Merge commit 'origin/master' into libcli-auth-merge-without-netlogond

4 files changed, 598 insertions, 373 deletions

diff --git a/source3/rpc_server/srv_lsa_hnd.c b/source3/rpc_server/srv_lsa_hnd.c
index e853bb2047..21b297af2d 100644
--- a/source3/rpc_server/srv_lsa_hnd.c
+++ b/source3/rpc_server/srv_lsa_hnd.c
@@ -24,6 +24,26 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_RPC_SRV
 
+/*
+ * Handle database - stored per pipe.
+ */
+
+struct policy {
+	struct policy *next, *prev;
+
+	struct policy_handle pol_hnd;
+
+	uint32_t access_granted;
+
+	void *data_ptr;
+};
+
+struct handle_list {
+	struct policy *Policy; 	/* List of policies. */
+	size_t count;			/* Current number of handles. */
+	size_t pipe_ref_count;	/* Number of pipe handles referring to this list. */
+};
+
 /* This is the max handles across all instances of a pipe name. */
 #ifndef MAX_OPEN_POLS
 #define MAX_OPEN_POLS 1024
@@ -40,6 +60,14 @@ static bool is_samr_lsa_pipe(const struct ndr_syntax_id *syntax)
 		|| ndr_syntax_id_equal(syntax, &ndr_table_lsarpc.syntax_id));
 }
 
+size_t num_pipe_handles(struct handle_list *list)
+{
+	if (list == NULL) {
+		return 0;
+	}
+	return list->count;
+}
+
 /****************************************************************************
  Initialise a policy handle list on a pipe. Handle list is shared between all
  pipes of the same name.
@@ -112,7 +140,9 @@ bool init_pipe_handle_list(pipes_struct *p, const struct ndr_syntax_id *syntax)
   data_ptr is TALLOC_FREE()'ed
 ****************************************************************************/
 
-bool create_policy_hnd(pipes_struct *p, struct policy_handle *hnd, void *data_ptr)
+static struct policy *create_policy_hnd_internal(pipes_struct *p,
+						 struct policy_handle *hnd,
+						 void *data_ptr)
 {
 	static uint32 pol_hnd_low  = 0;
 	static uint32 pol_hnd_high = 0;
@@ -123,13 +153,13 @@ bool create_policy_hnd(pipes_struct *p, struct policy_handle *hnd, void *data_pt
 	if (p->pipe_handles->count > MAX_OPEN_POLS) {
 		DEBUG(0,("create_policy_hnd: ERROR: too many handles (%d) on this pipe.\n",
 				(int)p->pipe_handles->count));
-		return False;
+		return NULL;
 	}
 
 	pol = TALLOC_ZERO_P(NULL, struct policy);
 	if (!pol) {
 		DEBUG(0,("create_policy_hnd: ERROR: out of memory!\n"));
-		return False;
+		return NULL;
 	}
 
 	if (data_ptr != NULL) {
@@ -160,14 +190,22 @@ bool create_policy_hnd(pipes_struct *p, struct policy_handle *hnd, void *data_pt
 	DEBUG(4,("Opened policy hnd[%d] ", (int)p->pipe_handles->count));
 	dump_data(4, (uint8 *)hnd, sizeof(*hnd));
 
-	return True;
+	return pol;
+}
+
+bool create_policy_hnd(pipes_struct *p, struct policy_handle *hnd,
+		       void *data_ptr)
+{
+	return create_policy_hnd_internal(p, hnd, data_ptr) != NULL;
 }
 
 /****************************************************************************
   find policy by handle - internal version.
 ****************************************************************************/
 
-static struct policy *find_policy_by_hnd_internal(pipes_struct *p, struct policy_handle *hnd, void **data_p)
+static struct policy *find_policy_by_hnd_internal(pipes_struct *p,
+						  const struct policy_handle *hnd,
+						  void **data_p)
 {
 	struct policy *pol;
 	size_t i;
@@ -197,7 +235,8 @@ static struct policy *find_policy_by_hnd_internal(pipes_struct *p, struct policy
   find policy by handle
 ****************************************************************************/
 
-bool find_policy_by_hnd(pipes_struct *p, struct policy_handle *hnd, void **data_p)
+bool find_policy_by_hnd(pipes_struct *p, const struct policy_handle *hnd,
+			void **data_p)
 {
 	return find_policy_by_hnd_internal(p, hnd, data_p) == NULL ? False : True;
 }
@@ -277,3 +316,81 @@ bool pipe_access_check(pipes_struct *p)
 
 	return True;
 }
+
+void *_policy_handle_create(struct pipes_struct *p, struct policy_handle *hnd,
+			    uint32_t access_granted, size_t data_size,
+			    const char *type, NTSTATUS *pstatus)
+{
+	struct policy *pol;
+	void *data;
+
+	if (p->pipe_handles->count > MAX_OPEN_POLS) {
+		DEBUG(0, ("policy_handle_create: ERROR: too many handles (%d) "
+			  "on pipe %s.\n", (int)p->pipe_handles->count,
+			  get_pipe_name_from_iface(&p->syntax)));
+		*pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
+		return NULL;
+	}
+
+	data = talloc_size(talloc_tos(), data_size);
+	if (data == NULL) {
+		*pstatus = NT_STATUS_NO_MEMORY;
+		return NULL;
+	}
+	talloc_set_name(data, "%s", type);
+
+	pol = create_policy_hnd_internal(p, hnd, data);
+	if (pol == NULL) {
+		TALLOC_FREE(data);
+		*pstatus = NT_STATUS_NO_MEMORY;
+		return NULL;
+	}
+	pol->access_granted = access_granted;
+	*pstatus = NT_STATUS_OK;
+	return data;
+}
+
+void *_policy_handle_find(struct pipes_struct *p,
+			  const struct policy_handle *hnd,
+			  uint32_t access_required,
+			  uint32_t *paccess_granted,
+			  const char *name, const char *location,
+			  NTSTATUS *pstatus)
+{
+	struct policy *pol;
+	void *data;
+
+	pol = find_policy_by_hnd_internal(p, hnd, &data);
+	if (pol == NULL) {
+		*pstatus = NT_STATUS_INVALID_HANDLE;
+		return NULL;
+	}
+	if (strcmp(name, talloc_get_name(data)) != 0) {
+		DEBUG(10, ("expected %s, got %s\n", name,
+			   talloc_get_name(data)));
+		*pstatus = NT_STATUS_INVALID_HANDLE;
+		return NULL;
+	}
+	if ((access_required & pol->access_granted) != access_required) {
+		if (geteuid() == sec_initial_uid()) {
+			DEBUG(4, ("%s: ACCESS should be DENIED (granted: "
+				  "%#010x; required: %#010x)\n", location,
+				  pol->access_granted, access_required));
+			DEBUGADD(4,("but overwritten by euid == 0\n"));
+			goto okay;
+		}
+		DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: "
+			 "%#010x)\n", location, pol->access_granted,
+			 access_required));
+		*pstatus = NT_STATUS_ACCESS_DENIED;
+		return NULL;
+	}
+
+ okay:
+	DEBUG(10, ("found handle of type %s\n", talloc_get_name(data)));
+	if (paccess_granted != NULL) {
+		*paccess_granted = pol->access_granted;
+	}
+	*pstatus = NT_STATUS_OK;
+	return data;
+}
diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index 0ce2b40f65..9481c206f6 100644
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -827,7 +827,15 @@ NTSTATUS _lsa_LookupSids(pipes_struct *p,
 					   &names,
 					   &mapped_count);
 
-	if (NT_STATUS_IS_ERR(status)) {
+	/* Only return here when there is a real error.
+	   NT_STATUS_NONE_MAPPED is a special case as it indicates that none of
+	   the requested sids could be resolved. Older versions of XP (pre SP3)
+	   rely that we return with the string representations of those SIDs in
+	   that case. If we don't, XP crashes - Guenther
+	   */
+
+	if (NT_STATUS_IS_ERR(status) &&
+	    !NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
 		return status;
 	}
 
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 187c721dfb..b54ed717a3 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -49,9 +49,17 @@
 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
 #define MAX_SAM_ENTRIES_W95 50
 
+struct samr_connect_info {
+	uint8_t dummy;
+};
+
+struct samr_domain_info {
+	struct dom_sid sid;
+	struct disp_info *disp_info;
+};
+
 typedef struct disp_info {
 	DOM_SID sid; /* identify which domain this is. */
-	bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
 	struct pdb_search *users; /* querydispinfo 1 and 4 */
 	struct pdb_search *machines; /* querydispinfo 2 */
 	struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
@@ -70,7 +78,6 @@ typedef struct disp_info {
 struct samr_info {
 	/* for use by the \PIPE\samr policy */
 	DOM_SID sid;
-	bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
 	uint32 status; /* some sort of flag.  best to record it.  comes from opnum 0x39 */
 	uint32 acc_granted;
 	DISP_INFO *disp_info;
@@ -298,7 +305,7 @@ static void map_max_allowed_access(const NT_USER_TOKEN *token,
  Fetch or create a dispinfo struct.
 ********************************************************************/
 
-static DISP_INFO *get_samr_dispinfo_by_sid(DOM_SID *psid)
+static DISP_INFO *get_samr_dispinfo_by_sid(const struct dom_sid *psid)
 {
 	/*
 	 * We do a static cache for DISP_INFO's here. Explanation can be found
@@ -377,26 +384,20 @@ static struct samr_info *get_samr_info_by_sid(TALLOC_CTX *mem_ctx,
 					      DOM_SID *psid)
 {
 	struct samr_info *info;
-	fstring sid_str;
 
-	if (psid) {
-		sid_to_fstring(sid_str, psid);
-	} else {
-		fstrcpy(sid_str,"(NULL)");
-	}
-
-	if ((info = TALLOC_ZERO_P(mem_ctx, struct samr_info)) == NULL) {
+	info = talloc_zero(mem_ctx, struct samr_info);
+	if (info == NULL) {
 		return NULL;
 	}
 	talloc_set_destructor(info, samr_info_destructor);
 
-	DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
+	DEBUG(10, ("get_samr_info_by_sid: created new info for sid %s\n",
+		   sid_string_dbg(psid)));
+
 	if (psid) {
 		sid_copy( &info->sid, psid);
-		info->builtin_domain = sid_check_is_builtin(psid);
 	} else {
 		DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
-		info->builtin_domain = False;
 	}
 
 	info->disp_info = get_samr_dispinfo_by_sid(psid);
@@ -481,8 +482,10 @@ static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromno
  We must also remove the timeout handler.
  ********************************************************************/
 
-static void force_flush_samr_cache(DISP_INFO *disp_info)
+static void force_flush_samr_cache(const struct dom_sid *sid)
 {
+	struct disp_info *disp_info = get_samr_dispinfo_by_sid(sid);
+
 	if ((disp_info == NULL) || (disp_info->cache_timeout_event == NULL)) {
 		return;
 	}
@@ -512,7 +515,7 @@ static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
 {
 	struct samr_displayentry *entry;
 
-	if (info->builtin_domain) {
+	if (sid_check_is_builtin(&info->sid)) {
 		/* No users in builtin. */
 		return 0;
 	}
@@ -536,7 +539,7 @@ static uint32 count_sam_groups(struct disp_info *info)
 {
 	struct samr_displayentry *entry;
 
-	if (info->builtin_domain) {
+	if (sid_check_is_builtin(&info->sid)) {
 		/* No groups in builtin. */
 		return 0;
 	}
@@ -597,7 +600,8 @@ NTSTATUS _samr_Close(pipes_struct *p, struct samr_Close *r)
 NTSTATUS _samr_OpenDomain(pipes_struct *p,
 			  struct samr_OpenDomain *r)
 {
-	struct    samr_info *info;
+	struct samr_connect_info *cinfo;
+	struct samr_domain_info *dinfo;
 	SEC_DESC *psd = NULL;
 	uint32    acc_granted;
 	uint32    des_access = r->in.access_mask;
@@ -607,15 +611,11 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
 
 	/* find the connection policy handle. */
 
-	if ( !find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info) )
-		return NT_STATUS_INVALID_HANDLE;
-
-	status = access_check_samr_function(info->acc_granted,
-					    SAMR_ACCESS_OPEN_DOMAIN,
-					    "_samr_OpenDomain" );
-
-	if ( !NT_STATUS_IS_OK(status) )
+	cinfo = policy_handle_find(p, r->in.connect_handle, 0, NULL,
+				   struct samr_connect_info, &status);
+	if (!NT_STATUS_IS_OK(status)) {
 		return status;
+	}
 
 	/*check if access can be granted as requested by client. */
 	map_max_allowed_access(p->server_info->ptok, &des_access);
@@ -638,14 +638,13 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
 		return NT_STATUS_NO_SUCH_DOMAIN;
 	}
 
-	/* associate the domain SID with the (unique) handle. */
-	if ((info = get_samr_info_by_sid(p->mem_ctx, r->in.sid))==NULL)
-		return NT_STATUS_NO_MEMORY;
-	info->acc_granted = acc_granted;
-
-	/* get a (unique) handle.  open a policy on it. */
-	if (!create_policy_hnd(p, r->out.domain_handle, info))
-		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+	dinfo = policy_handle_create(p, r->out.domain_handle, acc_granted,
+				     struct samr_domain_info, &status);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	dinfo->sid = *r->in.sid;
+	dinfo->disp_info = get_samr_dispinfo_by_sid(r->in.sid);
 
 	DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__));
 
@@ -964,7 +963,7 @@ NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
 			       struct samr_EnumDomainUsers *r)
 {
 	NTSTATUS status;
-	struct samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
 	int num_account;
 	uint32 enum_context = *r->in.resume_handle;
 	enum remote_arch_types ra_type = get_remote_arch();
@@ -974,20 +973,16 @@ NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
 	struct samr_SamArray *samr_array = NULL;
 	struct samr_SamEntry *samr_entries = NULL;
 
-	/* find the policy handle.  open a policy on it. */
-	if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
-		return NT_STATUS_INVALID_HANDLE;
+	DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
 
-	status = access_check_samr_function(info->acc_granted,
-					    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
-					    "_samr_EnumDomainUsers");
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
+				   struct samr_domain_info, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
 
-	DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
-
-	if (info->builtin_domain) {
+	if (sid_check_is_builtin(&dinfo->sid)) {
 		/* No users in builtin. */
 		*r->out.resume_handle = *r->in.resume_handle;
 		DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
@@ -1004,24 +999,24 @@ NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
 
 	/* AS ROOT !!!! */
 
-	if ((info->disp_info->enum_users != NULL) &&
-	    (info->disp_info->enum_acb_mask != r->in.acct_flags)) {
-		TALLOC_FREE(info->disp_info->enum_users);
+	if ((dinfo->disp_info->enum_users != NULL) &&
+	    (dinfo->disp_info->enum_acb_mask != r->in.acct_flags)) {
+		TALLOC_FREE(dinfo->disp_info->enum_users);
 	}
 
-	if (info->disp_info->enum_users == NULL) {
-		info->disp_info->enum_users = pdb_search_users(
-			info->disp_info, r->in.acct_flags);
-		info->disp_info->enum_acb_mask = r->in.acct_flags;
+	if (dinfo->disp_info->enum_users == NULL) {
+		dinfo->disp_info->enum_users = pdb_search_users(
+			dinfo->disp_info, r->in.acct_flags);
+		dinfo->disp_info->enum_acb_mask = r->in.acct_flags;
 	}
 
-	if (info->disp_info->enum_users == NULL) {
+	if (dinfo->disp_info->enum_users == NULL) {
 		/* END AS ROOT !!!! */
 		unbecome_root();
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
-	num_account = pdb_search_entries(info->disp_info->enum_users,
+	num_account = pdb_search_entries(dinfo->disp_info->enum_users,
 					 enum_context, max_entries,
 					 &entries);
 
@@ -1050,7 +1045,7 @@ NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
 	}
 
 	/* Ensure we cache this enumeration. */
-	set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
+	set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
 
 	DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__));
 
@@ -1107,26 +1102,22 @@ NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
 				struct samr_EnumDomainGroups *r)
 {
 	NTSTATUS status;
-	struct samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
 	struct samr_displayentry *groups;
 	uint32 num_groups;
 	struct samr_SamArray *samr_array = NULL;
 	struct samr_SamEntry *samr_entries = NULL;
 
-	/* find the policy handle.  open a policy on it. */
-	if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
-		return NT_STATUS_INVALID_HANDLE;
-
-	status = access_check_samr_function(info->acc_granted,
-					    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
-					    "_samr_EnumDomainGroups");
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
+				   struct samr_domain_info, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
 
 	DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
 
-	if (info->builtin_domain) {
+	if (sid_check_is_builtin(&dinfo->sid)) {
 		/* No groups in builtin. */
 		*r->out.resume_handle = *r->in.resume_handle;
 		DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
@@ -1142,22 +1133,22 @@ NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
 
 	become_root();
 
-	if (info->disp_info->groups == NULL) {
-		info->disp_info->groups = pdb_search_groups(info->disp_info);
+	if (dinfo->disp_info->groups == NULL) {
+		dinfo->disp_info->groups = pdb_search_groups(dinfo->disp_info);
 
-		if (info->disp_info->groups == NULL) {
+		if (dinfo->disp_info->groups == NULL) {
 			unbecome_root();
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	}
 
-	num_groups = pdb_search_entries(info->disp_info->groups,
+	num_groups = pdb_search_entries(dinfo->disp_info->groups,
 					*r->in.resume_handle,
 					MAX_SAM_ENTRIES, &groups);
 	unbecome_root();
 
 	/* Ensure we cache this enumeration. */
-	set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
+	set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
 
 	make_group_sam_entry_list(p->mem_ctx, &samr_entries,
 				  num_groups, groups);
@@ -1182,26 +1173,22 @@ NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
 				 struct samr_EnumDomainAliases *r)
 {
 	NTSTATUS status;
-	struct samr_info *info;
+	struct samr_domain_info *dinfo;
 	struct samr_displayentry *aliases;
 	uint32 num_aliases = 0;
 	struct samr_SamArray *samr_array = NULL;
 	struct samr_SamEntry *samr_entries = NULL;
 
-	/* find the policy handle.  open a policy on it. */
-	if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
-		return NT_STATUS_INVALID_HANDLE;
-
-	DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
-		 sid_string_dbg(&info->sid)));
-
-	status = access_check_samr_function(info->acc_granted,
-					    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
-					    "_samr_EnumDomainAliases");
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
+				   struct samr_domain_info, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
 
+	DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
+		 sid_string_dbg(&dinfo->sid)));
+
 	samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
 	if (!samr_array) {
 		return NT_STATUS_NO_MEMORY;
@@ -1209,22 +1196,22 @@ NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
 
 	become_root();
 
-	if (info->disp_info->aliases == NULL) {
-		info->disp_info->aliases = pdb_search_aliases(
-			info->disp_info, &info->sid);
-		if (info->disp_info->aliases == NULL) {
+	if (dinfo->disp_info->aliases == NULL) {
+		dinfo->disp_info->aliases = pdb_search_aliases(
+			dinfo->disp_info, &dinfo->sid);
+		if (dinfo->disp_info->aliases == NULL) {
 			unbecome_root();
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	}
 
-	num_aliases = pdb_search_entries(info->disp_info->aliases,
+	num_aliases = pdb_search_entries(dinfo->disp_info->aliases,
 					 *r->in.resume_handle,
 					 MAX_SAM_ENTRIES, &aliases);
 	unbecome_root();
 
 	/* Ensure we cache this enumeration. */
-	set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
+	set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
 
 	make_group_sam_entry_list(p->mem_ctx, &samr_entries,
 				  num_aliases, aliases);
@@ -1447,7 +1434,7 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
 				struct samr_QueryDisplayInfo *r)
 {
 	NTSTATUS status;
-	struct samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
 	uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
 
 	uint32 max_entries = r->in.max_entries;
@@ -1465,18 +1452,9 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
 
 	DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__));
 
-	/* find the policy handle.  open a policy on it. */
-	if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
-		return NT_STATUS_INVALID_HANDLE;
-
-	if (info->builtin_domain) {
-		DEBUG(5,("_samr_QueryDisplayInfo: Nothing in BUILTIN\n"));
-		return NT_STATUS_OK;
-	}
-
-	status = access_check_samr_function(info->acc_granted,
-					    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
-					    "_samr_QueryDisplayInfo");
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
+				   struct samr_domain_info, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -1541,10 +1519,10 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
 	switch (r->in.level) {
 	case 0x1:
 	case 0x4:
-		if (info->disp_info->users == NULL) {
-			info->disp_info->users = pdb_search_users(
-				info->disp_info, ACB_NORMAL);
-			if (info->disp_info->users == NULL) {
+		if (dinfo->disp_info->users == NULL) {
+			dinfo->disp_info->users = pdb_search_users(
+				dinfo->disp_info, ACB_NORMAL);
+			if (dinfo->disp_info->users == NULL) {
 				unbecome_root();
 				return NT_STATUS_ACCESS_DENIED;
 			}
@@ -1555,15 +1533,15 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
 				(unsigned  int)enum_context ));
 		}
 
-		num_account = pdb_search_entries(info->disp_info->users,
+		num_account = pdb_search_entries(dinfo->disp_info->users,
 						 enum_context, max_entries,
 						 &entries);
 		break;
 	case 0x2:
-		if (info->disp_info->machines == NULL) {
-			info->disp_info->machines = pdb_search_users(
-				info->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
-			if (info->disp_info->machines == NULL) {
+		if (dinfo->disp_info->machines == NULL) {
+			dinfo->disp_info->machines = pdb_search_users(
+				dinfo->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
+			if (dinfo->disp_info->machines == NULL) {
 				unbecome_root();
 				return NT_STATUS_ACCESS_DENIED;
 			}
@@ -1574,16 +1552,16 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
 				(unsigned  int)enum_context ));
 		}
 
-		num_account = pdb_search_entries(info->disp_info->machines,
+		num_account = pdb_search_entries(dinfo->disp_info->machines,
 						 enum_context, max_entries,
 						 &entries);
 		break;
 	case 0x3:
 	case 0x5:
-		if (info->disp_info->groups == NULL) {
-			info->disp_info->groups = pdb_search_groups(
-				info->disp_info);
-			if (info->disp_info->groups == NULL) {
+		if (dinfo->disp_info->groups == NULL) {
+			dinfo->disp_info->groups = pdb_search_groups(
+				dinfo->disp_info);
+			if (dinfo->disp_info->groups == NULL) {
 				unbecome_root();
 				return NT_STATUS_ACCESS_DENIED;
 			}
@@ -1594,7 +1572,7 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
 				(unsigned  int)enum_context ));
 		}
 
-		num_account = pdb_search_entries(info->disp_info->groups,
+		num_account = pdb_search_entries(dinfo->disp_info->groups,
 						 enum_context, max_entries,
 						 &entries);
 		break;
@@ -1651,7 +1629,7 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
 	}
 
 	/* Ensure we cache this enumeration. */
-	set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
+	set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
 
 	DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__));
 
@@ -1776,25 +1754,20 @@ NTSTATUS _samr_QueryAliasInfo(pipes_struct *p,
 NTSTATUS _samr_LookupNames(pipes_struct *p,
 			   struct samr_LookupNames *r)
 {
+	struct samr_domain_info *dinfo;
 	NTSTATUS status;
 	uint32 *rid;
 	enum lsa_SidType *type;
 	int i;
 	int num_rids = r->in.num_names;
-	DOM_SID pol_sid;
-	uint32  acc_granted;
 	struct samr_Ids rids, types;
 	uint32_t num_mapped = 0;
 
 	DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
 
-	if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL)) {
-		return NT_STATUS_OBJECT_TYPE_MISMATCH;
-	}
-
-	status = access_check_samr_function(acc_granted,
-					    0, /* Don't know the acc_bits yet */
-					    "_samr_LookupNames");
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   0 /* Don't know the acc_bits yet */, NULL,
+				   struct samr_domain_info, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -1811,7 +1784,7 @@ NTSTATUS _samr_LookupNames(pipes_struct *p,
 	NT_STATUS_HAVE_NO_MEMORY(type);
 
 	DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
-		 sid_string_dbg(&pol_sid)));
+		 sid_string_dbg(&dinfo->sid)));
 
 	for (i = 0; i < num_rids; i++) {
 
@@ -1820,7 +1793,7 @@ NTSTATUS _samr_LookupNames(pipes_struct *p,
 
 		rid[i] = 0xffffffff;
 
-		if (sid_check_is_builtin(&pol_sid)) {
+		if (sid_check_is_builtin(&dinfo->sid)) {
 			if (lookup_builtin_name(r->in.names[i].string,
 						&rid[i]))
 			{
@@ -2037,13 +2010,12 @@ static bool make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
 NTSTATUS _samr_LookupRids(pipes_struct *p,
 			  struct samr_LookupRids *r)
 {
+	struct samr_domain_info *dinfo;
 	NTSTATUS status;
 	const char **names;
 	enum lsa_SidType *attrs = NULL;
 	uint32 *wire_attrs = NULL;
-	DOM_SID pol_sid;
 	int num_rids = (int)r->in.num_rids;
-	uint32 acc_granted;
 	int i;
 	struct lsa_Strings names_array;
 	struct samr_Ids types_array;
@@ -2051,13 +2023,9 @@ NTSTATUS _samr_LookupRids(pipes_struct *p,
 
 	DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
 
-	/* find the policy handle.  open a policy on it. */
-	if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL))
-		return NT_STATUS_INVALID_HANDLE;
-
-	status = access_check_samr_function(acc_granted,
-					    0, /* Don't know the acc_bits yet */
-					    "_samr_LookupRids");
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   0 /* Don't know the acc_bits yet */, NULL,
+				   struct samr_domain_info, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -2082,7 +2050,7 @@ NTSTATUS _samr_LookupRids(pipes_struct *p,
 	}
 
 	become_root();  /* lookup_sid can require root privs */
-	status = pdb_lookup_rids(&pol_sid, num_rids, r->in.rids,
+	status = pdb_lookup_rids(&dinfo->sid, num_rids, r->in.rids,
 				 names, attrs);
 	unbecome_root();
 
@@ -2123,7 +2091,8 @@ NTSTATUS _samr_OpenUser(pipes_struct *p,
 {
 	struct samu *sampass=NULL;
 	DOM_SID sid;
-	struct samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
+	struct samr_info *info;
 	SEC_DESC *psd = NULL;
 	uint32    acc_granted;
 	uint32    des_access = r->in.access_mask;
@@ -2131,18 +2100,14 @@ NTSTATUS _samr_OpenUser(pipes_struct *p,
 	bool ret;
 	NTSTATUS nt_status;
 	SE_PRIV se_rights;
+	NTSTATUS status;
 
-	/* find the domain policy handle and get domain SID / access bits in the domain policy. */
-
-	if ( !get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL) )
-		return NT_STATUS_INVALID_HANDLE;
-
-	nt_status = access_check_samr_function(acc_granted,
-					       SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
-					       "_samr_OpenUser" );
-
-	if ( !NT_STATUS_IS_OK(nt_status) )
-		return nt_status;
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
+				   struct samr_domain_info, &status);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
 
 	if ( !(sampass = samu_new( p->mem_ctx )) ) {
 		return NT_STATUS_NO_MEMORY;
@@ -2150,7 +2115,7 @@ NTSTATUS _samr_OpenUser(pipes_struct *p,
 
 	/* append the user's RID to it */
 
-	if (!sid_append_rid(&sid, r->in.rid))
+	if (!sid_compose(&sid, &dinfo->sid, r->in.rid))
 		return NT_STATUS_NO_SUCH_USER;
 
 	/* check if access can be granted as requested by client. */
@@ -2788,7 +2753,7 @@ NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
 			       struct samr_QueryDomainInfo *r)
 {
 	NTSTATUS status = NT_STATUS_OK;
-	struct samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
 	union samr_DomainInfo *dom_info;
 	time_t u_expire, u_min_age;
 
@@ -2802,23 +2767,18 @@ NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
 
 	DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
 
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_ACCESS_LOOKUP_DOMAIN, NULL,
+				   struct samr_domain_info, &status);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
 	dom_info = TALLOC_ZERO_P(p->mem_ctx, union samr_DomainInfo);
 	if (!dom_info) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	/* find the policy handle.  open a policy on it. */
-	if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
-		return NT_STATUS_INVALID_HANDLE;
-	}
-
-	status = access_check_samr_function(info->acc_granted,
-					    SAMR_ACCESS_OPEN_DOMAIN,
-					    "_samr_QueryDomainInfo" );
-
-	if ( !NT_STATUS_IS_OK(status) )
-		return status;
-
 	switch (r->in.level) {
 		case 0x01:
 
@@ -2860,9 +2820,12 @@ NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
 
 			/* AS ROOT !!! */
 
-			dom_info->general.num_users	= count_sam_users(info->disp_info, ACB_NORMAL);
-			dom_info->general.num_groups	= count_sam_groups(info->disp_info);
-			dom_info->general.num_aliases	= count_sam_aliases(info->disp_info);
+			dom_info->general.num_users	= count_sam_users(
+				dinfo->disp_info, ACB_NORMAL);
+			dom_info->general.num_groups	= count_sam_groups(
+				dinfo->disp_info);
+			dom_info->general.num_aliases	= count_sam_aliases(
+				dinfo->disp_info);
 
 			pdb_get_account_policy(AP_TIME_TO_LOGOUT, &u_logout);
 
@@ -3032,7 +2995,8 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
 	const char *account = NULL;
 	DOM_SID sid;
 	uint32_t acb_info = r->in.acct_flags;
-	struct samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
+	struct samr_info *info;
 	NTSTATUS nt_status;
 	uint32 acc_granted;
 	SEC_DESC *psd;
@@ -3041,25 +3005,19 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
 	uint32    des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
 	bool can_add_account = False;
 	SE_PRIV se_rights;
-	DISP_INFO *disp_info = NULL;
 
-	/* Get the domain SID stored in the domain policy */
-	if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted,
-				     &disp_info))
-		return NT_STATUS_INVALID_HANDLE;
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_CREATE_USER, NULL,
+				   struct samr_domain_info, &nt_status);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
+	}
 
-	if (disp_info->builtin_domain) {
+	if (sid_check_is_builtin(&dinfo->sid)) {
 		DEBUG(5,("_samr_CreateUser2: Refusing user create in BUILTIN\n"));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
-	nt_status = access_check_samr_function(acc_granted,
-					       SAMR_DOMAIN_ACCESS_CREATE_USER,
-					       "_samr_CreateUser2");
-	if (!NT_STATUS_IS_OK(nt_status)) {
-		return nt_status;
-	}
-
 	if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
 	      acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
 		/* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
@@ -3161,7 +3119,7 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
 	}
 
 	/* After a "set" ensure we have no cached display info. */
-	force_flush_samr_cache(info->disp_info);
+	force_flush_samr_cache(&sid);
 
 	*r->out.access_granted = acc_granted;
 
@@ -3195,8 +3153,11 @@ NTSTATUS _samr_CreateUser(pipes_struct *p,
 NTSTATUS _samr_Connect(pipes_struct *p,
 		       struct samr_Connect *r)
 {
-	struct samr_info *info = NULL;
+	struct samr_connect_info *info;
+	uint32_t acc_granted;
+	struct policy_handle hnd;
 	uint32    des_access = r->in.access_mask;
+	NTSTATUS status;
 
 	/* Access check */
 
@@ -3205,12 +3166,6 @@ NTSTATUS _samr_Connect(pipes_struct *p,
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
-	/* set up the SAMR connect_anon response */
-
-	/* associate the user's SID with the new handle. */
-	if ((info = get_samr_info_by_sid(p->mem_ctx, NULL)) == NULL)
-		return NT_STATUS_NO_MEMORY;
-
 	/* don't give away the farm but this is probably ok.  The SAMR_ACCESS_ENUM_DOMAINS
 	   was observed from a win98 client trying to enumerate users (when configured
 	   user level access control on shares)   --jerry */
@@ -3218,12 +3173,20 @@ NTSTATUS _samr_Connect(pipes_struct *p,
 	map_max_allowed_access(p->server_info->ptok, &des_access);
 
 	se_map_generic( &des_access, &sam_generic_mapping );
-	info->acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS|SAMR_ACCESS_OPEN_DOMAIN);
 
-	/* get a (unique) handle.  open a policy on it. */
-	if (!create_policy_hnd(p, r->out.connect_handle, info))
-		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+	acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS
+				    |SAMR_ACCESS_LOOKUP_DOMAIN);
+
+	/* set up the SAMR connect_anon response */
+
+	info = policy_handle_create(p, &hnd, acc_granted,
+				    struct samr_connect_info,
+				    &status);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
 
+	*r->out.connect_handle = hnd;
 	return NT_STATUS_OK;
 }
 
@@ -3234,7 +3197,8 @@ NTSTATUS _samr_Connect(pipes_struct *p,
 NTSTATUS _samr_Connect2(pipes_struct *p,
 			struct samr_Connect2 *r)
 {
-	struct samr_info *info = NULL;
+	struct samr_connect_info *info = NULL;
+	struct policy_handle hnd;
 	SEC_DESC *psd = NULL;
 	uint32    acc_granted;
 	uint32    des_access = r->in.access_mask;
@@ -3277,20 +3241,16 @@ NTSTATUS _samr_Connect2(pipes_struct *p,
 	if ( !NT_STATUS_IS_OK(nt_status) )
 		return nt_status;
 
-	/* associate the user's SID and access granted with the new handle. */
-	if ((info = get_samr_info_by_sid(p->mem_ctx, NULL)) == NULL)
-		return NT_STATUS_NO_MEMORY;
-
-	info->acc_granted = acc_granted;
-	info->status = r->in.access_mask; /* this looks so wrong... - gd */
-
-	/* get a (unique) handle.  open a policy on it. */
-	if (!create_policy_hnd(p, r->out.connect_handle, info))
-		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+	info = policy_handle_create(p, &hnd, acc_granted,
+				    struct samr_connect_info, &nt_status);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
 
 	DEBUG(5,("%s: %d\n", fn, __LINE__));
 
-	return nt_status;
+	*r->out.connect_handle = hnd;
+	return NT_STATUS_OK;
 }
 
 /****************************************************************
@@ -3361,20 +3321,18 @@ NTSTATUS _samr_Connect5(pipes_struct *p,
 NTSTATUS _samr_LookupDomain(pipes_struct *p,
 			    struct samr_LookupDomain *r)
 {
-	NTSTATUS status = NT_STATUS_OK;
-	struct samr_info *info;
+	NTSTATUS status;
+	struct samr_connect_info *info;
 	const char *domain_name;
 	DOM_SID *sid = NULL;
 
-	if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
-		return NT_STATUS_INVALID_HANDLE;
-
 	/* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
 	   Reverted that change so we will work with RAS servers again */
 
-	status = access_check_samr_function(info->acc_granted,
-					    SAMR_ACCESS_OPEN_DOMAIN,
-					    "_samr_LookupDomain");
+	info = policy_handle_find(p, r->in.connect_handle,
+				  SAMR_ACCESS_LOOKUP_DOMAIN, NULL,
+				  struct samr_connect_info,
+				  &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -3413,17 +3371,14 @@ NTSTATUS _samr_EnumDomains(pipes_struct *p,
 			   struct samr_EnumDomains *r)
 {
 	NTSTATUS status;
-	struct samr_info *info;
+	struct samr_connect_info *info;
 	uint32_t num_entries = 2;
 	struct samr_SamEntry *entry_array = NULL;
 	struct samr_SamArray *sam;
 
-	if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
-		return NT_STATUS_INVALID_HANDLE;
-
-	status = access_check_samr_function(info->acc_granted,
-					    SAMR_ACCESS_ENUM_DOMAINS,
-					    "_samr_EnumDomains");
+	info = policy_handle_find(p, r->in.connect_handle,
+				  SAMR_ACCESS_ENUM_DOMAINS, NULL,
+				  struct samr_connect_info, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -3465,6 +3420,7 @@ NTSTATUS _samr_OpenAlias(pipes_struct *p,
 	DOM_SID sid;
 	uint32 alias_rid = r->in.rid;
 	struct    samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
 	SEC_DESC *psd = NULL;
 	uint32    acc_granted;
 	uint32    des_access = r->in.access_mask;
@@ -3472,21 +3428,16 @@ NTSTATUS _samr_OpenAlias(pipes_struct *p,
 	NTSTATUS  status;
 	SE_PRIV se_rights;
 
-	/* find the domain policy and get the SID / access bits stored in the domain policy */
-
-	if ( !get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL) )
-		return NT_STATUS_INVALID_HANDLE;
-
-	status = access_check_samr_function(acc_granted,
-					    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
-					    "_samr_OpenAlias");
-
-	if ( !NT_STATUS_IS_OK(status) )
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
+				   struct samr_domain_info, &status);
+	if (!NT_STATUS_IS_OK(status)) {
 		return status;
+	}
 
 	/* append the alias' RID to it */
 
-	if (!sid_append_rid(&sid, alias_rid))
+	if (!sid_compose(&sid, &dinfo->sid, alias_rid))
 		return NT_STATUS_NO_SUCH_ALIAS;
 
 	/*check if access can be granted as requested by client. */
@@ -4288,7 +4239,7 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
 	/* ================ END SeMachineAccountPrivilege BLOCK ================ */
 
 	if (NT_STATUS_IS_OK(status)) {
-		force_flush_samr_cache(disp_info);
+		force_flush_samr_cache(&sid);
 	}
 
 	return status;
@@ -4319,36 +4270,25 @@ NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
 {
 	size_t num_alias_rids;
 	uint32 *alias_rids;
-	struct samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
 	size_t i;
 
-	NTSTATUS ntstatus1;
-	NTSTATUS ntstatus2;
+	NTSTATUS status;
 
 	DOM_SID *members;
 
 	DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__));
 
-	/* find the policy handle.  open a policy on it. */
-	if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
-		return NT_STATUS_INVALID_HANDLE;
-
-	ntstatus1 = access_check_samr_function(info->acc_granted,
-					       SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
-					       "_samr_GetAliasMembership");
-	ntstatus2 = access_check_samr_function(info->acc_granted,
-					       SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
-					       "_samr_GetAliasMembership");
-
-	if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
-		if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
-		    !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
-			return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
-		}
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS
+				   | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
+				   struct samr_domain_info, &status);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
 	}
 
-	if (!sid_check_is_domain(&info->sid) &&
-	    !sid_check_is_builtin(&info->sid))
+	if (!sid_check_is_domain(&dinfo->sid) &&
+	    !sid_check_is_builtin(&dinfo->sid))
 		return NT_STATUS_OBJECT_TYPE_MISMATCH;
 
 	if (r->in.sids->num_sids) {
@@ -4367,13 +4307,13 @@ NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
 	num_alias_rids = 0;
 
 	become_root();
-	ntstatus1 = pdb_enum_alias_memberships(p->mem_ctx, &info->sid, members,
-					       r->in.sids->num_sids,
-					       &alias_rids, &num_alias_rids);
+	status = pdb_enum_alias_memberships(p->mem_ctx, &dinfo->sid, members,
+					    r->in.sids->num_sids,
+					    &alias_rids, &num_alias_rids);
 	unbecome_root();
 
-	if (!NT_STATUS_IS_OK(ntstatus1)) {
-		return ntstatus1;
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
 	}
 
 	r->out.rids->count = num_alias_rids;
@@ -4560,7 +4500,7 @@ NTSTATUS _samr_AddAliasMember(pipes_struct *p,
 	/******** END SeAddUsers BLOCK *********/
 
 	if (NT_STATUS_IS_OK(status)) {
-		force_flush_samr_cache(disp_info);
+		force_flush_samr_cache(&alias_sid);
 	}
 
 	return status;
@@ -4610,7 +4550,7 @@ NTSTATUS _samr_DeleteAliasMember(pipes_struct *p,
 	/******** END SeAddUsers BLOCK *********/
 
 	if (NT_STATUS_IS_OK(status)) {
-		force_flush_samr_cache(disp_info);
+		force_flush_samr_cache(&alias_sid);
 	}
 
 	return status;
@@ -4664,7 +4604,7 @@ NTSTATUS _samr_AddGroupMember(pipes_struct *p,
 
 	/******** END SeAddUsers BLOCK *********/
 
-	force_flush_samr_cache(disp_info);
+	force_flush_samr_cache(&group_sid);
 
 	return status;
 }
@@ -4722,7 +4662,7 @@ NTSTATUS _samr_DeleteGroupMember(pipes_struct *p,
 
 	/******** END SeAddUsers BLOCK *********/
 
-	force_flush_samr_cache(disp_info);
+	force_flush_samr_cache(&group_sid);
 
 	return status;
 }
@@ -4812,7 +4752,7 @@ NTSTATUS _samr_DeleteUser(pipes_struct *p,
 
 	ZERO_STRUCTP(r->out.user_handle);
 
-	force_flush_samr_cache(disp_info);
+	force_flush_samr_cache(&user_sid);
 
 	return NT_STATUS_OK;
 }
@@ -4878,7 +4818,7 @@ NTSTATUS _samr_DeleteDomainGroup(pipes_struct *p,
 	if (!close_policy_hnd(p, r->in.group_handle))
 		return NT_STATUS_OBJECT_NAME_INVALID;
 
-	force_flush_samr_cache(disp_info);
+	force_flush_samr_cache(&group_sid);
 
 	return NT_STATUS_OK;
 }
@@ -4949,7 +4889,7 @@ NTSTATUS _samr_DeleteDomAlias(pipes_struct *p,
 	if (!close_policy_hnd(p, r->in.alias_handle))
 		return NT_STATUS_OBJECT_NAME_INVALID;
 
-	force_flush_samr_cache(disp_info);
+	force_flush_samr_cache(&alias_sid);
 
 	return NT_STATUS_OK;
 }
@@ -4963,27 +4903,21 @@ NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
 
 {
 	NTSTATUS status;
-	DOM_SID dom_sid;
 	DOM_SID info_sid;
 	const char *name;
+	struct samr_domain_info *dinfo;
 	struct samr_info *info;
-	uint32 acc_granted;
 	SE_PRIV se_rights;
 	bool can_add_accounts;
-	DISP_INFO *disp_info = NULL;
-
-	/* Find the policy handle. Open a policy on it. */
-	if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
-		return NT_STATUS_INVALID_HANDLE;
 
-	status = access_check_samr_function(acc_granted,
-					    SAMR_DOMAIN_ACCESS_CREATE_GROUP,
-					    "_samr_CreateDomainGroup");
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_CREATE_GROUP, NULL,
+				   struct samr_domain_info, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
 
-	if (!sid_equal(&dom_sid, get_global_sam_sid()))
+	if (!sid_equal(&dinfo->sid, get_global_sam_sid()))
 		return NT_STATUS_ACCESS_DENIED;
 
 	name = r->in.name->string;
@@ -5018,7 +4952,7 @@ NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
 	if ( !NT_STATUS_IS_OK(status) )
 		return status;
 
-	sid_compose(&info_sid, get_global_sam_sid(), *r->out.rid);
+	sid_compose(&info_sid, &dinfo->sid, *r->out.rid);
 
 	if ((info = get_samr_info_by_sid(p->mem_ctx, &info_sid)) == NULL)
 		return NT_STATUS_NO_MEMORY;
@@ -5031,7 +4965,7 @@ NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
 	if (!create_policy_hnd(p, r->out.group_handle, info))
 		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 
-	force_flush_samr_cache(disp_info);
+	force_flush_samr_cache(&info_sid);
 
 	return NT_STATUS_OK;
 }
@@ -5043,29 +4977,23 @@ NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
 NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
 			      struct samr_CreateDomAlias *r)
 {
-	DOM_SID dom_sid;
 	DOM_SID info_sid;
 	const char *name = NULL;
+	struct samr_domain_info *dinfo;
 	struct samr_info *info;
-	uint32 acc_granted;
 	gid_t gid;
 	NTSTATUS result;
 	SE_PRIV se_rights;
 	bool can_add_accounts;
-	DISP_INFO *disp_info = NULL;
-
-	/* Find the policy handle. Open a policy on it. */
-	if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
-		return NT_STATUS_INVALID_HANDLE;
 
-	result = access_check_samr_function(acc_granted,
-					    SAMR_DOMAIN_ACCESS_CREATE_ALIAS,
-					    "_samr_CreateDomAlias");
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_CREATE_ALIAS, NULL,
+				   struct samr_domain_info, &result);
 	if (!NT_STATUS_IS_OK(result)) {
 		return result;
 	}
 
-	if (!sid_equal(&dom_sid, get_global_sam_sid()))
+	if (!sid_equal(&dinfo->sid, get_global_sam_sid()))
 		return NT_STATUS_ACCESS_DENIED;
 
 	name = r->in.alias_name->string;
@@ -5097,8 +5025,7 @@ NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
 		return result;
 	}
 
-	sid_copy(&info_sid, get_global_sam_sid());
-	sid_append_rid(&info_sid, *r->out.rid);
+	sid_compose(&info_sid, &dinfo->sid, *r->out.rid);
 
 	if (!sid_to_gid(&info_sid, &gid)) {
 		DEBUG(10, ("Could not find alias just created\n"));
@@ -5123,7 +5050,7 @@ NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
 	if (!create_policy_hnd(p, r->out.alias_handle, info))
 		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 
-	force_flush_samr_cache(disp_info);
+	force_flush_samr_cache(&info_sid);
 
 	return NT_STATUS_OK;
 }
@@ -5293,7 +5220,7 @@ NTSTATUS _samr_SetGroupInfo(pipes_struct *p,
 	/******** End SeAddUsers BLOCK *********/
 
 	if (NT_STATUS_IS_OK(status)) {
-		force_flush_samr_cache(disp_info);
+		force_flush_samr_cache(&group_sid);
 	}
 
 	return status;
@@ -5395,7 +5322,7 @@ NTSTATUS _samr_SetAliasInfo(pipes_struct *p,
         /******** End SeAddUsers BLOCK *********/
 
 	if (NT_STATUS_IS_OK(status))
-		force_flush_samr_cache(disp_info);
+		force_flush_samr_cache(&group_sid);
 
 	return status;
 }
@@ -5444,28 +5371,24 @@ NTSTATUS _samr_OpenGroup(pipes_struct *p,
 			 struct samr_OpenGroup *r)
 
 {
-	DOM_SID sid;
 	DOM_SID info_sid;
 	GROUP_MAP map;
+	struct samr_domain_info *dinfo;
 	struct samr_info *info;
 	SEC_DESC         *psd = NULL;
 	uint32            acc_granted;
 	uint32            des_access = r->in.access_mask;
 	size_t            sd_size;
 	NTSTATUS          status;
-	fstring sid_string;
 	bool ret;
 	SE_PRIV se_rights;
 
-	if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL))
-		return NT_STATUS_INVALID_HANDLE;
-
-	status = access_check_samr_function(acc_granted,
-					    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
-					    "_samr_OpenGroup");
-
-	if ( !NT_STATUS_IS_OK(status) )
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
+				   struct samr_domain_info, &status);
+	if (!NT_STATUS_IS_OK(status)) {
 		return status;
+	}
 
 	/*check if access can be granted as requested by client. */
 	map_max_allowed_access(p->server_info->ptok, &des_access);
@@ -5484,19 +5407,18 @@ NTSTATUS _samr_OpenGroup(pipes_struct *p,
 
 	/* this should not be hard-coded like this */
 
-	if (!sid_equal(&sid, get_global_sam_sid()))
+	if (!sid_equal(&dinfo->sid, get_global_sam_sid()))
 		return NT_STATUS_ACCESS_DENIED;
 
-	sid_copy(&info_sid, get_global_sam_sid());
-	sid_append_rid(&info_sid, r->in.rid);
-	sid_to_fstring(sid_string, &info_sid);
+	sid_compose(&info_sid, &dinfo->sid, r->in.rid);
 
 	if ((info = get_samr_info_by_sid(p->mem_ctx, &info_sid)) == NULL)
 		return NT_STATUS_NO_MEMORY;
 
 	info->acc_granted = acc_granted;
 
-	DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n", sid_string));
+	DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n",
+		   sid_string_dbg(&info_sid)));
 
 	/* check if that group really exists */
 	become_root();
@@ -5519,31 +5441,23 @@ NTSTATUS _samr_OpenGroup(pipes_struct *p,
 NTSTATUS _samr_RemoveMemberFromForeignDomain(pipes_struct *p,
 					     struct samr_RemoveMemberFromForeignDomain *r)
 {
-	DOM_SID			delete_sid, domain_sid;
-	uint32 			acc_granted;
+	struct samr_domain_info *dinfo;
 	NTSTATUS		result;
-	DISP_INFO *disp_info = NULL;
-
-	sid_copy( &delete_sid, r->in.sid );
 
 	DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
-		sid_string_dbg(&delete_sid)));
+		 sid_string_dbg(r->in.sid)));
 
 	/* Find the policy handle. Open a policy on it. */
 
-	if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &domain_sid,
-				     &acc_granted, &disp_info))
-		return NT_STATUS_INVALID_HANDLE;
-
-	result = access_check_samr_function(acc_granted,
-					    STD_RIGHT_DELETE_ACCESS,
-					    "_samr_RemoveMemberFromForeignDomain");
-
-	if (!NT_STATUS_IS_OK(result))
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   STD_RIGHT_DELETE_ACCESS, NULL,
+				   struct samr_domain_info, &result);
+	if (!NT_STATUS_IS_OK(result)) {
 		return result;
+	}
 
 	DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
-		  sid_string_dbg(&domain_sid)));
+		  sid_string_dbg(&dinfo->sid)));
 
 	/* we can only delete a user from a group since we don't have
 	   nested groups anyways.  So in the latter case, just say OK */
@@ -5559,16 +5473,16 @@ NTSTATUS _samr_RemoveMemberFromForeignDomain(pipes_struct *p,
 	 * only application of this call. To verify this, let people report
 	 * other cases. */
 
-	if (!sid_check_is_builtin(&domain_sid)) {
+	if (!sid_check_is_builtin(&dinfo->sid)) {
 		DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
 			 "global_sam_sid() = %s\n",
-			 sid_string_dbg(&domain_sid),
+			 sid_string_dbg(&dinfo->sid),
 			 sid_string_dbg(get_global_sam_sid())));
 		DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
 		return NT_STATUS_OK;
 	}
 
-	force_flush_samr_cache(disp_info);
+	force_flush_samr_cache(&dinfo->sid);
 
 	result = NT_STATUS_OK;
 
@@ -5599,7 +5513,7 @@ NTSTATUS _samr_QueryDomainInfo2(pipes_struct *p,
 NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
 			     struct samr_SetDomainInfo *r)
 {
-	struct samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
 	time_t u_expire, u_min_age;
 	time_t u_logout;
 	time_t u_lock_duration, u_reset_time;
@@ -5607,10 +5521,6 @@ NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
 
 	DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
 
-	/* find the policy handle.  open a policy on it. */
-	if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
-		return NT_STATUS_INVALID_HANDLE;
-
 	/* We do have different access bits for info
 	 * levels here, but we're really just looking for
 	 * GENERIC_RIGHTS_DOMAIN_WRITE access. Unfortunately
@@ -5618,12 +5528,12 @@ NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
 	 * assume if we have SAMR_DOMAIN_ACCESS_SET_INFO_1
 	 * set we are ok. */
 
-	result = access_check_samr_function(info->acc_granted,
-					    SAMR_DOMAIN_ACCESS_SET_INFO_1,
-					    "_samr_SetDomainInfo");
-
-	if (!NT_STATUS_IS_OK(result))
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_SET_INFO_1, NULL,
+				   struct samr_domain_info, &result);
+	if (!NT_STATUS_IS_OK(result)) {
 		return result;
+	}
 
 	DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
 
@@ -5676,7 +5586,7 @@ NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
 NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
 					  struct samr_GetDisplayEnumerationIndex *r)
 {
-	struct samr_info *info = NULL;
+	struct samr_domain_info *dinfo;
 	uint32_t max_entries = (uint32_t) -1;
 	uint32_t enum_context = 0;
 	int i;
@@ -5686,14 +5596,9 @@ NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
 
 	DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
 
-	/* find the policy handle.  open a policy on it. */
-	if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
-		return NT_STATUS_INVALID_HANDLE;
-	}
-
-	status = access_check_samr_function(info->acc_granted,
-					    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
-					    "_samr_GetDisplayEnumerationIndex");
+	dinfo = policy_handle_find(p, r->in.domain_handle,
+				   SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
+				   struct samr_domain_info, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -5711,10 +5616,10 @@ NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
 
 	switch (r->in.level) {
 	case 1:
-		if (info->disp_info->users == NULL) {
-			info->disp_info->users = pdb_search_users(
-				info->disp_info, ACB_NORMAL);
-			if (info->disp_info->users == NULL) {
+		if (dinfo->disp_info->users == NULL) {
+			dinfo->disp_info->users = pdb_search_users(
+				dinfo->disp_info, ACB_NORMAL);
+			if (dinfo->disp_info->users == NULL) {
 				unbecome_root();
 				return NT_STATUS_ACCESS_DENIED;
 			}
@@ -5726,15 +5631,15 @@ NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
 				"using cached user enumeration at index %u\n",
 				(unsigned int)enum_context));
 		}
-		num_account = pdb_search_entries(info->disp_info->users,
+		num_account = pdb_search_entries(dinfo->disp_info->users,
 						 enum_context, max_entries,
 						 &entries);
 		break;
 	case 2:
-		if (info->disp_info->machines == NULL) {
-			info->disp_info->machines = pdb_search_users(
-				info->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
-			if (info->disp_info->machines == NULL) {
+		if (dinfo->disp_info->machines == NULL) {
+			dinfo->disp_info->machines = pdb_search_users(
+				dinfo->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
+			if (dinfo->disp_info->machines == NULL) {
 				unbecome_root();
 				return NT_STATUS_ACCESS_DENIED;
 			}
@@ -5746,15 +5651,15 @@ NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
 				"using cached machine enumeration at index %u\n",
 				(unsigned int)enum_context));
 		}
-		num_account = pdb_search_entries(info->disp_info->machines,
+		num_account = pdb_search_entries(dinfo->disp_info->machines,
 						 enum_context, max_entries,
 						 &entries);
 		break;
 	case 3:
-		if (info->disp_info->groups == NULL) {
-			info->disp_info->groups = pdb_search_groups(
-				info->disp_info);
-			if (info->disp_info->groups == NULL) {
+		if (dinfo->disp_info->groups == NULL) {
+			dinfo->disp_info->groups = pdb_search_groups(
+				dinfo->disp_info);
+			if (dinfo->disp_info->groups == NULL) {
 				unbecome_root();
 				return NT_STATUS_ACCESS_DENIED;
 			}
@@ -5766,7 +5671,7 @@ NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
 				"using cached group enumeration at index %u\n",
 				(unsigned int)enum_context));
 		}
-		num_account = pdb_search_entries(info->disp_info->groups,
+		num_account = pdb_search_entries(dinfo->disp_info->groups,
 						 enum_context, max_entries,
 						 &entries);
 		break;
@@ -5779,7 +5684,7 @@ NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
 	unbecome_root();
 
 	/* Ensure we cache this enumeration. */
-	set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
+	set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
 
 	DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
 		r->in.name->string));
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index d114152f64..629e41c003 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -591,7 +591,8 @@ static bool open_printer_hnd(pipes_struct *p, struct policy_handle *hnd,
 
 	new_printer->access_granted = access_granted;
 
-	DEBUG(5, ("%d printer handles active\n", (int)p->pipe_handles->count ));
+	DEBUG(5, ("%d printer handles active\n",
+		  (int)num_pipe_handles(p->pipe_handles)));
 
 	return true;
 }
@@ -4846,6 +4847,121 @@ static WERROR fill_printer_driver_info3(TALLOC_CTX *mem_ctx,
 }
 
 /********************************************************************
+ * fill a spoolss_DriverInfo4 struct
+ ********************************************************************/
+
+static WERROR fill_printer_driver_info4(TALLOC_CTX *mem_ctx,
+					struct spoolss_DriverInfo4 *r,
+					const NT_PRINTER_DRIVER_INFO_LEVEL *driver,
+					const char *servername)
+{
+	const char *cservername = canon_servername(servername);
+
+	r->version		= driver->info_3->cversion;
+
+	r->driver_name		= talloc_strdup(mem_ctx, driver->info_3->name);
+	W_ERROR_HAVE_NO_MEMORY(r->driver_name);
+	r->architecture		= talloc_strdup(mem_ctx, driver->info_3->environment);
+	W_ERROR_HAVE_NO_MEMORY(r->architecture);
+
+	if (strlen(driver->info_3->driverpath)) {
+		r->driver_path	= talloc_asprintf(mem_ctx, "\\\\%s%s",
+				cservername, driver->info_3->driverpath);
+	} else {
+		r->driver_path	= talloc_strdup(mem_ctx, "");
+	}
+	W_ERROR_HAVE_NO_MEMORY(r->driver_path);
+
+	if (strlen(driver->info_3->datafile)) {
+		r->data_file	= talloc_asprintf(mem_ctx, "\\\\%s%s",
+				cservername, driver->info_3->datafile);
+	} else {
+		r->data_file	= talloc_strdup(mem_ctx, "");
+	}
+	W_ERROR_HAVE_NO_MEMORY(r->data_file);
+
+	if (strlen(driver->info_3->configfile)) {
+		r->config_file	= talloc_asprintf(mem_ctx, "\\\\%s%s",
+				cservername, driver->info_3->configfile);
+	} else {
+		r->config_file	= talloc_strdup(mem_ctx, "");
+	}
+	W_ERROR_HAVE_NO_MEMORY(r->config_file);
+
+	if (strlen(driver->info_3->helpfile)) {
+		r->help_file	= talloc_asprintf(mem_ctx, "\\\\%s%s",
+				cservername, driver->info_3->helpfile);
+	} else {
+		r->help_file	= talloc_strdup(mem_ctx, "");
+	}
+	W_ERROR_HAVE_NO_MEMORY(r->help_file);
+
+	r->dependent_files = string_array_from_driver_info(mem_ctx,
+							   driver->info_3->dependentfiles,
+							   cservername);
+
+
+	r->monitor_name		= talloc_strdup(mem_ctx, driver->info_3->monitorname);
+	W_ERROR_HAVE_NO_MEMORY(r->monitor_name);
+	r->default_datatype	= talloc_strdup(mem_ctx, driver->info_3->defaultdatatype);
+	W_ERROR_HAVE_NO_MEMORY(r->default_datatype);
+
+	r->previous_names = string_array_from_driver_info(mem_ctx,
+							  NULL,
+							  cservername);
+
+	return WERR_OK;
+}
+
+/********************************************************************
+ * fill a spoolss_DriverInfo5 struct
+ ********************************************************************/
+
+static WERROR fill_printer_driver_info5(TALLOC_CTX *mem_ctx,
+					struct spoolss_DriverInfo5 *r,
+					const NT_PRINTER_DRIVER_INFO_LEVEL *driver,
+					const char *servername)
+{
+	const char *cservername = canon_servername(servername);
+
+	r->version		= driver->info_3->cversion;
+
+	r->driver_name		= talloc_strdup(mem_ctx, driver->info_3->name);
+	W_ERROR_HAVE_NO_MEMORY(r->driver_name);
+	r->architecture		= talloc_strdup(mem_ctx, driver->info_3->environment);
+	W_ERROR_HAVE_NO_MEMORY(r->architecture);
+
+	if (strlen(driver->info_3->driverpath)) {
+		r->driver_path	= talloc_asprintf(mem_ctx, "\\\\%s%s",
+				cservername, driver->info_3->driverpath);
+	} else {
+		r->driver_path	= talloc_strdup(mem_ctx, "");
+	}
+	W_ERROR_HAVE_NO_MEMORY(r->driver_path);
+
+	if (strlen(driver->info_3->datafile)) {
+		r->data_file	= talloc_asprintf(mem_ctx, "\\\\%s%s",
+				cservername, driver->info_3->datafile);
+	} else {
+		r->data_file	= talloc_strdup(mem_ctx, "");
+	}
+	W_ERROR_HAVE_NO_MEMORY(r->data_file);
+
+	if (strlen(driver->info_3->configfile)) {
+		r->config_file	= talloc_asprintf(mem_ctx, "\\\\%s%s",
+				cservername, driver->info_3->configfile);
+	} else {
+		r->config_file	= talloc_strdup(mem_ctx, "");
+	}
+	W_ERROR_HAVE_NO_MEMORY(r->config_file);
+
+	r->driver_attributes	= 0;
+	r->config_version	= 0;
+	r->driver_version	= 0;
+
+	return WERR_OK;
+}
+/********************************************************************
  * fill a spoolss_DriverInfo6 struct
  ********************************************************************/
 
@@ -4893,7 +5009,7 @@ static WERROR fill_printer_driver_info6(TALLOC_CTX *mem_ctx,
 	} else {
 		r->help_file	= talloc_strdup(mem_ctx, "");
 	}
-	W_ERROR_HAVE_NO_MEMORY(r->config_file);
+	W_ERROR_HAVE_NO_MEMORY(r->help_file);
 
 	r->monitor_name		= talloc_strdup(mem_ctx, driver->info_3->monitorname);
 	W_ERROR_HAVE_NO_MEMORY(r->monitor_name);
@@ -6673,6 +6789,18 @@ static WERROR enumprinterdrivers_level(TALLOC_CTX *mem_ctx,
 				result = fill_printer_driver_info3(info, &info[count+i].info3,
 								   &driver, servername);
 				break;
+			case 4:
+				result = fill_printer_driver_info4(info, &info[count+i].info4,
+								   &driver, servername);
+				break;
+			case 5:
+				result = fill_printer_driver_info5(info, &info[count+i].info5,
+								   &driver, servername);
+				break;
+			case 6:
+				result = fill_printer_driver_info6(info, &info[count+i].info6,
+								   &driver, servername);
+				break;
 			default:
 				result = WERR_UNKNOWN_LEVEL;
 				break;
@@ -6745,6 +6873,49 @@ static WERROR enumprinterdrivers_level3(TALLOC_CTX *mem_ctx,
 					info_p, count);
 }
 
+/****************************************************************************
+ Enumerates all printer drivers at level 4.
+****************************************************************************/
+
+static WERROR enumprinterdrivers_level4(TALLOC_CTX *mem_ctx,
+					const char *servername,
+					const char *architecture,
+					union spoolss_DriverInfo **info_p,
+					uint32_t *count)
+{
+	return enumprinterdrivers_level(mem_ctx, servername, architecture, 4,
+					info_p, count);
+}
+
+/****************************************************************************
+ Enumerates all printer drivers at level 5.
+****************************************************************************/
+
+static WERROR enumprinterdrivers_level5(TALLOC_CTX *mem_ctx,
+					const char *servername,
+					const char *architecture,
+					union spoolss_DriverInfo **info_p,
+					uint32_t *count)
+{
+	return enumprinterdrivers_level(mem_ctx, servername, architecture, 5,
+					info_p, count);
+}
+
+/****************************************************************************
+ Enumerates all printer drivers at level 6.
+****************************************************************************/
+
+static WERROR enumprinterdrivers_level6(TALLOC_CTX *mem_ctx,
+					const char *servername,
+					const char *architecture,
+					union spoolss_DriverInfo **info_p,
+					uint32_t *count)
+{
+	return enumprinterdrivers_level(mem_ctx, servername, architecture, 6,
+					info_p, count);
+}
+
+
 /****************************************************************
  _spoolss_EnumPrinterDrivers
 ****************************************************************/
@@ -6789,6 +6960,21 @@ WERROR _spoolss_EnumPrinterDrivers(pipes_struct *p,
 						   r->in.environment,
 						   r->out.info, r->out.count);
 		break;
+	case 4:
+		result = enumprinterdrivers_level4(p->mem_ctx, cservername,
+						   r->in.environment,
+						   r->out.info, r->out.count);
+		break;
+	case 5:
+		result = enumprinterdrivers_level5(p->mem_ctx, cservername,
+						   r->in.environment,
+						   r->out.info, r->out.count);
+		break;
+	case 6:
+		result = enumprinterdrivers_level6(p->mem_ctx, cservername,
+						   r->in.environment,
+						   r->out.info, r->out.count);
+		break;
 	default:
 		return WERR_UNKNOWN_LEVEL;
 	}
@@ -8111,7 +8297,7 @@ WERROR _spoolss_AddForm(pipes_struct *p,
 	/* if the user is not root, doesn't have SE_PRINT_OPERATOR privilege,
 	   and not a printer admin, then fail */
 
-	if ((p->server_info->utok.uid != 0) &&
+	if ((p->server_info->utok.uid != sec_initial_uid()) &&
 	     !user_has_privileges(p->server_info->ptok, &se_printop) &&
 	     !token_contains_name_in_list(uidtoname(p->server_info->utok.uid),
 					  NULL, NULL,
@@ -8135,7 +8321,9 @@ WERROR _spoolss_AddForm(pipes_struct *p,
 		goto done;
 	}
 
+	become_root();
 	write_ntforms(&list, count);
+	unbecome_root();
 
 	/*
 	 * ChangeID must always be set if this is a printer
@@ -8168,6 +8356,7 @@ WERROR _spoolss_DeleteForm(pipes_struct *p,
 	WERROR status = WERR_OK;
 	NT_PRINTER_INFO_LEVEL *printer = NULL;
 	SE_PRIV se_printop = SE_PRINT_OPERATOR;
+	bool ret = false;
 
 	DEBUG(5,("_spoolss_DeleteForm\n"));
 
@@ -8189,7 +8378,7 @@ WERROR _spoolss_DeleteForm(pipes_struct *p,
 			goto done;
 	}
 
-	if ((p->server_info->utok.uid != 0) &&
+	if ((p->server_info->utok.uid != sec_initial_uid()) &&
 	     !user_has_privileges(p->server_info->ptok, &se_printop) &&
 	     !token_contains_name_in_list(uidtoname(p->server_info->utok.uid),
 					  NULL, NULL,
@@ -8209,8 +8398,12 @@ WERROR _spoolss_DeleteForm(pipes_struct *p,
 
 	count = get_ntforms(&list);
 
-	if ( !delete_a_form(&list, form_name, &count, &status ))
+	become_root();
+	ret = delete_a_form(&list, form_name, &count, &status);
+	unbecome_root();
+	if (ret == false) {
 		goto done;
+	}
 
 	/*
 	 * ChangeID must always be set if this is a printer
@@ -8268,7 +8461,7 @@ WERROR _spoolss_SetForm(pipes_struct *p,
 	/* if the user is not root, doesn't have SE_PRINT_OPERATOR privilege,
 	   and not a printer admin, then fail */
 
-	if ((p->server_info->utok.uid != 0) &&
+	if ((p->server_info->utok.uid != sec_initial_uid()) &&
 	     !user_has_privileges(p->server_info->ptok, &se_printop) &&
 	     !token_contains_name_in_list(uidtoname(p->server_info->utok.uid),
 					  NULL, NULL,
@@ -8286,7 +8479,9 @@ WERROR _spoolss_SetForm(pipes_struct *p,
 
 	count = get_ntforms(&list);
 	update_a_form(&list, form, count);
+	become_root();
 	write_ntforms(&list, count);
+	unbecome_root();
 
 	/*
 	 * ChangeID must always be set if this is a printer