12 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 	goto done;
 
  failed:
-	rpccli_samr_DeleteDomainGroup(pipe_cli, ctx,
+	rpccli_samr_DeleteDomainGroup(pipe_cli, talloc_tos(),
 				      &group_handle);
 
  done:
 	if (is_valid_policy_hnd(&group_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -264,7 +264,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_group_name, r->in.group_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_group_name,
@@ -280,7 +280,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+	status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
 				       &domain_handle,
 				       SEC_STD_DELETE |
 				       SAMR_GROUP_ACCESS_GET_MEMBERS |
@@ -294,7 +294,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_QueryGroupInfo(pipe_cli, ctx,
+	status = rpccli_samr_QueryGroupInfo(pipe_cli, talloc_tos(),
 					    &group_handle,
 					    GROUPINFOATTRIBUTES,
 					    &info);
@@ -310,7 +310,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 #endif
-	status = rpccli_samr_QueryGroupMember(pipe_cli, ctx,
+	status = rpccli_samr_QueryGroupMember(pipe_cli, talloc_tos(),
 					      &group_handle,
 					      &rid_array);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -322,7 +322,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 	struct lsa_Strings names;
 	struct samr_Ids member_types;
 
-	status = rpccli_samr_LookupRids(pipe_cli, ctx,
+	status = rpccli_samr_LookupRids(pipe_cli, talloc_tos(),
 					&domain_handle,
 					rid_array->count,
 					rid_array->rids,
@@ -336,7 +336,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 
 	for (i=0; i < rid_array->count; i++) {
 
-		status = rpccli_samr_DeleteGroupMember(pipe_cli, ctx,
+		status = rpccli_samr_DeleteGroupMember(pipe_cli, talloc_tos(),
 						       &group_handle,
 						       rid_array->rids[i]);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -345,7 +345,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 		}
 	}
 
-	status = rpccli_samr_DeleteDomainGroup(pipe_cli, ctx,
+	status = rpccli_samr_DeleteDomainGroup(pipe_cli, talloc_tos(),
 					       &group_handle);
 	if (!NT_STATUS_IS_OK(status)) {
 		werr = ntstatus_to_werror(status);
@@ -358,7 +358,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&group_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -429,7 +429,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_group_name, r->in.group_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_group_name,
@@ -445,7 +445,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+	status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
 				       &domain_handle,
 				       SAMR_GROUP_ACCESS_SET_INFO |
 				       SAMR_GROUP_ACCESS_LOOKUP_INFO,
@@ -460,7 +460,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 		case 0:
 			g0 = (struct GROUP_INFO_0 *)r->in.buffer;
 			init_lsa_String(&info.name, g0->grpi0_name);
-			status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+			status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 							  &group_handle,
 							  GROUPINFONAME,
 							  &info);
@@ -468,7 +468,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 		case 1:
 			g1 = (struct GROUP_INFO_1 *)r->in.buffer;
 			init_lsa_String(&info.description, g1->grpi1_comment);
-			status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+			status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 							  &group_handle,
 							  GROUPINFODESCRIPTION,
 							  &info);
@@ -476,7 +476,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 		case 2:
 			g2 = (struct GROUP_INFO_2 *)r->in.buffer;
 			init_lsa_String(&info.description, g2->grpi2_comment);
-			status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+			status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 							  &group_handle,
 							  GROUPINFODESCRIPTION,
 							  &info);
@@ -485,7 +485,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 				goto done;
 			}
 			info.attributes.attributes = g2->grpi2_attributes;
-			status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+			status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 							  &group_handle,
 							  GROUPINFOATTRIBUTES,
 							  &info);
@@ -493,7 +493,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 		case 3:
 			g3 = (struct GROUP_INFO_3 *)r->in.buffer;
 			init_lsa_String(&info.description, g3->grpi3_comment);
-			status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+			status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 							  &group_handle,
 							  GROUPINFODESCRIPTION,
 							  &info);
@@ -502,7 +502,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 				goto done;
 			}
 			info.attributes.attributes = g3->grpi3_attributes;
-			status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+			status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 							  &group_handle,
 							  GROUPINFOATTRIBUTES,
 							  &info);
@@ -510,7 +510,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 		case 1002:
 			g1002 = (struct GROUP_INFO_1002 *)r->in.buffer;
 			init_lsa_String(&info.description, g1002->grpi1002_comment);
-			status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+			status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 							  &group_handle,
 							  GROUPINFODESCRIPTION,
 							  &info);
@@ -518,7 +518,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 		case 1005:
 			g1005 = (struct GROUP_INFO_1005 *)r->in.buffer;
 			info.attributes.attributes = g1005->grpi1005_attributes;
-			status = rpccli_samr_SetGroupInfo(pipe_cli, ctx,
+			status = rpccli_samr_SetGroupInfo(pipe_cli, talloc_tos(),
 							  &group_handle,
 							  GROUPINFOATTRIBUTES,
 							  &info);
@@ -537,7 +537,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&group_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -664,7 +664,7 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_group_name, r->in.group_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_group_name,
@@ -680,7 +680,7 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+	status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
 				       &domain_handle,
 				       SAMR_GROUP_ACCESS_LOOKUP_INFO,
 				       rids.ids[0],
@@ -690,12 +690,12 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_QueryGroupInfo(pipe_cli, ctx,
+	status = rpccli_samr_QueryGroupInfo(pipe_cli, talloc_tos(),
 					    &group_handle,
 					    GROUPINFOALL2,
 					    &info);
 	if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
-		status = rpccli_samr_QueryGroupInfo(pipe_cli, ctx,
+		status = rpccli_samr_QueryGroupInfo(pipe_cli, talloc_tos(),
 						    &group_handle,
 						    GROUPINFOALL,
 						    &info);
@@ -716,7 +716,7 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
 	}
  done:
 	if (is_valid_policy_hnd(&group_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -780,7 +780,7 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_group_name, r->in.group_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_group_name,
@@ -796,7 +796,7 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+	status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
 				       &domain_handle,
 				       SAMR_GROUP_ACCESS_ADD_MEMBER,
 				       rids.ids[0],
@@ -808,7 +808,7 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_user_name, r->in.user_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_user_name,
@@ -824,7 +824,7 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_AddGroupMember(pipe_cli, ctx,
+	status = rpccli_samr_AddGroupMember(pipe_cli, talloc_tos(),
 					    &group_handle,
 					    rids.ids[0],
 					    7); /* why ? */
@@ -837,7 +837,7 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&group_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -901,7 +901,7 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_group_name, r->in.group_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_group_name,
@@ -917,7 +917,7 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+	status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
 				       &domain_handle,
 				       SAMR_GROUP_ACCESS_REMOVE_MEMBER,
 				       rids.ids[0],
@@ -929,7 +929,7 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_user_name, r->in.user_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_user_name,
@@ -945,7 +945,7 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_DeleteGroupMember(pipe_cli, ctx,
+	status = rpccli_samr_DeleteGroupMember(pipe_cli, talloc_tos(),
 					       &group_handle,
 					       rids.ids[0]);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -957,7 +957,7 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&group_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -1179,7 +1179,7 @@ WERROR NetGroupEnum_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_QueryDomainInfo(pipe_cli, ctx,
+	status = rpccli_samr_QueryDomainInfo(pipe_cli, talloc_tos(),
 					     &domain_handle,
 					     2,
 					     &domain_info);
@@ -1310,7 +1310,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, r->in.group_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_account_name,
@@ -1321,7 +1321,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+	status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
 				       &domain_handle,
 				       SAMR_GROUP_ACCESS_GET_MEMBERS,
 				       group_rids.ids[0],
@@ -1331,7 +1331,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_QueryGroupMember(pipe_cli, ctx,
+	status = rpccli_samr_QueryGroupMember(pipe_cli, talloc_tos(),
 					      &group_handle,
 					      &rid_array);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -1339,7 +1339,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_LookupRids(pipe_cli, ctx,
+	status = rpccli_samr_LookupRids(pipe_cli, talloc_tos(),
 					&domain_handle,
 					rid_array->count,
 					rid_array->rids,
@@ -1375,7 +1375,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&group_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -1461,7 +1461,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, r->in.group_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_account_name,
@@ -1472,7 +1472,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+	status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
 				       &domain_handle,
 				       SAMR_GROUP_ACCESS_GET_MEMBERS |
 				       SAMR_GROUP_ACCESS_ADD_MEMBER |
@@ -1485,7 +1485,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_QueryGroupInfo(pipe_cli, ctx,
+	status = rpccli_samr_QueryGroupInfo(pipe_cli, talloc_tos(),
 					    &group_handle,
 					    GROUPINFOATTRIBUTES,
 					    &group_info);
@@ -1523,7 +1523,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 		}
 	}
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 r->in.num_entries,
 					 lsa_names,
@@ -1536,7 +1536,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 
 	member_rids = user_rids.ids;
 
-	status = rpccli_samr_QueryGroupMember(pipe_cli, ctx,
+	status = rpccli_samr_QueryGroupMember(pipe_cli, talloc_tos(),
 					      &group_handle,
 					      &rid_array);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -1587,7 +1587,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 	/* add list */
 
 	for (i=0; i < num_add_rids; i++) {
-		status = rpccli_samr_AddGroupMember(pipe_cli, ctx,
+		status = rpccli_samr_AddGroupMember(pipe_cli, talloc_tos(),
 						    &group_handle,
 						    add_rids[i],
 						    7 /* ? */);
@@ -1600,7 +1600,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 	/* del list */
 
 	for (i=0; i < num_del_rids; i++) {
-		status = rpccli_samr_DeleteGroupMember(pipe_cli, ctx,
+		status = rpccli_samr_DeleteGroupMember(pipe_cli, talloc_tos(),
 						       &group_handle,
 						       del_rids[i]);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -1613,7 +1613,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&group_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
diff --git a/source3/lib/netapi/joindomain.c b/source3/lib/netapi/joindomain.c
index e5777a0d33..3905709d50 100644
--- a/source3/lib/netapi/joindomain.c
+++ b/source3/lib/netapi/joindomain.c
@@ -128,7 +128,7 @@ WERROR NetJoinDomain_r(struct libnetapi_ctx *ctx,
 
 	old_timeout = rpccli_set_timeout(pipe_cli, 600000);
 
-	status = rpccli_wkssvc_NetrJoinDomain2(pipe_cli, ctx,
+	status = rpccli_wkssvc_NetrJoinDomain2(pipe_cli, talloc_tos(),
 					       r->in.server,
 					       r->in.domain,
 					       r->in.account_ou,
@@ -258,7 +258,7 @@ WERROR NetUnjoinDomain_r(struct libnetapi_ctx *ctx,
 
 	old_timeout = rpccli_set_timeout(pipe_cli, 60000);
 
-	status = rpccli_wkssvc_NetrUnjoinDomain2(pipe_cli, ctx,
+	status = rpccli_wkssvc_NetrUnjoinDomain2(pipe_cli, talloc_tos(),
 						 r->in.server_name,
 						 r->in.account,
 						 encrypted_password,
@@ -295,7 +295,7 @@ WERROR NetGetJoinInformation_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_wkssvc_NetrGetJoinInformation(pipe_cli, ctx,
+	status = rpccli_wkssvc_NetrGetJoinInformation(pipe_cli, talloc_tos(),
 						      r->in.server_name,
 						      &buffer,
 						      (enum wkssvc_NetJoinStatus *)r->out.name_type,
@@ -436,7 +436,7 @@ WERROR NetGetJoinableOUs_r(struct libnetapi_ctx *ctx,
 						   &encrypted_password);
 	}
 
-	status = rpccli_wkssvc_NetrGetJoinableOus2(pipe_cli, ctx,
+	status = rpccli_wkssvc_NetrGetJoinableOus2(pipe_cli, talloc_tos(),
 						   r->in.server_name,
 						   r->in.domain,
 						   r->in.account,
@@ -478,7 +478,7 @@ WERROR NetRenameMachineInDomain_r(struct libnetapi_ctx *ctx,
 						   &encrypted_password);
 	}
 
-	status = rpccli_wkssvc_NetrRenameMachineInDomain2(pipe_cli, ctx,
+	status = rpccli_wkssvc_NetrRenameMachineInDomain2(pipe_cli, talloc_tos(),
 							  r->in.server_name,
 							  r->in.new_machine_name,
 							  r->in.account,
diff --git a/source3/lib/netapi/libnetapi.c b/source3/lib/netapi/libnetapi.c
index c50f372e8e..45bb1d5d82 100644
--- a/source3/lib/netapi/libnetapi.c
+++ b/source3/lib/netapi/libnetapi.c
@@ -39,9 +39,11 @@ NET_API_STATUS NetJoinDomain(const char * server /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -71,6 +73,7 @@ NET_API_STATUS NetJoinDomain(const char * server /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetJoinDomain, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -87,9 +90,11 @@ NET_API_STATUS NetUnjoinDomain(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -117,6 +122,7 @@ NET_API_STATUS NetUnjoinDomain(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetUnjoinDomain, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -132,9 +138,11 @@ NET_API_STATUS NetGetJoinInformation(const char * server_name /* [in] [unique] *
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -161,6 +169,7 @@ NET_API_STATUS NetGetJoinInformation(const char * server_name /* [in] [unique] *
 		NDR_PRINT_OUT_DEBUG(NetGetJoinInformation, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -179,9 +188,11 @@ NET_API_STATUS NetGetJoinableOUs(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -211,6 +222,7 @@ NET_API_STATUS NetGetJoinableOUs(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetGetJoinableOUs, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -228,9 +240,11 @@ NET_API_STATUS NetRenameMachineInDomain(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -259,6 +273,7 @@ NET_API_STATUS NetRenameMachineInDomain(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetRenameMachineInDomain, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -274,9 +289,11 @@ NET_API_STATUS NetServerGetInfo(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -303,6 +320,7 @@ NET_API_STATUS NetServerGetInfo(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetServerGetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -319,9 +337,11 @@ NET_API_STATUS NetServerSetInfo(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -349,6 +369,7 @@ NET_API_STATUS NetServerSetInfo(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetServerSetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -364,9 +385,11 @@ NET_API_STATUS NetGetDCName(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -393,6 +416,7 @@ NET_API_STATUS NetGetDCName(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetGetDCName, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -408,9 +432,11 @@ NET_API_STATUS NetGetAnyDCName(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -437,6 +463,7 @@ NET_API_STATUS NetGetAnyDCName(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetGetAnyDCName, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -455,9 +482,11 @@ NET_API_STATUS DsGetDcName(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -487,6 +516,7 @@ NET_API_STATUS DsGetDcName(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(DsGetDcName, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -503,9 +533,11 @@ NET_API_STATUS NetUserAdd(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -533,6 +565,7 @@ NET_API_STATUS NetUserAdd(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetUserAdd, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -547,9 +580,11 @@ NET_API_STATUS NetUserDel(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -575,6 +610,7 @@ NET_API_STATUS NetUserDel(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetUserDel, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -595,9 +631,11 @@ NET_API_STATUS NetUserEnum(const char * server_name /* [in] [unique] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -630,6 +668,7 @@ NET_API_STATUS NetUserEnum(const char * server_name /* [in] [unique] */,
 		NDR_PRINT_OUT_DEBUG(NetUserEnum, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -646,9 +685,11 @@ NET_API_STATUS NetUserChangePassword(const char * domain_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -676,6 +717,7 @@ NET_API_STATUS NetUserChangePassword(const char * domain_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetUserChangePassword, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -692,9 +734,11 @@ NET_API_STATUS NetUserGetInfo(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -722,6 +766,7 @@ NET_API_STATUS NetUserGetInfo(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetUserGetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -739,9 +784,11 @@ NET_API_STATUS NetUserSetInfo(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -770,6 +817,7 @@ NET_API_STATUS NetUserSetInfo(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetUserSetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -789,9 +837,11 @@ NET_API_STATUS NetUserGetGroups(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -822,6 +872,7 @@ NET_API_STATUS NetUserGetGroups(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetUserGetGroups, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -839,9 +890,11 @@ NET_API_STATUS NetUserSetGroups(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -870,6 +923,7 @@ NET_API_STATUS NetUserSetGroups(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetUserSetGroups, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -890,9 +944,11 @@ NET_API_STATUS NetUserGetLocalGroups(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -924,6 +980,7 @@ NET_API_STATUS NetUserGetLocalGroups(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetUserGetLocalGroups, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -939,9 +996,11 @@ NET_API_STATUS NetUserModalsGet(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -968,6 +1027,7 @@ NET_API_STATUS NetUserModalsGet(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetUserModalsGet, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -984,9 +1044,11 @@ NET_API_STATUS NetUserModalsSet(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1014,6 +1076,7 @@ NET_API_STATUS NetUserModalsSet(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetUserModalsSet, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1033,9 +1096,11 @@ NET_API_STATUS NetQueryDisplayInformation(const char * server_name /* [in] [uniq
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1066,6 +1131,7 @@ NET_API_STATUS NetQueryDisplayInformation(const char * server_name /* [in] [uniq
 		NDR_PRINT_OUT_DEBUG(NetQueryDisplayInformation, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1082,9 +1148,11 @@ NET_API_STATUS NetGroupAdd(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1112,6 +1180,7 @@ NET_API_STATUS NetGroupAdd(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetGroupAdd, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1126,9 +1195,11 @@ NET_API_STATUS NetGroupDel(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1154,6 +1225,7 @@ NET_API_STATUS NetGroupDel(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetGroupDel, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1173,9 +1245,11 @@ NET_API_STATUS NetGroupEnum(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1207,6 +1281,7 @@ NET_API_STATUS NetGroupEnum(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetGroupEnum, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1224,9 +1299,11 @@ NET_API_STATUS NetGroupSetInfo(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1255,6 +1332,7 @@ NET_API_STATUS NetGroupSetInfo(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetGroupSetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1271,9 +1349,11 @@ NET_API_STATUS NetGroupGetInfo(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1301,6 +1381,7 @@ NET_API_STATUS NetGroupGetInfo(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetGroupGetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1316,9 +1397,11 @@ NET_API_STATUS NetGroupAddUser(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1345,6 +1428,7 @@ NET_API_STATUS NetGroupAddUser(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetGroupAddUser, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1360,9 +1444,11 @@ NET_API_STATUS NetGroupDelUser(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1389,6 +1475,7 @@ NET_API_STATUS NetGroupDelUser(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetGroupDelUser, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1409,9 +1496,11 @@ NET_API_STATUS NetGroupGetUsers(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1444,6 +1533,7 @@ NET_API_STATUS NetGroupGetUsers(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetGroupGetUsers, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1461,9 +1551,11 @@ NET_API_STATUS NetGroupSetUsers(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1492,6 +1584,7 @@ NET_API_STATUS NetGroupSetUsers(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetGroupSetUsers, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1508,9 +1601,11 @@ NET_API_STATUS NetLocalGroupAdd(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1538,6 +1633,7 @@ NET_API_STATUS NetLocalGroupAdd(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetLocalGroupAdd, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1552,9 +1648,11 @@ NET_API_STATUS NetLocalGroupDel(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1580,6 +1678,7 @@ NET_API_STATUS NetLocalGroupDel(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetLocalGroupDel, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1596,9 +1695,11 @@ NET_API_STATUS NetLocalGroupGetInfo(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1626,6 +1727,7 @@ NET_API_STATUS NetLocalGroupGetInfo(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetLocalGroupGetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1643,9 +1745,11 @@ NET_API_STATUS NetLocalGroupSetInfo(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1674,6 +1778,7 @@ NET_API_STATUS NetLocalGroupSetInfo(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetLocalGroupSetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1693,9 +1798,11 @@ NET_API_STATUS NetLocalGroupEnum(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1727,6 +1834,7 @@ NET_API_STATUS NetLocalGroupEnum(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetLocalGroupEnum, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1744,9 +1852,11 @@ NET_API_STATUS NetLocalGroupAddMembers(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1775,6 +1885,7 @@ NET_API_STATUS NetLocalGroupAddMembers(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetLocalGroupAddMembers, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1792,9 +1903,11 @@ NET_API_STATUS NetLocalGroupDelMembers(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1823,6 +1936,7 @@ NET_API_STATUS NetLocalGroupDelMembers(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetLocalGroupDelMembers, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1843,9 +1957,11 @@ NET_API_STATUS NetLocalGroupGetMembers(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1878,6 +1994,7 @@ NET_API_STATUS NetLocalGroupGetMembers(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetLocalGroupGetMembers, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1895,9 +2012,11 @@ NET_API_STATUS NetLocalGroupSetMembers(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1926,6 +2045,7 @@ NET_API_STATUS NetLocalGroupSetMembers(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetLocalGroupSetMembers, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1940,9 +2060,11 @@ NET_API_STATUS NetRemoteTOD(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -1968,6 +2090,7 @@ NET_API_STATUS NetRemoteTOD(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetRemoteTOD, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -1984,9 +2107,11 @@ NET_API_STATUS NetShareAdd(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2014,6 +2139,7 @@ NET_API_STATUS NetShareAdd(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetShareAdd, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2029,9 +2155,11 @@ NET_API_STATUS NetShareDel(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2058,6 +2186,7 @@ NET_API_STATUS NetShareDel(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetShareDel, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2077,9 +2206,11 @@ NET_API_STATUS NetShareEnum(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2111,6 +2242,7 @@ NET_API_STATUS NetShareEnum(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetShareEnum, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2127,9 +2259,11 @@ NET_API_STATUS NetShareGetInfo(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2157,6 +2291,7 @@ NET_API_STATUS NetShareGetInfo(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetShareGetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2174,9 +2309,11 @@ NET_API_STATUS NetShareSetInfo(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2205,6 +2342,7 @@ NET_API_STATUS NetShareSetInfo(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetShareSetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2219,9 +2357,11 @@ NET_API_STATUS NetFileClose(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2247,6 +2387,7 @@ NET_API_STATUS NetFileClose(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetFileClose, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2263,9 +2404,11 @@ NET_API_STATUS NetFileGetInfo(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2293,6 +2436,7 @@ NET_API_STATUS NetFileGetInfo(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetFileGetInfo, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2314,9 +2458,11 @@ NET_API_STATUS NetFileEnum(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2350,6 +2496,7 @@ NET_API_STATUS NetFileEnum(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetFileEnum, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2367,9 +2514,11 @@ NET_API_STATUS NetShutdownInit(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2398,6 +2547,7 @@ NET_API_STATUS NetShutdownInit(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(NetShutdownInit, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2411,9 +2561,11 @@ NET_API_STATUS NetShutdownAbort(const char * server_name /* [in] */)
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2438,6 +2590,7 @@ NET_API_STATUS NetShutdownAbort(const char * server_name /* [in] */)
 		NDR_PRINT_OUT_DEBUG(NetShutdownAbort, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2454,9 +2607,11 @@ NET_API_STATUS I_NetLogonControl(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2484,6 +2639,7 @@ NET_API_STATUS I_NetLogonControl(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(I_NetLogonControl, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
@@ -2501,9 +2657,11 @@ NET_API_STATUS I_NetLogonControl2(const char * server_name /* [in] */,
 	struct libnetapi_ctx *ctx = NULL;
 	NET_API_STATUS status;
 	WERROR werr;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	status = libnetapi_getctx(&ctx);
 	if (status != 0) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -2532,6 +2690,7 @@ NET_API_STATUS I_NetLogonControl2(const char * server_name /* [in] */,
 		NDR_PRINT_OUT_DEBUG(I_NetLogonControl2, &r);
 	}
 
+	TALLOC_FREE(frame);
 	return (NET_API_STATUS)r.out.result;
 }
 
diff --git a/source3/lib/netapi/localgroup.c b/source3/lib/netapi/localgroup.c
index c9e1b722bd..676f6df9ed 100644
--- a/source3/lib/netapi/localgroup.c
+++ b/source3/lib/netapi/localgroup.c
@@ -199,7 +199,7 @@ WERROR NetLocalGroupAdd_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, alias_name);
 
-	status = rpccli_samr_CreateDomAlias(pipe_cli, ctx,
+	status = rpccli_samr_CreateDomAlias(pipe_cli, talloc_tos(),
 					    &domain_handle,
 					    &lsa_account_name,
 					    SEC_STD_DELETE |
@@ -217,7 +217,7 @@ WERROR NetLocalGroupAdd_r(struct libnetapi_ctx *ctx,
 
 		init_lsa_String(&alias_info.description, info1->lgrpi1_comment);
 
-		status = rpccli_samr_SetAliasInfo(pipe_cli, ctx,
+		status = rpccli_samr_SetAliasInfo(pipe_cli, talloc_tos(),
 						  &alias_handle,
 						  ALIASINFODESCRIPTION,
 						  &alias_info);
@@ -231,7 +231,7 @@ WERROR NetLocalGroupAdd_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&alias_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &alias_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &alias_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -334,7 +334,7 @@ WERROR NetLocalGroupDel_r(struct libnetapi_ctx *ctx,
 
 
  delete_alias:
-	status = rpccli_samr_DeleteDomAlias(pipe_cli, ctx,
+	status = rpccli_samr_DeleteDomAlias(pipe_cli, talloc_tos(),
 					    &alias_handle);
 	if (!NT_STATUS_IS_OK(status)) {
 		werr = ntstatus_to_werror(status);
@@ -347,7 +347,7 @@ WERROR NetLocalGroupDel_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&alias_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &alias_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &alias_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -505,7 +505,7 @@ WERROR NetLocalGroupGetInfo_r(struct libnetapi_ctx *ctx,
 	}
 
  query_alias:
-	status = rpccli_samr_QueryAliasInfo(pipe_cli, ctx,
+	status = rpccli_samr_QueryAliasInfo(pipe_cli, talloc_tos(),
 					    &alias_handle,
 					    ALIASINFOALL,
 					    &alias_info);
@@ -522,7 +522,7 @@ WERROR NetLocalGroupGetInfo_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&alias_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &alias_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &alias_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -683,7 +683,7 @@ WERROR NetLocalGroupSetInfo_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_SetAliasInfo(pipe_cli, ctx,
+	status = rpccli_samr_SetAliasInfo(pipe_cli, talloc_tos(),
 					  &alias_handle,
 					  alias_level,
 					  alias_info);
@@ -696,7 +696,7 @@ WERROR NetLocalGroupSetInfo_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&alias_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &alias_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &alias_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -791,7 +791,7 @@ WERROR NetLocalGroupEnum_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_QueryDomainInfo(pipe_cli, ctx,
+	status = rpccli_samr_QueryDomainInfo(pipe_cli, talloc_tos(),
 					     &builtin_handle,
 					     2,
 					     &builtin_info);
@@ -804,7 +804,7 @@ WERROR NetLocalGroupEnum_r(struct libnetapi_ctx *ctx,
 		*r->out.total_entries += builtin_info->general.num_aliases;
 	}
 
-	status = rpccli_samr_QueryDomainInfo(pipe_cli, ctx,
+	status = rpccli_samr_QueryDomainInfo(pipe_cli, talloc_tos(),
 					     &domain_handle,
 					     2,
 					     &domain_info);
@@ -817,7 +817,7 @@ WERROR NetLocalGroupEnum_r(struct libnetapi_ctx *ctx,
 		*r->out.total_entries += domain_info->general.num_aliases;
 	}
 
-	status = rpccli_samr_EnumDomainAliases(pipe_cli, ctx,
+	status = rpccli_samr_EnumDomainAliases(pipe_cli, talloc_tos(),
 					       &builtin_handle,
 					       r->in.resume_handle,
 					       &builtin_sam_array,
@@ -853,7 +853,7 @@ WERROR NetLocalGroupEnum_r(struct libnetapi_ctx *ctx,
 						r->out.buffer);
 	}
 
-	status = rpccli_samr_EnumDomainAliases(pipe_cli, ctx,
+	status = rpccli_samr_EnumDomainAliases(pipe_cli, talloc_tos(),
 					       &domain_handle,
 					       r->in.resume_handle,
 					       &domain_sam_array,
@@ -1159,7 +1159,7 @@ static WERROR NetLocalGroupModifyMembers_r(struct libnetapi_ctx *ctx,
 
 		struct lsa_SidArray current_sids;
 
-		status = rpccli_samr_GetMembersInAlias(pipe_cli, ctx,
+		status = rpccli_samr_GetMembersInAlias(pipe_cli, talloc_tos(),
 						       &alias_handle,
 						       &current_sids);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -1215,7 +1215,7 @@ static WERROR NetLocalGroupModifyMembers_r(struct libnetapi_ctx *ctx,
 	/* add list */
 
 	for (i=0; i < num_add_sids; i++) {
-		status = rpccli_samr_AddAliasMember(pipe_cli, ctx,
+		status = rpccli_samr_AddAliasMember(pipe_cli, talloc_tos(),
 						    &alias_handle,
 						    &add_sids[i]);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -1227,7 +1227,7 @@ static WERROR NetLocalGroupModifyMembers_r(struct libnetapi_ctx *ctx,
 	/* del list */
 
 	for (i=0; i < num_del_sids; i++) {
-		status = rpccli_samr_DeleteAliasMember(pipe_cli, ctx,
+		status = rpccli_samr_DeleteAliasMember(pipe_cli, talloc_tos(),
 						       &alias_handle,
 						       &del_sids[i]);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -1240,7 +1240,7 @@ static WERROR NetLocalGroupModifyMembers_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&alias_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &alias_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &alias_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
diff --git a/source3/lib/netapi/netlogon.c b/source3/lib/netapi/netlogon.c
index 932ab8bb1d..8c30d6caab 100644
--- a/source3/lib/netapi/netlogon.c
+++ b/source3/lib/netapi/netlogon.c
@@ -139,7 +139,7 @@ WERROR I_NetLogonControl_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_netr_LogonControl(pipe_cli, ctx,
+	status = rpccli_netr_LogonControl(pipe_cli, talloc_tos(),
 					  r->in.server_name,
 					  r->in.function_code,
 					  r->in.query_level,
@@ -197,7 +197,7 @@ WERROR I_NetLogonControl2_r(struct libnetapi_ctx *ctx,
 	case NETLOGON_CONTROL_TC_VERIFY:
 	case NETLOGON_CONTROL_SET_DBFLAG:
 	case NETLOGON_CONTROL_FORCE_DNS_REG:
-		status = rpccli_netr_LogonControl2Ex(pipe_cli, ctx,
+		status = rpccli_netr_LogonControl2Ex(pipe_cli, talloc_tos(),
 						     r->in.server_name,
 						     r->in.function_code,
 						     r->in.query_level,
@@ -206,7 +206,7 @@ WERROR I_NetLogonControl2_r(struct libnetapi_ctx *ctx,
 						     &werr);
 		break;
 	default:
-		status = rpccli_netr_LogonControl2(pipe_cli, ctx,
+		status = rpccli_netr_LogonControl2(pipe_cli, talloc_tos(),
 						   r->in.server_name,
 						   r->in.function_code,
 						   r->in.query_level,
diff --git a/source3/lib/netapi/serverinfo.c b/source3/lib/netapi/serverinfo.c
index edf41686c5..83b749877e 100644
--- a/source3/lib/netapi/serverinfo.c
+++ b/source3/lib/netapi/serverinfo.c
@@ -509,7 +509,7 @@ WERROR NetServerGetInfo_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_srvsvc_NetSrvGetInfo(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetSrvGetInfo(pipe_cli, talloc_tos(),
 					     r->in.server_name,
 					     r->in.level,
 					     &info,
@@ -615,7 +615,7 @@ WERROR NetServerSetInfo_r(struct libnetapi_ctx *ctx,
 			goto done;
 	}
 
-	status = rpccli_srvsvc_NetSrvSetInfo(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetSrvSetInfo(pipe_cli, talloc_tos(),
 					     r->in.server_name,
 					     r->in.level,
 					     &info,
@@ -648,7 +648,7 @@ WERROR NetRemoteTOD_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_srvsvc_NetRemoteTOD(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetRemoteTOD(pipe_cli, talloc_tos(),
 					    r->in.server_name,
 					    &info,
 					    &werr);
diff --git a/source3/lib/netapi/share.c b/source3/lib/netapi/share.c
index 65bcd9a3a2..4232a9e7c0 100644
--- a/source3/lib/netapi/share.c
+++ b/source3/lib/netapi/share.c
@@ -215,7 +215,7 @@ WERROR NetShareAdd_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_srvsvc_NetShareAdd(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetShareAdd(pipe_cli, talloc_tos(),
 					   r->in.server_name,
 					   r->in.level,
 					   &info,
@@ -259,7 +259,7 @@ WERROR NetShareDel_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_srvsvc_NetShareDel(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetShareDel(pipe_cli, talloc_tos(),
 					   r->in.server_name,
 					   r->in.net_name,
 					   r->in.reserved,
@@ -338,7 +338,7 @@ WERROR NetShareEnum_r(struct libnetapi_ctx *ctx,
 			break;
 	}
 
-	status = rpccli_srvsvc_NetShareEnumAll(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetShareEnumAll(pipe_cli, talloc_tos(),
 					       r->in.server_name,
 					       &info_ctr,
 					       r->in.prefmaxlen,
@@ -423,7 +423,7 @@ WERROR NetShareGetInfo_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_srvsvc_NetShareGetInfo(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetShareGetInfo(pipe_cli, talloc_tos(),
 					       r->in.server_name,
 					       r->in.net_name,
 					       r->in.level,
@@ -502,7 +502,7 @@ WERROR NetShareSetInfo_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_srvsvc_NetShareSetInfo(pipe_cli, ctx,
+	status = rpccli_srvsvc_NetShareSetInfo(pipe_cli, talloc_tos(),
 					       r->in.server_name,
 					       r->in.net_name,
 					       r->in.level,
diff --git a/source3/lib/netapi/shutdown.c b/source3/lib/netapi/shutdown.c
index 4bbb99e5e7..78b797b144 100644
--- a/source3/lib/netapi/shutdown.c
+++ b/source3/lib/netapi/shutdown.c
@@ -46,7 +46,7 @@ WERROR NetShutdownInit_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_StringLarge(&message, r->in.message);
 
-	status = rpccli_initshutdown_Init(pipe_cli, ctx,
+	status = rpccli_initshutdown_Init(pipe_cli, talloc_tos(),
 					  NULL,
 					  &message,
 					  r->in.timeout,
@@ -88,7 +88,7 @@ WERROR NetShutdownAbort_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_initshutdown_Abort(pipe_cli, ctx,
+	status = rpccli_initshutdown_Abort(pipe_cli, talloc_tos(),
 					   NULL,
 					   &werr);
 	if (!NT_STATUS_IS_OK(status)) {
diff --git a/source3/lib/netapi/user.c b/source3/lib/netapi/user.c
index de0fc7da6e..151c24b539 100644
--- a/source3/lib/netapi/user.c
+++ b/source3/lib/netapi/user.c
@@ -317,7 +317,7 @@ static NTSTATUS set_user_info_USER_INFO_X(TALLOC_CTX *ctx,
 					  session_key,
 					  &user_info.info25.password);
 
-		status = rpccli_samr_SetUserInfo2(pipe_cli, ctx,
+		status = rpccli_samr_SetUserInfo2(pipe_cli, talloc_tos(),
 						  user_handle,
 						  25,
 						  &user_info);
@@ -330,7 +330,7 @@ static NTSTATUS set_user_info_USER_INFO_X(TALLOC_CTX *ctx,
 						session_key,
 						&user_info.info23.password);
 
-			status = rpccli_samr_SetUserInfo2(pipe_cli, ctx,
+			status = rpccli_samr_SetUserInfo2(pipe_cli, talloc_tos(),
 							  user_handle,
 							  23,
 							  &user_info);
@@ -339,7 +339,7 @@ static NTSTATUS set_user_info_USER_INFO_X(TALLOC_CTX *ctx,
 
 		user_info.info21 = info21;
 
-		status = rpccli_samr_SetUserInfo(pipe_cli, ctx,
+		status = rpccli_samr_SetUserInfo(pipe_cli, talloc_tos(),
 						 user_handle,
 						 21,
 						 &user_info);
@@ -413,7 +413,7 @@ WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, uX.usriX_name);
 
-	status = rpccli_samr_CreateUser2(pipe_cli, ctx,
+	status = rpccli_samr_CreateUser2(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 &lsa_account_name,
 					 ACB_NORMAL,
@@ -430,7 +430,7 @@ WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_QueryUserInfo(pipe_cli, ctx,
+	status = rpccli_samr_QueryUserInfo(pipe_cli, talloc_tos(),
 					   &user_handle,
 					   16,
 					   &user_info);
@@ -444,7 +444,7 @@ WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_GetUserPwInfo(pipe_cli, ctx,
+	status = rpccli_samr_GetUserPwInfo(pipe_cli, talloc_tos(),
 					   &user_handle,
 					   &pw_info);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -467,12 +467,12 @@ WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
 	goto done;
 
  failed:
-	rpccli_samr_DeleteUser(pipe_cli, ctx,
+	rpccli_samr_DeleteUser(pipe_cli, talloc_tos(),
 			       &user_handle);
 
  done:
 	if (is_valid_policy_hnd(&user_handle) && pipe_cli) {
-		rpccli_samr_Close(pipe_cli, ctx, &user_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &user_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -531,7 +531,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenDomain(pipe_cli, ctx,
+	status = rpccli_samr_OpenDomain(pipe_cli, talloc_tos(),
 					&connect_handle,
 					SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					CONST_DISCARD(struct dom_sid *, &global_sid_Builtin),
@@ -543,7 +543,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, r->in.user_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_account_name,
@@ -554,7 +554,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenUser(pipe_cli, ctx,
+	status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
 				      &domain_handle,
 				      SEC_STD_DELETE,
 				      user_rids.ids[0],
@@ -566,7 +566,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 
 	sid_compose(&user_sid, domain_sid, user_rids.ids[0]);
 
-	status = rpccli_samr_RemoveMemberFromForeignDomain(pipe_cli, ctx,
+	status = rpccli_samr_RemoveMemberFromForeignDomain(pipe_cli, talloc_tos(),
 							   &builtin_handle,
 							   &user_sid);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -574,7 +574,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_DeleteUser(pipe_cli, ctx,
+	status = rpccli_samr_DeleteUser(pipe_cli, talloc_tos(),
 					&user_handle);
 	if (!NT_STATUS_IS_OK(status)) {
 		werr = ntstatus_to_werror(status);
@@ -585,7 +585,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&user_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &user_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &user_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -1675,7 +1675,7 @@ WERROR NetUserGetInfo_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, r->in.user_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_account_name,
@@ -1702,7 +1702,7 @@ WERROR NetUserGetInfo_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&user_handle) && pipe_cli) {
-		rpccli_samr_Close(pipe_cli, ctx, &user_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &user_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -1830,7 +1830,7 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, r->in.user_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_account_name,
@@ -1841,7 +1841,7 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenUser(pipe_cli, ctx,
+	status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
 				      &domain_handle,
 				      user_mask,
 				      user_rids.ids[0],
@@ -1870,7 +1870,7 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&user_handle) && pipe_cli) {
-		rpccli_samr_Close(pipe_cli, ctx, &user_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &user_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -2849,7 +2849,7 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, r->in.user_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_account_name,
@@ -2860,7 +2860,7 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenUser(pipe_cli, ctx,
+	status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
 				      &domain_handle,
 				      SAMR_USER_ACCESS_GET_GROUPS,
 				      user_rids.ids[0],
@@ -2870,7 +2870,7 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_GetGroupsForUser(pipe_cli, ctx,
+	status = rpccli_samr_GetGroupsForUser(pipe_cli, talloc_tos(),
 					      &user_handle,
 					      &rid_array);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -2888,7 +2888,7 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
 		rids[i] = rid_array->rids[i].rid;
 	}
 
-	status = rpccli_samr_LookupRids(pipe_cli, ctx,
+	status = rpccli_samr_LookupRids(pipe_cli, talloc_tos(),
 					&domain_handle,
 					rid_array->count,
 					rids,
@@ -3000,7 +3000,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, r->in.user_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_account_name,
@@ -3011,7 +3011,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenUser(pipe_cli, ctx,
+	status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
 				      &domain_handle,
 				      SAMR_USER_ACCESS_GET_GROUPS,
 				      user_rids.ids[0],
@@ -3050,7 +3050,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 		}
 	}
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 r->in.num_entries,
 					 lsa_names,
@@ -3064,7 +3064,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 	member_rids = group_rids.ids;
 	num_member_rids = group_rids.count;
 
-	status = rpccli_samr_GetGroupsForUser(pipe_cli, ctx,
+	status = rpccli_samr_GetGroupsForUser(pipe_cli, talloc_tos(),
 					      &user_handle,
 					      &rid_array);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -3115,7 +3115,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 	/* add list */
 
 	for (i=0; i < num_add_rids; i++) {
-		status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+		status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
 					       &domain_handle,
 					       SAMR_GROUP_ACCESS_ADD_MEMBER,
 					       add_rids[i],
@@ -3125,7 +3125,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 			goto done;
 		}
 
-		status = rpccli_samr_AddGroupMember(pipe_cli, ctx,
+		status = rpccli_samr_AddGroupMember(pipe_cli, talloc_tos(),
 						    &group_handle,
 						    user_rids.ids[0],
 						    7 /* ? */);
@@ -3135,14 +3135,14 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 		}
 
 		if (is_valid_policy_hnd(&group_handle)) {
-			rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+			rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 		}
 	}
 
 	/* del list */
 
 	for (i=0; i < num_del_rids; i++) {
-		status = rpccli_samr_OpenGroup(pipe_cli, ctx,
+		status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
 					       &domain_handle,
 					       SAMR_GROUP_ACCESS_REMOVE_MEMBER,
 					       del_rids[i],
@@ -3152,7 +3152,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 			goto done;
 		}
 
-		status = rpccli_samr_DeleteGroupMember(pipe_cli, ctx,
+		status = rpccli_samr_DeleteGroupMember(pipe_cli, talloc_tos(),
 						       &group_handle,
 						       user_rids.ids[0]);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -3161,7 +3161,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 		}
 
 		if (is_valid_policy_hnd(&group_handle)) {
-			rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+			rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 		}
 	}
 
@@ -3169,7 +3169,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 
  done:
 	if (is_valid_policy_hnd(&group_handle)) {
-		rpccli_samr_Close(pipe_cli, ctx, &group_handle);
+		rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
 	}
 
 	if (ctx->disable_policy_handle_cache) {
@@ -3294,7 +3294,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 
 	init_lsa_String(&lsa_account_name, r->in.user_name);
 
-	status = rpccli_samr_LookupNames(pipe_cli, ctx,
+	status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
 					 &domain_handle,
 					 1,
 					 &lsa_account_name,
@@ -3305,7 +3305,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_OpenUser(pipe_cli, ctx,
+	status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
 				      &domain_handle,
 				      SAMR_USER_ACCESS_GET_GROUPS,
 				      user_rids.ids[0],
@@ -3315,7 +3315,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 		goto done;
 	}
 
-	status = rpccli_samr_GetGroupsForUser(pipe_cli, ctx,
+	status = rpccli_samr_GetGroupsForUser(pipe_cli, talloc_tos(),
 					      &user_handle,
 					      &rid_array);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -3356,7 +3356,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 		}
 	}
 
-	status = rpccli_samr_GetAliasMembership(pipe_cli, ctx,
+	status = rpccli_samr_GetAliasMembership(pipe_cli, talloc_tos(),
 						&domain_handle,
 						&sid_array,
 						&domain_rids);
@@ -3373,7 +3373,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 		}
 	}
 
-	status = rpccli_samr_GetAliasMembership(pipe_cli, ctx,
+	status = rpccli_samr_GetAliasMembership(pipe_cli, talloc_tos(),
 						&builtin_handle,
 						&sid_array,
 						&builtin_rids);
@@ -3390,7 +3390,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 		}
 	}
 
-	status = rpccli_samr_LookupRids(pipe_cli, ctx,
+	status = rpccli_samr_LookupRids(pipe_cli, talloc_tos(),
 					&builtin_handle,
 					num_rids,
 					rids,