Merge branch 'master' of ssh://git.samba.org/data/git/samba

15 files changed, 623 insertions, 626 deletions

diff --git a/source3/rpc_server/srv_dfs_nt.c b/source3/rpc_server/srv_dfs_nt.c
index 661d262dc4..bef8d83103 100644
--- a/source3/rpc_server/srv_dfs_nt.c
+++ b/source3/rpc_server/srv_dfs_nt.c
@@ -48,7 +48,7 @@ WERROR _dfs_Add(pipes_struct *p, struct dfs_Add *r)
 	NTSTATUS status;
 	TALLOC_CTX *ctx = talloc_tos();
 
-	if (p->pipe_user.ut.uid != sec_initial_uid()) {
+	if (p->server_info->utok.uid != sec_initial_uid()) {
 		DEBUG(10,("_dfs_add: uid != 0. Access denied.\n"));
 		return WERR_ACCESS_DENIED;
 	}
@@ -113,7 +113,7 @@ WERROR _dfs_Remove(pipes_struct *p, struct dfs_Remove *r)
 	TALLOC_CTX *ctx = talloc_tos();
 	char *altpath = NULL;
 
-	if (p->pipe_user.ut.uid != sec_initial_uid()) {
+	if (p->server_info->utok.uid != sec_initial_uid()) {
 		DEBUG(10,("_dfs_remove: uid != 0. Access denied.\n"));
 		return WERR_ACCESS_DENIED;
 	}
diff --git a/source3/rpc_server/srv_eventlog_lib.c b/source3/rpc_server/srv_eventlog_lib.c
index 9215a86d3f..c4a7828b6c 100644
--- a/source3/rpc_server/srv_eventlog_lib.c
+++ b/source3/rpc_server/srv_eventlog_lib.c
@@ -140,13 +140,13 @@ int elog_tdb_size( TDB_CONTEXT * tdb, int *MaxSize, int *Retention )
  return True if we made enough room to accommodate needed bytes
 ********************************************************************/
 
-static bool make_way_for_eventlogs( TDB_CONTEXT * the_tdb, int32 needed,
+static bool make_way_for_eventlogs( TDB_CONTEXT * the_tdb, int32_t needed,
 				    bool whack_by_date )
 {
-	int start_record, i, new_start;
-	int end_record;
-	int nbytes, reclen, len, Retention, MaxSize;
-	int tresv1, trecnum, timegen, timewr;
+	int32_t start_record, i, new_start;
+	int32_t end_record;
+	int32_t reclen, tresv1, trecnum, timegen, timewr;
+	int nbytes, len, Retention, MaxSize;
 	TDB_DATA key, ret;
 	time_t current_time, exp_time;
 
@@ -173,16 +173,17 @@ static bool make_way_for_eventlogs( TDB_CONTEXT * the_tdb, int32 needed,
 	nbytes = 0;
 
 	DEBUG( 3,
-	       ( "MaxSize [%d] Retention [%d] Current Time [%d]  exp_time [%d]\n",
-		 MaxSize, Retention, (uint32)current_time, (uint32)exp_time ) );
+	       ( "MaxSize [%d] Retention [%d] Current Time [%u]  exp_time [%u]\n",
+		 MaxSize, Retention, (unsigned int)current_time, (unsigned int)exp_time ) );
 	DEBUG( 3,
-	       ( "Start Record [%d] End Record [%d]\n", start_record,
-		 end_record ) );
+	       ( "Start Record [%u] End Record [%u]\n",
+		(unsigned int)start_record,
+		(unsigned int)end_record ));
 
 	for ( i = start_record; i < end_record; i++ ) {
 		/* read a record, add the amt to nbytes */
-		key.dsize = sizeof( int32 );
-		key.dptr = ( uint8 * ) ( int32 * ) & i;
+		key.dsize = sizeof(int32_t);
+		key.dptr = (unsigned char *)&i;
 		ret = tdb_fetch( the_tdb, key );
 		if ( ret.dsize == 0 ) {
 			DEBUG( 8,
@@ -198,12 +199,13 @@ static bool make_way_for_eventlogs( TDB_CONTEXT * the_tdb, int32 needed,
 		if (len == -1) {
 			DEBUG( 10,("make_way_for_eventlogs: tdb_unpack failed.\n"));
 			tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
+			SAFE_FREE( ret.dptr );
 			return False;
 		}
 
 		DEBUG( 8,
-		       ( "read record %d, record size is [%d], total so far [%d]\n",
-			 i, reclen, nbytes ) );
+		       ( "read record %u, record size is [%d], total so far [%d]\n",
+			 (unsigned int)i, reclen, nbytes ) );
 
 		SAFE_FREE( ret.dptr );
 
@@ -220,14 +222,14 @@ static bool make_way_for_eventlogs( TDB_CONTEXT * the_tdb, int32 needed,
 	}
 
 	DEBUG( 3,
-	       ( "nbytes [%d] needed [%d] start_record is [%d], should be set to [%d]\n",
-		 nbytes, needed, start_record, i ) );
+	       ( "nbytes [%d] needed [%d] start_record is [%u], should be set to [%u]\n",
+		 nbytes, needed, (unsigned int)start_record, (unsigned int)i ) );
 	/* todo - remove eventlog entries here and set starting record to start_record... */
 	new_start = i;
 	if ( start_record != new_start ) {
 		for ( i = start_record; i < new_start; i++ ) {
-			key.dsize = sizeof( int32 );
-			key.dptr = ( uint8 * ) ( int32 * ) & i;
+			key.dsize = sizeof(int32_t);
+			key.dptr = (unsigned char *)&i;
 			tdb_delete( the_tdb, key );
 		}
 
@@ -267,7 +269,7 @@ bool prune_eventlog( TDB_CONTEXT * tdb )
 /********************************************************************
 ********************************************************************/
 
-bool can_write_to_eventlog( TDB_CONTEXT * tdb, int32 needed )
+bool can_write_to_eventlog( TDB_CONTEXT * tdb, int32_t needed )
 {
 	int calcd_size;
 	int MaxSize, Retention;
@@ -313,7 +315,7 @@ bool can_write_to_eventlog( TDB_CONTEXT * tdb, int32 needed )
 ELOG_TDB *elog_open_tdb( char *logname, bool force_clear )
 {
 	TDB_CONTEXT *tdb = NULL;
-	uint32 vers_id;
+	uint32_t vers_id;
 	ELOG_TDB *ptr;
 	char *tdbpath = NULL;
 	ELOG_TDB *tdb_node = NULL;
@@ -454,7 +456,7 @@ int write_eventlog_tdb( TDB_CONTEXT * the_tdb, Eventlog_entry * ee )
 	uint8 *packed_ee;
 	TALLOC_CTX *mem_ctx = NULL;
 	TDB_DATA kbuf, ebuf;
-	uint32 n_packed;
+	uint32_t n_packed;
 
 	if ( !ee )
 		return 0;
diff --git a/source3/rpc_server/srv_eventlog_nt.c b/source3/rpc_server/srv_eventlog_nt.c
index 3c7469f3ef..d12b490d21 100644
--- a/source3/rpc_server/srv_eventlog_nt.c
+++ b/source3/rpc_server/srv_eventlog_nt.c
@@ -1,20 +1,20 @@
-/* 
+/*
  *  Unix SMB/CIFS implementation.
  *  RPC Pipe client / server routines
  *  Copyright (C) Marcin Krzysztof Porwit    2005,
  *  Copyright (C) Brian Moran                2005,
  *  Copyright (C) Gerald (Jerry) Carter      2005.
- *  
+ *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
  *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
- *  
+ *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *  
+ *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
@@ -40,10 +40,10 @@ typedef struct {
 static void free_eventlog_info( void *ptr )
 {
 	EVENTLOG_INFO *elog = (EVENTLOG_INFO *)ptr;
-	
+
 	if ( elog->etdb )
 		elog_close_tdb( elog->etdb, False );
-	
+
 	TALLOC_FREE( elog );
 }
 
@@ -72,21 +72,21 @@ static bool elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
 	char *tdbname = elog_tdbname(talloc_tos(), info->logname );
 	SEC_DESC *sec_desc;
 	NTSTATUS status;
-	
-	if ( !tdbname ) 
+
+	if ( !tdbname )
 		return False;
-	
+
 	/* get the security descriptor for the file */
-	
+
 	sec_desc = get_nt_acl_no_snum( info, tdbname );
-	SAFE_FREE( tdbname );
-	
+	TALLOC_FREE( tdbname );
+
 	if ( !sec_desc ) {
-		DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n", 
+		DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n",
 			tdbname));
 		return False;
 	}
-	
+
 	/* root free pass */
 
 	if ( geteuid() == sec_initial_uid() ) {
@@ -95,21 +95,21 @@ static bool elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
 	}
 
 	/* run the check, try for the max allowed */
-	
+
 	status = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
 		&info->access_granted);
-		
+
 	if ( sec_desc )
 		TALLOC_FREE( sec_desc );
-		
+
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(8,("elog_check_access: se_access_check() return %s\n",
 			nt_errstr(status)));
 		return False;
 	}
-	
+
 	/* we have to have READ permission for a successful open */
-	
+
 	return ( info->access_granted & SA_RIGHT_FILE_READ_DATA );
 }
 
@@ -120,7 +120,7 @@ static bool elog_validate_logname( const char *name )
 {
 	int i;
 	const char **elogs = lp_eventlog_list();
-	
+
 	if (!elogs) {
 		return False;
 	}
@@ -129,7 +129,7 @@ static bool elog_validate_logname( const char *name )
 		if ( strequal( name, elogs[i] ) )
 			return True;
 	}
-	
+
 	return False;
 }
 
@@ -178,19 +178,19 @@ static bool get_oldest_entry_hook( EVENTLOG_INFO * info )
 static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd )
 {
 	EVENTLOG_INFO *elog;
-	
+
 	/* first thing is to validate the eventlog name */
 	
 	if ( !elog_validate_logname( logname ) )
 		return NT_STATUS_OBJECT_PATH_INVALID;
-	
+
 	if ( !(elog = TALLOC_ZERO_P( NULL, EVENTLOG_INFO )) )
 		return NT_STATUS_NO_MEMORY;
-		
+
 	elog->logname = talloc_strdup( elog, logname );
-	
+
 	/* Open the tdb first (so that we can create any new tdbs if necessary).
-	   We have to do this as root and then use an internal access check 
+	   We have to do this as root and then use an internal access check
 	   on the file permissions since you can only have a tdb open once
 	   in a single process */
 
@@ -201,40 +201,40 @@ static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hn
 	if ( !elog->etdb ) {
 		/* according to MSDN, if the logfile cannot be found, we should
 		  default to the "Application" log */
-	
+
 		if ( !strequal( logname, ELOG_APPL ) ) {
-		
+
 			TALLOC_FREE( elog->logname );
-			
-			elog->logname = talloc_strdup( elog, ELOG_APPL );			
+
+			elog->logname = talloc_strdup( elog, ELOG_APPL );
 
 			/* do the access check */
-			if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
+			if ( !elog_check_access( elog, p->server_info->ptok ) ) {
 				TALLOC_FREE( elog );
 				return NT_STATUS_ACCESS_DENIED;
 			}
-	
+
 			become_root();
 			elog->etdb = elog_open_tdb( elog->logname, False );
 			unbecome_root();
-		}	
-		
+		}
+
 		if ( !elog->etdb ) {
 			TALLOC_FREE( elog );
-			return NT_STATUS_ACCESS_DENIED;	/* ??? */		
+			return NT_STATUS_ACCESS_DENIED;	/* ??? */
 		}
 	}
-	
+
 	/* now do the access check.  Close the tdb if we fail here */
 
-	if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
+	if ( !elog_check_access( elog, p->server_info->ptok ) ) {
 		elog_close_tdb( elog->etdb, False );
 		TALLOC_FREE( elog );
 		return NT_STATUS_ACCESS_DENIED;
 	}
-	
+
 	/* create the policy handle */
-	
+
 	if ( !create_policy_hnd
 	     ( p, hnd, free_eventlog_info, ( void * ) elog ) ) {
 		free_eventlog_info( elog );
@@ -246,7 +246,7 @@ static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hn
 	if ( !get_oldest_entry_hook( elog ) ) {
 		DEBUG(3,("elog_open: Successfully opened eventlog but can't "
 			"get any information on internal records!\n"));
-	}	
+	}
 
 	elog->current_record = elog->oldest_entry;
 
@@ -283,15 +283,15 @@ static int elog_size( EVENTLOG_INFO *info )
   Eventlog_entry.  returns NULL if it can't get the record for some reason.
  ********************************************************************/
 
-static Eventlog_entry *get_eventlog_record(prs_struct *ps,
+static Eventlog_entry *get_eventlog_record(TALLOC_CTX *mem_ctx,
 				TDB_CONTEXT *tdb,
 				int recno)
 {
 	Eventlog_entry *ee = NULL;
 	TDB_DATA ret, key;
 
-	int srecno;
-	int reclen;
+	int32_t srecno;
+	int32_t reclen;
 	int len;
 
 	char *wpsource = NULL;
@@ -300,10 +300,10 @@ static Eventlog_entry *get_eventlog_record(prs_struct *ps,
 	char *wpstrs = NULL;
 	char *puserdata = NULL;
 
-	key.dsize = sizeof(int32);
+	key.dsize = sizeof(int32_t);
 
 	srecno = recno;
-	key.dptr = ( uint8 * ) &srecno;
+	key.dptr = (unsigned char *)&srecno;
 
 	ret = tdb_fetch( tdb, key );
 
@@ -321,7 +321,7 @@ static Eventlog_entry *get_eventlog_record(prs_struct *ps,
 	if ( !len )
 		return NULL;
 
-	ee = TALLOC_ARRAY(ps->mem_ctx, Eventlog_entry, 1);
+	ee = TALLOC_ARRAY(mem_ctx, Eventlog_entry, 1);
 	if (!ee) {
 		return NULL;
 	}
@@ -413,7 +413,7 @@ static Eventlog_entry *get_eventlog_record(prs_struct *ps,
 }
 
 /********************************************************************
- note that this can only be called AFTER the table is constructed, 
+ note that this can only be called AFTER the table is constructed,
  since it uses the table to find the tdb handle
  ********************************************************************/
 
@@ -426,28 +426,28 @@ static bool sync_eventlog_params( EVENTLOG_INFO *info )
 	struct registry_value *value;
 	WERROR wresult;
 	char *elogname = info->logname;
-	TALLOC_CTX *ctx = talloc_tos();
+	TALLOC_CTX *ctx = talloc_stackframe();
 	bool ret = false;
 
 	DEBUG( 4, ( "sync_eventlog_params with %s\n", elogname ) );
 
 	if ( !info->etdb ) {
 		DEBUG( 4, ( "No open tdb! (%s)\n", info->logname ) );
-		return False;
+		goto done;
 	}
 	/* set resonable defaults.  512Kb on size and 1 week on time */
 
 	uiMaxSize = 0x80000;
 	uiRetention = 604800;
 
-	/* the general idea is to internally open the registry 
-	   key and retrieve the values.  That way we can continue 
-	   to use the same fetch/store api that we use in 
+	/* the general idea is to internally open the registry
+	   key and retrieve the values.  That way we can continue
+	   to use the same fetch/store api that we use in
 	   srv_reg_nt.c */
 
 	path = talloc_asprintf(ctx, "%s/%s", KEY_EVENTLOG, elogname );
 	if (!path) {
-		return false;
+		goto done;
 	}
 
 	wresult = reg_open_path(ctx, path, REG_KEY_READ, get_root_nt_token(),
@@ -457,14 +457,13 @@ static bool sync_eventlog_params( EVENTLOG_INFO *info )
 		DEBUG( 4,
 		       ( "sync_eventlog_params: Failed to open key [%s] (%s)\n",
 			 path, win_errstr( wresult ) ) );
-		return false;
+		goto done;
 	}
 
 	wresult = reg_queryvalue(key, key, "Retention", &value);
 	if (!W_ERROR_IS_OK(wresult)) {
 		DEBUG(4, ("Failed to query value \"Retention\": %s\n",
 			  win_errstr(wresult)));
-		ret = false;
 		goto done;
 	}
 	uiRetention = value->v.dword;
@@ -473,7 +472,6 @@ static bool sync_eventlog_params( EVENTLOG_INFO *info )
 	if (!W_ERROR_IS_OK(wresult)) {
 		DEBUG(4, ("Failed to query value \"MaxSize\": %s\n",
 			  win_errstr(wresult)));
-		ret = false;
 		goto done;
 	}
 	uiMaxSize = value->v.dword;
@@ -491,13 +489,13 @@ done:
 /********************************************************************
  ********************************************************************/
 
-static Eventlog_entry *read_package_entry( prs_struct * ps,
+static Eventlog_entry *read_package_entry( TALLOC_CTX *mem_ctx,
 					   Eventlog_entry * entry )
 {
 	uint8 *offset;
 	Eventlog_entry *ee_new = NULL;
 
-	ee_new = PRS_ALLOC_MEM( ps, Eventlog_entry, 1 );
+	ee_new = TALLOC_ZERO_ARRAY(mem_ctx, Eventlog_entry, 1 );
 	if ( ee_new == NULL ) {
 		return NULL;
 	}
@@ -536,10 +534,10 @@ static Eventlog_entry *read_package_entry( prs_struct * ps,
 	DEBUG( 10,
 	       ( "entry->record.length is [%d].\n", entry->record.length ) );
 	entry->data =
-		PRS_ALLOC_MEM( ps, uint8,
-			       entry->record.length -
-			       sizeof( Eventlog_record ) -
-			       sizeof( entry->record.length ) );
+		TALLOC_ZERO_ARRAY(mem_ctx, uint8_t,
+				  entry->record.length -
+				  sizeof( Eventlog_record ) -
+				  sizeof( entry->record.length ));
 	if ( entry->data == NULL ) {
 		return NULL;
 	}
@@ -625,13 +623,13 @@ NTSTATUS _eventlog_OpenEventLogW(pipes_struct *p,
 	if (r->in.logname->string) {
 		logname = r->in.logname->string;
 	}
-	
+
 	DEBUG( 10,("_eventlog_open_eventlog: Server [%s], Log [%s]\n",
 		servername, logname ));
-		
+
 	/* according to MSDN, if the logfile cannot be found, we should
 	  default to the "Application" log */
-	  
+
 	if ( !NT_STATUS_IS_OK( result = elog_open( p, logname, r->out.handle )) )
 		return result;
 
@@ -761,7 +759,7 @@ NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
 
 		/* assume that when the record fetch fails, that we are done */
 
-		entry = get_eventlog_record (ps, ELOG_TDB_CTX(info->etdb), record_number);
+		entry = get_eventlog_record (ps->mem_ctx, ELOG_TDB_CTX(info->etdb), record_number);
 		if (!entry) {
 			break;
 		}
@@ -770,7 +768,7 @@ NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
 
 		/* Now see if there is enough room to add */
 
-		if ( !(ee_new = read_package_entry( ps, entry )) )
+		if ( !(ee_new = read_package_entry( ps->mem_ctx, entry )) )
 			return NT_STATUS_NO_MEMORY;
 
 		if ( r_u->num_bytes_in_resp + ee_new->record.length > q_u->max_read_size ) {
diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index f4e891ca8c..05452112ca 100644
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -381,9 +381,10 @@ NTSTATUS _lsa_OpenPolicy2(pipes_struct *p,
 	/* get the generic lsa policy SD until we store it */
 	lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
 
-	status = se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted);
+	status = se_access_check(psd, p->server_info->ptok, des_access,
+				 &acc_granted);
 	if (!NT_STATUS_IS_OK(status)) {
-		if (p->pipe_user.ut.uid != sec_initial_uid()) {
+		if (p->server_info->utok.uid != sec_initial_uid()) {
 			return status;
 		}
 		DEBUG(4,("ACCESS should be DENIED (granted: %#010x;  required: %#010x)\n",
@@ -393,7 +394,7 @@ NTSTATUS _lsa_OpenPolicy2(pipes_struct *p,
 
 	/* This is needed for lsa_open_account and rpcclient .... :-) */
 
-	if (p->pipe_user.ut.uid == sec_initial_uid())
+	if (p->server_info->utok.uid == sec_initial_uid())
 		acc_granted = LSA_POLICY_ALL_ACCESS;
 
 	/* associate the domain SID with the (unique) handle. */
@@ -432,9 +433,10 @@ NTSTATUS _lsa_OpenPolicy(pipes_struct *p,
 	/* get the generic lsa policy SD until we store it */
 	lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
 
-	status = se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted);
+	status = se_access_check(psd, p->server_info->ptok, des_access,
+				 &acc_granted);
 	if (!NT_STATUS_IS_OK(status)) {
-		if (p->pipe_user.ut.uid != sec_initial_uid()) {
+		if (p->server_info->utok.uid != sec_initial_uid()) {
 			return status;
 		}
 		DEBUG(4,("ACCESS should be DENIED (granted: %#010x;  required: %#010x)\n",
@@ -1539,8 +1541,9 @@ NTSTATUS _lsa_CreateAccount(pipes_struct *p,
 	/* check to see if the pipe_user is a Domain Admin since
 	   account_pol.tdb was already opened as root, this is all we have */
 
-	if ( p->pipe_user.ut.uid != sec_initial_uid()
-		&& !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+	if ( p->server_info->utok.uid != sec_initial_uid()
+		&& !nt_token_check_domain_rid( p->server_info->ptok,
+					       DOMAIN_GROUP_RID_ADMINS ) )
 		return NT_STATUS_ACCESS_DENIED;
 
 	if ( is_privileged_sid( r->in.sid ) )
@@ -1726,8 +1729,9 @@ NTSTATUS _lsa_SetSystemAccessAccount(pipes_struct *p,
 	/* check to see if the pipe_user is a Domain Admin since
 	   account_pol.tdb was already opened as root, this is all we have */
 
-	if ( p->pipe_user.ut.uid != sec_initial_uid()
-		&& !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+	if ( p->server_info->utok.uid != sec_initial_uid()
+		&& !nt_token_check_domain_rid( p->server_info->ptok,
+					       DOMAIN_GROUP_RID_ADMINS ) )
 		return NT_STATUS_ACCESS_DENIED;
 
 	if (!pdb_getgrsid(&map, info->sid))
@@ -1755,8 +1759,9 @@ NTSTATUS _lsa_AddPrivilegesToAccount(pipes_struct *p,
 	/* check to see if the pipe_user is root or a Domain Admin since
 	   account_pol.tdb was already opened as root, this is all we have */
 
-	if ( p->pipe_user.ut.uid != sec_initial_uid()
-		&& !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+	if ( p->server_info->utok.uid != sec_initial_uid()
+		&& !nt_token_check_domain_rid( p->server_info->ptok,
+					       DOMAIN_GROUP_RID_ADMINS ) )
 	{
 		return NT_STATUS_ACCESS_DENIED;
 	}
@@ -1795,8 +1800,9 @@ NTSTATUS _lsa_RemovePrivilegesFromAccount(pipes_struct *p,
 	/* check to see if the pipe_user is root or a Domain Admin since
 	   account_pol.tdb was already opened as root, this is all we have */
 
-	if ( p->pipe_user.ut.uid != sec_initial_uid()
-		&& !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+	if ( p->server_info->utok.uid != sec_initial_uid()
+		&& !nt_token_check_domain_rid( p->server_info->ptok,
+					       DOMAIN_GROUP_RID_ADMINS ) )
 	{
 		return NT_STATUS_ACCESS_DENIED;
 	}
@@ -1952,8 +1958,9 @@ NTSTATUS _lsa_AddAccountRights(pipes_struct *p,
 	/* check to see if the pipe_user is a Domain Admin since
 	   account_pol.tdb was already opened as root, this is all we have */
 
-	if ( p->pipe_user.ut.uid != sec_initial_uid()
-		&& !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+	if ( p->server_info->utok.uid != sec_initial_uid()
+		&& !nt_token_check_domain_rid( p->server_info->ptok,
+					       DOMAIN_GROUP_RID_ADMINS ) )
 	{
 		return NT_STATUS_ACCESS_DENIED;
 	}
@@ -2001,8 +2008,9 @@ NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p,
 	/* check to see if the pipe_user is a Domain Admin since
 	   account_pol.tdb was already opened as root, this is all we have */
 
-	if ( p->pipe_user.ut.uid != sec_initial_uid()
-		&& !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+	if ( p->server_info->utok.uid != sec_initial_uid()
+		&& !nt_token_check_domain_rid( p->server_info->ptok,
+					       DOMAIN_GROUP_RID_ADMINS ) )
 	{
 		return NT_STATUS_ACCESS_DENIED;
 	}
diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c
index 75fc99401e..45acd3ed48 100644
--- a/source3/rpc_server/srv_netlog_nt.c
+++ b/source3/rpc_server/srv_netlog_nt.c
@@ -981,7 +981,7 @@ NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
 		memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
 	}
 
-	status = serverinfo_to_SamInfo3(server_info, pipe_session_key, sam3);
+	status = serverinfo_to_SamInfo3(server_info, pipe_session_key, 16, sam3);
 	TALLOC_FREE(server_info);
 	return status;
 }
diff --git a/source3/rpc_server/srv_ntsvcs.c b/source3/rpc_server/srv_ntsvcs.c
index 5010990b58..840da3eec4 100644
--- a/source3/rpc_server/srv_ntsvcs.c
+++ b/source3/rpc_server/srv_ntsvcs.c
@@ -97,23 +97,7 @@ static bool api_ntsvcs_validate_device_instance(pipes_struct *p)
 
 static bool api_ntsvcs_get_device_reg_property(pipes_struct *p)
 {
-	NTSVCS_Q_GET_DEVICE_REG_PROPERTY q_u;
-	NTSVCS_R_GET_DEVICE_REG_PROPERTY r_u;
-	prs_struct *data = &p->in_data.data;
-	prs_struct *rdata = &p->out_data.rdata;
-
-	ZERO_STRUCT(q_u);
-	ZERO_STRUCT(r_u);
-
-	if(!ntsvcs_io_q_get_device_reg_property("", &q_u, data, 0))
-		return False;
-
-	r_u.status = _ntsvcs_get_device_reg_property(p, &q_u, &r_u);
-
-	if(!ntsvcs_io_r_get_device_reg_property("", &r_u, rdata, 0))
-		return False;
-
-	return True;
+	return proxy_ntsvcs_call(p, NDR_PNP_GETDEVICEREGPROP);
 }
 
 /*******************************************************************
diff --git a/source3/rpc_server/srv_ntsvcs_nt.c b/source3/rpc_server/srv_ntsvcs_nt.c
index 268da52896..f2c85bbd3e 100644
--- a/source3/rpc_server/srv_ntsvcs_nt.c
+++ b/source3/rpc_server/srv_ntsvcs_nt.c
@@ -93,30 +93,31 @@ WERROR _ntsvcs_get_device_list( pipes_struct *p, NTSVCS_Q_GET_DEVICE_LIST *q_u,
 }
 
 /********************************************************************
+_PNP_GetDeviceRegProp
 ********************************************************************/
 
-WERROR _ntsvcs_get_device_reg_property( pipes_struct *p, NTSVCS_Q_GET_DEVICE_REG_PROPERTY *q_u, NTSVCS_R_GET_DEVICE_REG_PROPERTY *r_u )
+WERROR _PNP_GetDeviceRegProp(pipes_struct *p,
+			     struct PNP_GetDeviceRegProp *r)
 {
-	fstring devicepath;
 	char *ptr;
 	REGVAL_CTR *values;
 	REGISTRY_VALUE *val;
 
-	rpcstr_pull(devicepath, q_u->devicepath.buffer, sizeof(devicepath), q_u->devicepath.uni_str_len*2, 0);
-
-	switch( q_u->property ) {
+	switch( r->in.property ) {
 	case DEV_REGPROP_DESC:
+
 		/* just parse the service name from the device path and then
 		   lookup the display name */
-		if ( !(ptr = strrchr_m( devicepath, '\\' )) )
+		if ( !(ptr = strrchr_m( r->in.devicepath, '\\' )) )
 			return WERR_GENERAL_FAILURE;
 		*ptr = '\0';
 
-		if ( !(ptr = strrchr_m( devicepath, '_' )) )
+		if ( !(ptr = strrchr_m( r->in.devicepath, '_' )) )
 			return WERR_GENERAL_FAILURE;
 		ptr++;
 
-		if ( !(values = svcctl_fetch_regvalues( ptr, p->pipe_user.nt_user_token )) )
+		if ( !(values = svcctl_fetch_regvalues(
+			       ptr, p->server_info->ptok)))
 			return WERR_GENERAL_FAILURE;
 
 		if ( !(val = regval_ctr_getvalue( values, "DisplayName" )) ) {
@@ -124,16 +125,27 @@ WERROR _ntsvcs_get_device_reg_property( pipes_struct *p, NTSVCS_Q_GET_DEVICE_REG
 			return WERR_GENERAL_FAILURE;
 		}
 
-		r_u->unknown1 = 0x1;	/* always 1...tested using a remove device manager connection */
-		r_u->size = reg_init_regval_buffer( &r_u->value, val );
-		r_u->needed = r_u->size;
+		if (*r->in.buffer_size < val->size) {
+			*r->out.needed = val->size;
+			*r->out.buffer_size = 0;
+			TALLOC_FREE( values );
+			return WERR_CM_BUFFER_SMALL;
+		}
 
+		r->out.buffer = (uint8_t *)talloc_memdup(p->mem_ctx, val->data_p, val->size);
 		TALLOC_FREE(values);
+		if (!r->out.buffer) {
+			return WERR_NOMEM;
+		}
+
+		*r->out.reg_data_type = REG_SZ;	/* always 1...tested using a remove device manager connection */
+		*r->out.buffer_size = val->size;
+		*r->out.needed = val->size;
 
 		break;
 
 	default:
-		r_u->unknown1 = 0x00437c98;
+		*r->out.reg_data_type = 0x00437c98; /* ??? */
 		return WERR_CM_NO_SUCH_VALUE;
 	}
 
@@ -279,16 +291,6 @@ WERROR _PNP_GetDepth(pipes_struct *p,
 /****************************************************************
 ****************************************************************/
 
-WERROR _PNP_GetDeviceRegProp(pipes_struct *p,
-			     struct PNP_GetDeviceRegProp *r)
-{
-	p->rng_fault_state = true;
-	return WERR_NOT_SUPPORTED;
-}
-
-/****************************************************************
-****************************************************************/
-
 WERROR _PNP_SetDeviceRegProp(pipes_struct *p,
 			     struct PNP_SetDeviceRegProp *r)
 {
diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 2c31d7b3f1..5610e0bf71 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -614,11 +614,6 @@ static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 
 	ZERO_STRUCT(reply);
 
-	/* Set up for non-authenticated user. */
-	TALLOC_FREE(p->pipe_user.nt_user_token);
-	p->pipe_user.ut.ngroups = 0;
-	SAFE_FREE( p->pipe_user.ut.groups);
-
 	/* this has to be done as root in order to verify the password */
 	become_root();
 	status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
@@ -656,29 +651,8 @@ static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 		  "workstation: %s\n", a->ntlmssp_state->user,
 		  a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
 
-	/*
-	 * Store the UNIX credential data (uid/gid pair) in the pipe structure.
-	 */
-
-	p->pipe_user.ut.uid = a->server_info->utok.uid;
-	p->pipe_user.ut.gid = a->server_info->utok.gid;
-	
-	p->pipe_user.ut.ngroups = a->server_info->utok.ngroups;
-	if (p->pipe_user.ut.ngroups) {
-		if (!(p->pipe_user.ut.groups = (gid_t *)memdup(
-			      a->server_info->utok.groups,
-			      sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
-			DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
-			return False;
-		}
-	}
-
-	if (a->server_info->ptok) {
-		p->pipe_user.nt_user_token =
-			dup_nt_token(NULL, a->server_info->ptok);
-	} else {
+	if (a->server_info->ptok == NULL) {
 		DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
-		p->pipe_user.nt_user_token = NULL;
 		return False;
 	}
 
@@ -1711,11 +1685,6 @@ bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 
 		case RPC_ANONYMOUS_AUTH_TYPE:
 			/* Unauthenticated bind request. */
-			/* Get the authenticated pipe user from current_user */
-			if (!copy_current_user(&p->pipe_user, &current_user)) {
-				DEBUG(10, ("Could not copy current user\n"));
-				goto err_exit;
-			}
 			/* We're finished - no more packets. */
 			p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 			/* We must set the pipe auth_level here also. */
@@ -2226,23 +2195,6 @@ bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss
 }
 
 /****************************************************************************
- Return a user struct for a pipe user.
-****************************************************************************/
-
-struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
-{
-	if (p->pipe_bound &&
-			(p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
-			(p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
-		memcpy(user, &p->pipe_user, sizeof(struct current_user));
-	} else {
-		memcpy(user, &current_user, sizeof(struct current_user));
-	}
-
-	return user;
-}
-
-/****************************************************************************
  Find the set of RPC functions associated with this context_id
 ****************************************************************************/
 
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c
index 92f89282cf..1cff95dcab 100644
--- a/source3/rpc_server/srv_pipe_hnd.c
+++ b/source3/rpc_server/srv_pipe_hnd.c
@@ -20,6 +20,7 @@
  */
 
 #include "includes.h"
+#include "librpc/gen_ndr/ndr_named_pipe_auth.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_RPC_SRV
@@ -161,13 +162,6 @@ static struct pipes_struct *make_internal_rpc_pipe_p(TALLOC_CTX *mem_ctx,
 
 	p->endian = RPC_LITTLE_ENDIAN;
 
-	ZERO_STRUCT(p->pipe_user);
-
-	p->pipe_user.vuid = vuid;
-	p->pipe_user.ut.uid = (uid_t)-1;
-	p->pipe_user.ut.gid = (gid_t)-1;
-	p->pipe_user.nt_user_token = dup_nt_token(NULL, server_info->ptok);
-
 	/*
 	 * Initialize the outgoing RPC data buffer with no memory.
 	 */	
@@ -899,9 +893,6 @@ static int close_internal_rpc_pipe_hnd(struct pipes_struct *p)
 	/* Free the handles database. */
 	close_policy_by_pipe(p);
 
-	TALLOC_FREE(p->pipe_user.nt_user_token);
-	SAFE_FREE(p->pipe_user.ut.groups);
-
 	DLIST_REMOVE(InternalPipes, p);
 
 	ZERO_STRUCTP(p);
@@ -944,6 +935,17 @@ static struct np_proxy_state *make_external_rpc_pipe_p(TALLOC_CTX *mem_ctx,
 	struct np_proxy_state *result;
 	struct sockaddr_un addr;
 	char *socket_path;
+	const char *socket_dir;
+
+	DATA_BLOB req_blob;
+	struct netr_SamInfo3 *info3;
+	struct named_pipe_auth_req req;
+	DATA_BLOB rep_blob;
+	uint8 rep_buf[20];
+	struct named_pipe_auth_rep rep;
+	enum ndr_err_code ndr_err;
+	NTSTATUS status;
+	ssize_t written;
 
 	result = talloc(mem_ctx, struct np_proxy_state);
 	if (result == NULL) {
@@ -961,8 +963,16 @@ static struct np_proxy_state *make_external_rpc_pipe_p(TALLOC_CTX *mem_ctx,
 	ZERO_STRUCT(addr);
 	addr.sun_family = AF_UNIX;
 
-	socket_path = talloc_asprintf(talloc_tos(), "%s/%s",
-				      get_dyn_NCALRPCDIR(), "DEFAULT");
+	socket_dir = lp_parm_const_string(
+		GLOBAL_SECTION_SNUM, "external_rpc_pipe", "socket_dir",
+		get_dyn_NCALRPCDIR());
+	if (socket_dir == NULL) {
+		DEBUG(0, ("externan_rpc_pipe:socket_dir not set\n"));
+		goto fail;
+	}
+
+	socket_path = talloc_asprintf(talloc_tos(), "%s/np/%s",
+				      socket_dir, pipe_name);
 	if (socket_path == NULL) {
 		DEBUG(0, ("talloc_asprintf failed\n"));
 		goto fail;
@@ -970,11 +980,96 @@ static struct np_proxy_state *make_external_rpc_pipe_p(TALLOC_CTX *mem_ctx,
 	strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
 	TALLOC_FREE(socket_path);
 
+	become_root();
 	if (sys_connect(result->fd, (struct sockaddr *)&addr) == -1) {
+		unbecome_root();
 		DEBUG(0, ("connect(%s) failed: %s\n", addr.sun_path,
 			  strerror(errno)));
 		goto fail;
 	}
+	unbecome_root();
+
+	info3 = talloc(talloc_tos(), struct netr_SamInfo3);
+	if (info3 == NULL) {
+		DEBUG(0, ("talloc failed\n"));
+		goto fail;
+	}
+
+	status = serverinfo_to_SamInfo3(server_info, NULL, 0, info3);
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(info3);
+		DEBUG(0, ("serverinfo_to_SamInfo3 failed: %s\n",
+			  nt_errstr(status)));
+		goto fail;
+	}
+
+	req.level = 1;
+	req.info.info1 = *info3;
+
+	ndr_err = ndr_push_struct_blob(
+		&req_blob, talloc_tos(), NULL, &req,
+		(ndr_push_flags_fn_t)ndr_push_named_pipe_auth_req);
+
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		DEBUG(10, ("ndr_push_named_pipe_auth_req failed: %s\n",
+			   ndr_errstr(ndr_err)));
+		goto fail;
+	}
+
+	DEBUG(10, ("named_pipe_auth_req(client)[%u]\n", (uint32_t)req_blob.length));
+	dump_data(10, req_blob.data, req_blob.length);
+
+	written = write_data(result->fd, (char *)req_blob.data,
+			     req_blob.length);
+	if (written == -1) {
+		DEBUG(3, ("Could not write auth req data to RPC server\n"));
+		goto fail;
+	}
+
+	status = read_data(result->fd, (char *)rep_buf, sizeof(rep_buf));
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(3, ("Could not read auth result\n"));
+		goto fail;
+	}
+
+	rep_blob = data_blob_const(rep_buf, sizeof(rep_buf));
+
+	DEBUG(10,("name_pipe_auth_rep(client)[%u]\n", (uint32_t)rep_blob.length));
+	dump_data(10, rep_blob.data, rep_blob.length);
+
+	ndr_err = ndr_pull_struct_blob(
+		&rep_blob, talloc_tos(), NULL, &rep,
+		(ndr_pull_flags_fn_t)ndr_pull_named_pipe_auth_rep);
+
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		DEBUG(0, ("ndr_pull_named_pipe_auth_rep failed: %s\n",
+			  ndr_errstr(ndr_err)));
+		goto fail;
+	}
+
+	if (rep.length != 16) {
+		DEBUG(0, ("req invalid length: %u != 16\n",
+			  rep.length));
+		goto fail;
+	}
+
+	if (strcmp(NAMED_PIPE_AUTH_MAGIC, rep.magic) != 0) {
+		DEBUG(0, ("req invalid magic: %s != %s\n",
+			  rep.magic, NAMED_PIPE_AUTH_MAGIC));
+		goto fail;
+	}
+
+	if (!NT_STATUS_IS_OK(rep.status)) {
+		DEBUG(0, ("req failed: %s\n",
+			  nt_errstr(rep.status)));
+		goto fail;
+	}
+
+	if (rep.level != 1) {
+		DEBUG(0, ("req invalid level: %u != 1\n",
+			  rep.level));
+		goto fail;
+	}
 
 	return result;
 
@@ -983,9 +1078,10 @@ static struct np_proxy_state *make_external_rpc_pipe_p(TALLOC_CTX *mem_ctx,
 	return NULL;
 }
 
-NTSTATUS np_open(struct smb_request *smb_req, struct connection_struct *conn,
-		 const char *name, struct files_struct **pfsp)
+NTSTATUS np_open(struct smb_request *smb_req, const char *name,
+		 struct files_struct **pfsp)
 {
+	struct connection_struct *conn = smb_req->conn;
 	NTSTATUS status;
 	struct files_struct *fsp;
 	const char **proxy_list;
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index c573173900..cbcd4de60c 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -45,6 +45,9 @@
 
 #define DISP_INFO_CACHE_TIMEOUT 10
 
+#define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
+#define MAX_SAM_ENTRIES_W95 50
+
 typedef struct disp_info {
 	DOM_SID sid; /* identify which domain this is. */
 	bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
@@ -629,7 +632,7 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
 		return status;
 
 	/*check if access can be granted as requested by client. */
-	map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+	map_max_allowed_access(p->server_info->ptok, &des_access);
 
 	make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
 	se_map_generic( &des_access, &dom_generic_mapping );
@@ -637,7 +640,7 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
 	se_priv_copy( &se_rights, &se_machine_account );
 	se_priv_add( &se_rights, &se_add_users );
 
-	status = access_check_samr_object( psd, p->pipe_user.nt_user_token,
+	status = access_check_samr_object( psd, p->server_info->ptok,
 		&se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
 		&acc_granted, "_samr_OpenDomain" );
 
@@ -1009,6 +1012,7 @@ NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
 	if (!samr_array) {
 		return NT_STATUS_NO_MEMORY;
 	}
+	*r->out.sam = samr_array;
 
 	become_root();
 
@@ -1068,7 +1072,6 @@ NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
 	samr_array->entries = samr_entries;
 
 	*r->out.resume_handle = *r->in.resume_handle + num_account;
-	*r->out.sam = samr_array;
 	*r->out.num_entries = num_account;
 
 	DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
@@ -1481,6 +1484,11 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
 	if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
 		return NT_STATUS_INVALID_HANDLE;
 
+	if (info->builtin_domain) {
+		DEBUG(5,("_samr_QueryDisplayInfo: Nothing in BUILTIN\n"));
+		return NT_STATUS_OK;
+	}
+
 	status = access_check_samr_function(info->acc_granted,
 					    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
 					    "_samr_QueryDisplayInfo");
@@ -1791,6 +1799,7 @@ NTSTATUS _samr_LookupNames(pipes_struct *p,
 	DOM_SID pol_sid;
 	uint32  acc_granted;
 	struct samr_Ids rids, types;
+	uint32_t num_mapped = 0;
 
 	DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
 
@@ -1838,10 +1847,18 @@ NTSTATUS _samr_LookupNames(pipes_struct *p,
 		}
 
 		if (type[i] != SID_NAME_UNKNOWN) {
-			status = NT_STATUS_OK;
+			num_mapped++;
 		}
 	}
 
+	if (num_mapped == num_rids) {
+		status = NT_STATUS_OK;
+	} else if (num_mapped == 0) {
+		status = NT_STATUS_NONE_MAPPED;
+	} else {
+		status = STATUS_SOME_UNMAPPED;
+	}
+
 	rids.count = num_rids;
 	rids.ids = rid;
 
@@ -2163,7 +2180,7 @@ NTSTATUS _samr_OpenUser(pipes_struct *p,
 
 	/* check if access can be granted as requested by client. */
 
-	map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+	map_max_allowed_access(p->server_info->ptok, &des_access);
 
 	make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
 	se_map_generic(&des_access, &usr_generic_mapping);
@@ -2171,7 +2188,7 @@ NTSTATUS _samr_OpenUser(pipes_struct *p,
 	se_priv_copy( &se_rights, &se_machine_account );
 	se_priv_add( &se_rights, &se_add_users );
 
-	nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+	nt_status = access_check_samr_object(psd, p->server_info->ptok,
 		&se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
 		&acc_granted, "_samr_OpenUser");
 
@@ -2236,79 +2253,117 @@ static NTSTATUS init_samr_parameters_string(TALLOC_CTX *mem_ctx,
 	return NT_STATUS_OK;
 }
 
-/*************************************************************************
- get_user_info_7. Safe. Only gives out account_name.
- *************************************************************************/
-
-static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
-				struct samr_UserInfo7 *r,
-				DOM_SID *user_sid)
+static NTSTATUS get_user_info_5(TALLOC_CTX *mem_ctx,
+				struct samr_UserInfo5 *r,
+				struct samu *pw,
+				DOM_SID *domain_sid)
 {
-	struct samu *smbpass=NULL;
-	bool ret;
-	const char *account_name = NULL;
+	const DOM_SID *sid_user, *sid_group;
+	uint32_t rid, primary_gid;
+	NTTIME last_logon, last_logoff, last_password_change,
+	       acct_expiry;
+	const char *account_name, *full_name, *home_directory, *home_drive,
+		   *logon_script, *profile_path, *description,
+		   *workstations, *comment;
+	struct samr_LogonHours logon_hours;
 
 	ZERO_STRUCTP(r);
 
-	if ( !(smbpass = samu_new( mem_ctx )) ) {
-		return NT_STATUS_NO_MEMORY;
+	sid_user = pdb_get_user_sid(pw);
+
+	if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
+		DEBUG(0, ("get_user_info_5: User %s has SID %s, \nwhich conflicts with "
+			  "the domain sid %s.  Failing operation.\n",
+			  pdb_get_username(pw), sid_string_dbg(sid_user),
+			  sid_string_dbg(domain_sid)));
+		return NT_STATUS_UNSUCCESSFUL;
 	}
 
 	become_root();
-	ret = pdb_getsampwsid(smbpass, user_sid);
+	sid_group = pdb_get_group_sid(pw);
 	unbecome_root();
 
-	if ( !ret ) {
-		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
-		return NT_STATUS_NO_SUCH_USER;
+	if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
+		DEBUG(0, ("get_user_info_5: User %s has Primary Group SID %s, \n"
+			  "which conflicts with the domain sid %s.  Failing operation.\n",
+			  pdb_get_username(pw), sid_string_dbg(sid_group),
+			  sid_string_dbg(domain_sid)));
+		return NT_STATUS_UNSUCCESSFUL;
 	}
 
-	account_name = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
-	if (!account_name) {
-		TALLOC_FREE(smbpass);
-		return NT_STATUS_NO_MEMORY;
-	}
-	TALLOC_FREE(smbpass);
+	unix_to_nt_time(&last_logon, pdb_get_logon_time(pw));
+	unix_to_nt_time(&last_logoff, pdb_get_logoff_time(pw));
+	unix_to_nt_time(&acct_expiry, pdb_get_kickoff_time(pw));
+	unix_to_nt_time(&last_password_change, pdb_get_pass_last_set_time(pw));
+
+	account_name = talloc_strdup(mem_ctx, pdb_get_username(pw));
+	full_name = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
+	home_directory = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
+	home_drive = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
+	logon_script = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
+	profile_path = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
+	description = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
+	workstations = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
+	comment = talloc_strdup(mem_ctx, pdb_get_comment(pw));
 
-	DEBUG(3,("User:[%s]\n", account_name));
+	logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
 
-	init_samr_user_info7(r, account_name);
+	init_samr_user_info5(r,
+			     account_name,
+			     full_name,
+			     rid,
+			     primary_gid,
+			     home_directory,
+			     home_drive,
+			     logon_script,
+			     profile_path,
+			     description,
+			     workstations,
+			     last_logon,
+			     last_logoff,
+			     logon_hours,
+			     pdb_get_bad_password_count(pw),
+			     pdb_get_logon_count(pw),
+			     last_password_change,
+			     acct_expiry,
+			     pdb_get_acct_ctrl(pw));
 
 	return NT_STATUS_OK;
 }
 
 /*************************************************************************
- get_user_info_9. Only gives out primary group SID.
+ get_user_info_7. Safe. Only gives out account_name.
  *************************************************************************/
 
-static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
-				struct samr_UserInfo9 *r,
-				DOM_SID *user_sid)
+static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
+				struct samr_UserInfo7 *r,
+				struct samu *smbpass)
 {
-	struct samu *smbpass=NULL;
-	bool ret;
+	const char *account_name = NULL;
 
 	ZERO_STRUCTP(r);
 
-	if ( !(smbpass = samu_new( mem_ctx )) ) {
+	account_name = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
+	if (!account_name) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	become_root();
-	ret = pdb_getsampwsid(smbpass, user_sid);
-	unbecome_root();
+	init_samr_user_info7(r, account_name);
 
-	if (ret==False) {
-		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
-		TALLOC_FREE(smbpass);
-		return NT_STATUS_NO_SUCH_USER;
-	}
+	return NT_STATUS_OK;
+}
 
-	DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
+/*************************************************************************
+ get_user_info_9. Only gives out primary group SID.
+ *************************************************************************/
 
-	init_samr_user_info9(r, pdb_get_group_rid(smbpass));
+static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
+				struct samr_UserInfo9 *r,
+				struct samu *smbpass)
+{
+	ZERO_STRUCTP(r);
 
-	TALLOC_FREE(smbpass);
+	init_samr_user_info9(r, pdb_get_group_rid(smbpass));
 
 	return NT_STATUS_OK;
 }
@@ -2319,33 +2374,12 @@ static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
 
 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx,
 				 struct samr_UserInfo16 *r,
-				 DOM_SID *user_sid)
+				 struct samu *smbpass)
 {
-	struct samu *smbpass=NULL;
-	bool ret;
-
 	ZERO_STRUCTP(r);
 
-	if ( !(smbpass = samu_new( mem_ctx )) ) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	become_root();
-	ret = pdb_getsampwsid(smbpass, user_sid);
-	unbecome_root();
-
-	if (ret==False) {
-		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
-		TALLOC_FREE(smbpass);
-		return NT_STATUS_NO_SUCH_USER;
-	}
-
-	DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
-
 	init_samr_user_info16(r, pdb_get_acct_ctrl(smbpass));
 
-	TALLOC_FREE(smbpass);
-
 	return NT_STATUS_OK;
 }
 
@@ -2410,10 +2444,8 @@ static NTSTATUS get_user_info_18(pipes_struct *p,
 
 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
 				 struct samr_UserInfo20 *r,
-				 DOM_SID *user_sid)
+				 struct samu *sampass)
 {
-	struct samu *sampass=NULL;
-	bool ret;
 	const char *munged_dial = NULL;
 	DATA_BLOB blob;
 	NTSTATUS status;
@@ -2421,24 +2453,8 @@ static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
 
 	ZERO_STRUCTP(r);
 
-	if ( !(sampass = samu_new( mem_ctx )) ) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	become_root();
-	ret = pdb_getsampwsid(sampass, user_sid);
-	unbecome_root();
-
-	if (ret == False) {
-		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
-		TALLOC_FREE(sampass);
-		return NT_STATUS_NO_SUCH_USER;
-	}
-
 	munged_dial = pdb_get_munged_dial(sampass);
 
-	samr_clear_sam_passwd(sampass);
-
 	DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass),
 		munged_dial, (int)strlen(munged_dial)));
 
@@ -2450,7 +2466,6 @@ static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
 
 	status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
 	data_blob_free(&blob);
-	TALLOC_FREE(sampass);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -2467,12 +2482,10 @@ static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
 
 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
 				 struct samr_UserInfo21 *r,
-				 DOM_SID *user_sid,
+				 struct samu *pw,
 				 DOM_SID *domain_sid)
 {
 	NTSTATUS status;
-	struct samu *pw = NULL;
-	bool ret;
 	const DOM_SID *sid_user, *sid_group;
 	uint32_t rid, primary_gid;
 	NTTIME last_logon, last_logoff, last_password_change,
@@ -2489,24 +2502,6 @@ static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
 
 	ZERO_STRUCTP(r);
 
-	if (!(pw = samu_new(mem_ctx))) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	become_root();
-	ret = pdb_getsampwsid(pw, user_sid);
-	unbecome_root();
-
-	if (ret == False) {
-		DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
-		TALLOC_FREE(pw);
-		return NT_STATUS_NO_SUCH_USER;
-	}
-
-	samr_clear_sam_passwd(pw);
-
-	DEBUG(3,("User:[%s]\n", pdb_get_username(pw)));
-
 	sid_user = pdb_get_user_sid(pw);
 
 	if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
@@ -2514,7 +2509,6 @@ static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
 			  "the domain sid %s.  Failing operation.\n",
 			  pdb_get_username(pw), sid_string_dbg(sid_user),
 			  sid_string_dbg(domain_sid)));
-		TALLOC_FREE(pw);
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
@@ -2527,7 +2521,6 @@ static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
 			  "which conflicts with the domain sid %s.  Failing operation.\n",
 			  pdb_get_username(pw), sid_string_dbg(sid_group),
 			  sid_string_dbg(domain_sid)));
-		TALLOC_FREE(pw);
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
@@ -2560,7 +2553,6 @@ static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
 	status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
 	data_blob_free(&blob);
 	if (!NT_STATUS_IS_OK(status)) {
-		TALLOC_FREE(pw);
 		return status;
 	}
 
@@ -2618,7 +2610,6 @@ static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
 			      0, /* nt_password_set */
 			      0, /* lm_password_set */
 			      password_expired);
-	TALLOC_FREE(pw);
 
 	return NT_STATUS_OK;
 }
@@ -2635,6 +2626,8 @@ NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
 	struct samr_info *info = NULL;
 	DOM_SID domain_sid;
 	uint32 rid;
+	bool ret = false;
+	struct samu *pwd = NULL;
 
 	/* search for the handle */
 	if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info))
@@ -2664,52 +2657,54 @@ NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
 
 	DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
 
+	if (!(pwd = samu_new(p->mem_ctx))) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	become_root();
+	ret = pdb_getsampwsid(pwd, &info->sid);
+	unbecome_root();
+
+	if (ret == false) {
+		DEBUG(4,("User %s not found\n", sid_string_dbg(&info->sid)));
+		TALLOC_FREE(pwd);
+		return NT_STATUS_NO_SUCH_USER;
+	}
+
+	DEBUG(3,("User:[%s]\n", pdb_get_username(pwd)));
+
+	samr_clear_sam_passwd(pwd);
+
 	switch (r->in.level) {
+	case 5:
+		status = get_user_info_5(p->mem_ctx, &user_info->info5, pwd, &domain_sid);
+		break;
 	case 7:
-		status = get_user_info_7(p->mem_ctx, &user_info->info7, &info->sid);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
+		status = get_user_info_7(p->mem_ctx, &user_info->info7, pwd);
 		break;
 	case 9:
-		status = get_user_info_9(p->mem_ctx, &user_info->info9, &info->sid);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
+		status = get_user_info_9(p->mem_ctx, &user_info->info9, pwd);
 		break;
 	case 16:
-		status = get_user_info_16(p->mem_ctx, &user_info->info16, &info->sid);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
+		status = get_user_info_16(p->mem_ctx, &user_info->info16, pwd);
 		break;
-
 	case 18:
+		/* level 18 is special */
 		status = get_user_info_18(p, p->mem_ctx, &user_info->info18, &info->sid);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
 		break;
-
 	case 20:
-		status = get_user_info_20(p->mem_ctx, &user_info->info20, &info->sid);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
+		status = get_user_info_20(p->mem_ctx, &user_info->info20, pwd);
 		break;
-
 	case 21:
-		status = get_user_info_21(p->mem_ctx, &user_info->info21,
-					  &info->sid, &domain_sid);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
+		status = get_user_info_21(p->mem_ctx, &user_info->info21, pwd, &domain_sid);
 		break;
-
 	default:
-		return NT_STATUS_INVALID_INFO_CLASS;
+		status = NT_STATUS_INVALID_INFO_CLASS;
+		break;
 	}
 
+	TALLOC_FREE(pwd);
+
 	*r->out.info = user_info;
 
 	DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__));
@@ -2717,6 +2712,21 @@ NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
 	return status;
 }
 
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
+			      struct samr_QueryUserInfo2 *r)
+{
+	struct samr_QueryUserInfo u;
+
+	u.in.user_handle	= r->in.user_handle;
+	u.in.level		= r->in.level;
+	u.out.info		= r->out.info;
+
+	return _samr_QueryUserInfo(p, &u);
+}
+
 /*******************************************************************
  _samr_GetGroupsForUser
  ********************************************************************/
@@ -2969,7 +2979,7 @@ NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
 							lp_workgroup(),
 							global_myname(),
 							seq_num,
-							1,
+							DOMAIN_SERVER_ENABLED,
 							server_role,
 							1,
 							num_users,
@@ -3146,6 +3156,11 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
 				     &disp_info))
 		return NT_STATUS_INVALID_HANDLE;
 
+	if (disp_info->builtin_domain) {
+		DEBUG(5,("_samr_CreateUser2: Refusing user create in BUILTIN\n"));
+		return NT_STATUS_ACCESS_DENIED;
+	}
+
 	nt_status = access_check_samr_function(acc_granted,
 					       SAMR_DOMAIN_ACCESS_CREATE_USER,
 					       "_samr_CreateUser2");
@@ -3176,7 +3191,7 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
 	{
 		se_priv_copy( &se_rights, &se_machine_account );
 		can_add_account = user_has_privileges(
-			p->pipe_user.nt_user_token, &se_rights );
+			p->server_info->ptok, &se_rights );
 	}
 	/* usrmgr.exe (and net rpc trustdom grant) creates a normal user
 	   account for domain trusts and changes the ACB flags later */
@@ -3185,7 +3200,7 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
 	{
 		se_priv_copy( &se_rights, &se_add_users );
 		can_add_account = user_has_privileges(
-			p->pipe_user.nt_user_token, &se_rights );
+			p->server_info->ptok, &se_rights );
 	}
 	else 	/* implicit assumption of a BDC or domain trust account here
 		 * (we already check the flags earlier) */
@@ -3194,13 +3209,13 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
 			/* only Domain Admins can add a BDC or domain trust */
 			se_priv_copy( &se_rights, &se_priv_none );
 			can_add_account = nt_token_check_domain_rid(
-				p->pipe_user.nt_user_token,
+				p->server_info->ptok,
 				DOMAIN_GROUP_RID_ADMINS );
 		}
 	}
 
 	DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
-		  uidtoname(p->pipe_user.ut.uid),
+		  uidtoname(p->server_info->utok.uid),
 		  can_add_account ? "True":"False" ));
 
 	/********** BEGIN Admin BLOCK **********/
@@ -3225,13 +3240,13 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
 
 	sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
 
-	map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+	map_max_allowed_access(p->server_info->ptok, &des_access);
 
 	make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
 			    &sid, SAMR_USR_RIGHTS_WRITE_PW);
 	se_map_generic(&des_access, &usr_generic_mapping);
 
-	nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+	nt_status = access_check_samr_object(psd, p->server_info->ptok,
 		&se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
 		&acc_granted, "_samr_CreateUser2");
 
@@ -3261,6 +3276,26 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
 	return NT_STATUS_OK;
 }
 
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _samr_CreateUser(pipes_struct *p,
+			  struct samr_CreateUser *r)
+{
+	struct samr_CreateUser2 c;
+	uint32_t access_granted;
+
+	c.in.domain_handle	= r->in.domain_handle;
+	c.in.account_name	= r->in.account_name;
+	c.in.acct_flags		= ACB_NORMAL;
+	c.in.access_mask	= r->in.access_mask;
+	c.out.user_handle	= r->out.user_handle;
+	c.out.access_granted	= &access_granted;
+	c.out.rid		= r->out.rid;
+
+	return _samr_CreateUser2(p, &c);
+}
+
 /*******************************************************************
  _samr_Connect
  ********************************************************************/
@@ -3288,7 +3323,7 @@ NTSTATUS _samr_Connect(pipes_struct *p,
 	   was observed from a win98 client trying to enumerate users (when configured
 	   user level access control on shares)   --jerry */
 
-	map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+	map_max_allowed_access(p->server_info->ptok, &des_access);
 
 	se_map_generic( &des_access, &sam_generic_mapping );
 	info->acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS|SAMR_ACCESS_OPEN_DOMAIN);
@@ -3313,24 +3348,36 @@ NTSTATUS _samr_Connect2(pipes_struct *p,
 	uint32    des_access = r->in.access_mask;
 	NTSTATUS  nt_status;
 	size_t    sd_size;
+	const char *fn = "_samr_Connect2";
 
+	switch (p->hdr_req.opnum) {
+	case NDR_SAMR_CONNECT2:
+		fn = "_samr_Connect2";
+		break;
+	case NDR_SAMR_CONNECT4:
+		fn = "_samr_Connect4";
+		break;
+	case NDR_SAMR_CONNECT5:
+		fn = "_samr_Connect5";
+		break;
+	}
 
-	DEBUG(5,("_samr_Connect2: %d\n", __LINE__));
+	DEBUG(5,("%s: %d\n", fn, __LINE__));
 
 	/* Access check */
 
 	if (!pipe_access_check(p)) {
-		DEBUG(3, ("access denied to _samr_Connect2\n"));
+		DEBUG(3, ("access denied to %s\n", fn));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
-	map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+	map_max_allowed_access(p->server_info->ptok, &des_access);
 
 	make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
 	se_map_generic(&des_access, &sam_generic_mapping);
 
-	nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
-		NULL, 0, des_access, &acc_granted, "_samr_Connect2");
+	nt_status = access_check_samr_object(psd, p->server_info->ptok,
+		NULL, 0, des_access, &acc_granted, fn);
 
 	if ( !NT_STATUS_IS_OK(nt_status) )
 		return nt_status;
@@ -3346,7 +3393,7 @@ NTSTATUS _samr_Connect2(pipes_struct *p,
 	if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
 		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 
-	DEBUG(5,("_samr_Connect2: %d\n", __LINE__));
+	DEBUG(5,("%s: %d\n", fn, __LINE__));
 
 	return nt_status;
 }
@@ -3358,48 +3405,13 @@ NTSTATUS _samr_Connect2(pipes_struct *p,
 NTSTATUS _samr_Connect4(pipes_struct *p,
 			struct samr_Connect4 *r)
 {
-	struct samr_info *info = NULL;
-	SEC_DESC *psd = NULL;
-	uint32    acc_granted;
-	uint32    des_access = r->in.access_mask;
-	NTSTATUS  nt_status;
-	size_t    sd_size;
-
-
-	DEBUG(5,("_samr_Connect4: %d\n", __LINE__));
-
-	/* Access check */
-
-	if (!pipe_access_check(p)) {
-		DEBUG(3, ("access denied to samr_Connect4\n"));
-		return NT_STATUS_ACCESS_DENIED;
-	}
-
-	map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
-
-	make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
-	se_map_generic(&des_access, &sam_generic_mapping);
-
-	nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
-		NULL, 0, des_access, &acc_granted, "_samr_Connect4");
+	struct samr_Connect2 c;
 
-	if ( !NT_STATUS_IS_OK(nt_status) )
-		return nt_status;
-
-	/* associate the user's SID and access granted with the new handle. */
-	if ((info = get_samr_info_by_sid(NULL)) == NULL)
-		return NT_STATUS_NO_MEMORY;
-
-	info->acc_granted = acc_granted;
-	info->status = r->in.access_mask; /* ??? */
-
-	/* get a (unique) handle.  open a policy on it. */
-	if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
-		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+	c.in.system_name	= r->in.system_name;
+	c.in.access_mask	= r->in.access_mask;
+	c.out.connect_handle	= r->out.connect_handle;
 
-	DEBUG(5,("_samr_Connect4: %d\n", __LINE__));
-
-	return NT_STATUS_OK;
+	return _samr_Connect2(p, &c);
 }
 
 /*******************************************************************
@@ -3409,50 +3421,22 @@ NTSTATUS _samr_Connect4(pipes_struct *p,
 NTSTATUS _samr_Connect5(pipes_struct *p,
 			struct samr_Connect5 *r)
 {
-	struct samr_info *info = NULL;
-	SEC_DESC *psd = NULL;
-	uint32    acc_granted;
-	uint32    des_access = r->in.access_mask;
-	NTSTATUS  nt_status;
-	size_t    sd_size;
+	NTSTATUS status;
+	struct samr_Connect2 c;
 	struct samr_ConnectInfo1 info1;
 
-	DEBUG(5,("_samr_Connect5: %d\n", __LINE__));
+	info1.client_version = SAMR_CONNECT_AFTER_W2K;
+	info1.unknown2 = 0;
 
-	/* Access check */
+	c.in.system_name	= r->in.system_name;
+	c.in.access_mask	= r->in.access_mask;
+	c.out.connect_handle	= r->out.connect_handle;
 
-	if (!pipe_access_check(p)) {
-		DEBUG(3, ("access denied to samr_Connect5\n"));
-		return NT_STATUS_ACCESS_DENIED;
+	status = _samr_Connect2(p, &c);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
 	}
 
-	map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
-
-	make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
-	se_map_generic(&des_access, &sam_generic_mapping);
-
-	nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
-		NULL, 0, des_access, &acc_granted, "_samr_Connect5");
-
-	if ( !NT_STATUS_IS_OK(nt_status) )
-		return nt_status;
-
-	/* associate the user's SID and access granted with the new handle. */
-	if ((info = get_samr_info_by_sid(NULL)) == NULL)
-		return NT_STATUS_NO_MEMORY;
-
-	info->acc_granted = acc_granted;
-	info->status = r->in.access_mask; /* ??? */
-
-	/* get a (unique) handle.  open a policy on it. */
-	if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
-		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-
-	DEBUG(5,("_samr_Connect5: %d\n", __LINE__));
-
-	info1.client_version = SAMR_CONNECT_AFTER_W2K;
-	info1.unknown2 = 0;
-
 	*r->out.level_out = 1;
 	r->out.info_out->info1 = info1;
 
@@ -3485,6 +3469,9 @@ NTSTATUS _samr_LookupDomain(pipes_struct *p,
 	}
 
 	domain_name = r->in.domain_name->string;
+	if (!domain_name) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
 
 	sid = TALLOC_ZERO_P(p->mem_ctx, struct dom_sid2);
 	if (!sid) {
@@ -3595,7 +3582,7 @@ NTSTATUS _samr_OpenAlias(pipes_struct *p,
 
 	/*check if access can be granted as requested by client. */
 
-	map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+	map_max_allowed_access(p->server_info->ptok, &des_access);
 
 	make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
 	se_map_generic(&des_access,&ali_generic_mapping);
@@ -3603,7 +3590,7 @@ NTSTATUS _samr_OpenAlias(pipes_struct *p,
 	se_priv_copy( &se_rights, &se_add_users );
 
 
-	status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+	status = access_check_samr_object(psd, p->server_info->ptok,
 		&se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
 		&acc_granted, "_samr_OpenAlias");
 
@@ -3657,13 +3644,11 @@ static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
 
 	if (id7 == NULL) {
 		DEBUG(5, ("set_user_info_7: NULL id7\n"));
-		TALLOC_FREE(pwd);
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
 	if (!id7->account_name.string) {
 	        DEBUG(5, ("set_user_info_7: failed to get new username\n"));
-		TALLOC_FREE(pwd);
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -3683,7 +3668,6 @@ static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
 
 	rc = pdb_rename_sam_account(pwd, id7->account_name.string);
 
-	TALLOC_FREE(pwd);
 	return rc;
 }
 
@@ -3696,23 +3680,18 @@ static bool set_user_info_16(struct samr_UserInfo16 *id16,
 {
 	if (id16 == NULL) {
 		DEBUG(5, ("set_user_info_16: NULL id16\n"));
-		TALLOC_FREE(pwd);
 		return False;
 	}
 
 	/* FIX ME: check if the value is really changed --metze */
 	if (!pdb_set_acct_ctrl(pwd, id16->acct_flags, PDB_CHANGED)) {
-		TALLOC_FREE(pwd);
 		return False;
 	}
 
 	if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
-		TALLOC_FREE(pwd);
 		return False;
 	}
 
-	TALLOC_FREE(pwd);
-
 	return True;
 }
 
@@ -3725,29 +3704,23 @@ static bool set_user_info_18(struct samr_UserInfo18 *id18,
 {
 	if (id18 == NULL) {
 		DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
-		TALLOC_FREE(pwd);
 		return False;
 	}
 
 	if (!pdb_set_lanman_passwd (pwd, id18->lm_pwd.hash, PDB_CHANGED)) {
-		TALLOC_FREE(pwd);
 		return False;
 	}
 	if (!pdb_set_nt_passwd     (pwd, id18->nt_pwd.hash, PDB_CHANGED)) {
-		TALLOC_FREE(pwd);
 		return False;
 	}
  	if (!pdb_set_pass_last_set_time (pwd, time(NULL), PDB_CHANGED)) {
-		TALLOC_FREE(pwd);
 		return False;
 	}
 
 	if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
-		TALLOC_FREE(pwd);
 		return False;
  	}
 
-	TALLOC_FREE(pwd);
 	return True;
 }
 
@@ -3767,12 +3740,9 @@ static bool set_user_info_20(struct samr_UserInfo20 *id20,
 
 	/* write the change out */
 	if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
-		TALLOC_FREE(pwd);
 		return False;
  	}
 
-	TALLOC_FREE(pwd);
-
 	return True;
 }
 
@@ -3791,6 +3761,14 @@ static NTSTATUS set_user_info_21(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
+	if (id21->fields_present == 0) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (id21->fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+
 	/* we need to separately check for an account rename first */
 
 	if (id21->account_name.string &&
@@ -3816,7 +3794,6 @@ static NTSTATUS set_user_info_21(TALLOC_CTX *mem_ctx,
 		if (!NT_STATUS_IS_OK(status)) {
 			DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
 				nt_errstr(status)));
-			TALLOC_FREE(pwd);
 			return status;
 		}
 
@@ -3847,12 +3824,9 @@ static NTSTATUS set_user_info_21(TALLOC_CTX *mem_ctx,
 
 	/* write the change out */
 	if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
-		TALLOC_FREE(pwd);
 		return status;
  	}
 
-	TALLOC_FREE(pwd);
-
 	return NT_STATUS_OK;
 }
 
@@ -3866,7 +3840,7 @@ static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
 {
 	char *plaintext_buf = NULL;
 	uint32 len = 0;
-	uint16 acct_ctrl;
+	uint32_t acct_ctrl;
 	NTSTATUS status;
 
 	if (id23 == NULL) {
@@ -3874,39 +3848,48 @@ static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
-	DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
-		  pdb_get_username(pwd)));
-
-	acct_ctrl = pdb_get_acct_ctrl(pwd);
-
-	if (!decode_pw_buffer(mem_ctx,
-				id23->password.data,
-				&plaintext_buf,
-				&len,
-				STR_UNICODE)) {
-		TALLOC_FREE(pwd);
+	if (id23->info.fields_present == 0) {
 		return NT_STATUS_INVALID_PARAMETER;
- 	}
+	}
 
-	if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
-		TALLOC_FREE(pwd);
+	if (id23->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
+	if ((id23->info.fields_present & SAMR_FIELD_PASSWORD) ||
+	    (id23->info.fields_present & SAMR_FIELD_PASSWORD2)) {
+
+		DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
+			  pdb_get_username(pwd)));
+
+		if (!decode_pw_buffer(mem_ctx,
+				      id23->password.data,
+				      &plaintext_buf,
+				      &len,
+				      STR_UNICODE)) {
+			return NT_STATUS_WRONG_PASSWORD;
+		}
+
+		if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
+			return NT_STATUS_ACCESS_DENIED;
+		}
+	}
+
 	copy_id23_to_sam_passwd(pwd, id23);
 
+	acct_ctrl = pdb_get_acct_ctrl(pwd);
+
 	/* if it's a trust account, don't update /etc/passwd */
 	if (    ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
 		( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
 		( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
 		DEBUG(5, ("Changing trust account.  Not updating /etc/passwd\n"));
-	} else  {
+	} else if (plaintext_buf) {
 		/* update the UNIX password */
 		if (lp_unix_password_sync() ) {
 			struct passwd *passwd;
 			if (pdb_get_username(pwd) == NULL) {
 				DEBUG(1, ("chgpasswd: User without name???\n"));
-				TALLOC_FREE(pwd);
 				return NT_STATUS_ACCESS_DENIED;
 			}
 
@@ -3916,29 +3899,26 @@ static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
 			}
 
 			if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
-				TALLOC_FREE(pwd);
 				return NT_STATUS_ACCESS_DENIED;
 			}
 			TALLOC_FREE(passwd);
 		}
 	}
 
-	memset(plaintext_buf, '\0', strlen(plaintext_buf));
+	if (plaintext_buf) {
+		memset(plaintext_buf, '\0', strlen(plaintext_buf));
+	}
 
 	if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
 	    (!NT_STATUS_IS_OK(status =  pdb_set_unix_primary_group(mem_ctx,
 								   pwd)))) {
-		TALLOC_FREE(pwd);
 		return status;
 	}
 
 	if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
-		TALLOC_FREE(pwd);
 		return status;
 	}
 
-	TALLOC_FREE(pwd);
-
 	return NT_STATUS_OK;
 }
 
@@ -3969,12 +3949,10 @@ static bool set_user_info_pw(uint8 *pass, struct samu *pwd,
 				&plaintext_buf,
 				&len,
 				STR_UNICODE)) {
-		TALLOC_FREE(pwd);
 		return False;
  	}
 
 	if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
-		TALLOC_FREE(pwd);
 		return False;
 	}
 
@@ -3990,7 +3968,6 @@ static bool set_user_info_pw(uint8 *pass, struct samu *pwd,
 
 			if (pdb_get_username(pwd) == NULL) {
 				DEBUG(1, ("chgpasswd: User without name???\n"));
-				TALLOC_FREE(pwd);
 				return False;
 			}
 
@@ -4000,7 +3977,6 @@ static bool set_user_info_pw(uint8 *pass, struct samu *pwd,
 			}
 
 			if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
-				TALLOC_FREE(pwd);
 				return False;
 			}
 			TALLOC_FREE(passwd);
@@ -4028,12 +4004,9 @@ static bool set_user_info_pw(uint8 *pass, struct samu *pwd,
 
 	/* update the SAMBA password */
 	if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
-		TALLOC_FREE(pwd);
 		return False;
  	}
 
-	TALLOC_FREE(pwd);
-
 	return True;
 }
 
@@ -4052,11 +4025,18 @@ static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
+	if (id25->info.fields_present == 0) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (id25->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+
 	copy_id25_to_sam_passwd(pwd, id25);
 
 	/* write the change out */
 	if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
-		TALLOC_FREE(pwd);
 		return status;
  	}
 
@@ -4075,9 +4055,6 @@ static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
 		}
 	}
 
-	/* WARNING: No TALLOC_FREE(pwd), we are about to set the password
-	 * hereafter! */
-
 	return NT_STATUS_OK;
 }
 
@@ -4162,20 +4139,20 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
 
 	acb_info = pdb_get_acct_ctrl(pwd);
 	if (acb_info & ACB_WSTRUST)
-		has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
+		has_enough_rights = user_has_privileges(p->server_info->ptok,
 							&se_machine_account);
 	else if (acb_info & ACB_NORMAL)
-		has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
+		has_enough_rights = user_has_privileges(p->server_info->ptok,
 							&se_add_users);
 	else if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
 		if (lp_enable_privileges()) {
-			has_enough_rights = nt_token_check_domain_rid(p->pipe_user.nt_user_token,
+			has_enough_rights = nt_token_check_domain_rid(p->server_info->ptok,
 								      DOMAIN_GROUP_RID_ADMINS);
 		}
 	}
 
 	DEBUG(5, ("_samr_SetUserInfo: %s does%s possess sufficient rights\n",
-		  uidtoname(p->pipe_user.ut.uid),
+		  uidtoname(p->server_info->utok.uid),
 		  has_enough_rights ? "" : " not"));
 
 	/* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
@@ -4242,7 +4219,7 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
 
 			if (!set_user_info_pw(info->info24.password.data, pwd,
 					      switch_value)) {
-				status = NT_STATUS_ACCESS_DENIED;
+				status = NT_STATUS_WRONG_PASSWORD;
 			}
 			break;
 
@@ -4263,7 +4240,7 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
 			}
 			if (!set_user_info_pw(info->info25.password.data, pwd,
 					      switch_value)) {
-				status = NT_STATUS_ACCESS_DENIED;
+				status = NT_STATUS_WRONG_PASSWORD;
 			}
 			break;
 
@@ -4279,7 +4256,7 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
 
 			if (!set_user_info_pw(info->info26.password.data, pwd,
 					      switch_value)) {
-				status = NT_STATUS_ACCESS_DENIED;
+				status = NT_STATUS_WRONG_PASSWORD;
 			}
 			break;
 
@@ -4289,6 +4266,8 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
 
  done:
 
+	TALLOC_FREE(pwd);
+
 	if (has_enough_rights) {
 		unbecome_root();
 	}
@@ -4553,7 +4532,7 @@ NTSTATUS _samr_AddAliasMember(pipes_struct *p,
 	DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
 
 	se_priv_copy( &se_rights, &se_add_users );
-	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+	can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
 
 	/******** BEGIN SeAddUsers BLOCK *********/
 
@@ -4603,7 +4582,7 @@ NTSTATUS _samr_DeleteAliasMember(pipes_struct *p,
 		   sid_string_dbg(&alias_sid)));
 
 	se_priv_copy( &se_rights, &se_add_users );
-	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+	can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
 
 	/******** BEGIN SeAddUsers BLOCK *********/
 
@@ -4658,7 +4637,7 @@ NTSTATUS _samr_AddGroupMember(pipes_struct *p,
 	}
 
 	se_priv_copy( &se_rights, &se_add_users );
-	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+	can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
 
 	/******** BEGIN SeAddUsers BLOCK *********/
 
@@ -4716,7 +4695,7 @@ NTSTATUS _samr_DeleteGroupMember(pipes_struct *p,
 	}
 
 	se_priv_copy( &se_rights, &se_add_users );
-	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+	can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
 
 	/******** BEGIN SeAddUsers BLOCK *********/
 
@@ -4787,9 +4766,9 @@ NTSTATUS _samr_DeleteUser(pipes_struct *p,
 
 	/* For machine accounts it's the SeMachineAccountPrivilege that counts. */
 	if ( acb_info & ACB_WSTRUST ) {
-		can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account );
+		can_add_accounts = user_has_privileges( p->server_info->ptok, &se_machine_account );
 	} else {
-		can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
+		can_add_accounts = user_has_privileges( p->server_info->ptok, &se_add_users );
 	}
 
 	/******** BEGIN SeAddUsers BLOCK *********/
@@ -4861,7 +4840,7 @@ NTSTATUS _samr_DeleteDomainGroup(pipes_struct *p,
 	}
 
 	se_priv_copy( &se_rights, &se_add_users );
-	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+	can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
 
 	/******** BEGIN SeAddUsers BLOCK *********/
 
@@ -4936,7 +4915,7 @@ NTSTATUS _samr_DeleteDomAlias(pipes_struct *p,
 	DEBUG(10, ("lookup on Local SID\n"));
 
 	se_priv_copy( &se_rights, &se_add_users );
-	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+	can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
 
 	/******** BEGIN SeAddUsers BLOCK *********/
 
@@ -5005,7 +4984,7 @@ NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
 	}
 
 	se_priv_copy( &se_rights, &se_add_users );
-	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+	can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
 
 	/******** BEGIN SeAddUsers BLOCK *********/
 
@@ -5079,7 +5058,7 @@ NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
 	name = r->in.alias_name->string;
 
 	se_priv_copy( &se_rights, &se_add_users );
-	can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+	can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
 
 	result = can_create(p->mem_ctx, name);
 	if (!NT_STATUS_IS_OK(result)) {
@@ -5291,7 +5270,7 @@ NTSTATUS _samr_SetGroupInfo(pipes_struct *p,
 			return NT_STATUS_INVALID_INFO_CLASS;
 	}
 
-	can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
+	can_mod_accounts = user_has_privileges( p->server_info->ptok, &se_add_users );
 
 	/******** BEGIN SeAddUsers BLOCK *********/
 
@@ -5393,7 +5372,7 @@ NTSTATUS _samr_SetAliasInfo(pipes_struct *p,
 			return NT_STATUS_INVALID_INFO_CLASS;
 	}
 
-        can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
+        can_mod_accounts = user_has_privileges( p->server_info->ptok, &se_add_users );
 
         /******** BEGIN SeAddUsers BLOCK *********/
 
@@ -5481,14 +5460,14 @@ NTSTATUS _samr_OpenGroup(pipes_struct *p,
 		return status;
 
 	/*check if access can be granted as requested by client. */
-	map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+	map_max_allowed_access(p->server_info->ptok, &des_access);
 
 	make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
 	se_map_generic(&des_access,&grp_generic_mapping);
 
 	se_priv_copy( &se_rights, &se_add_users );
 
-	status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+	status = access_check_samr_object(psd, p->server_info->ptok,
 		&se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
 		&acc_granted, "_samr_OpenGroup");
 
@@ -5842,16 +5821,6 @@ NTSTATUS _samr_Shutdown(pipes_struct *p,
 /****************************************************************
 ****************************************************************/
 
-NTSTATUS _samr_CreateUser(pipes_struct *p,
-			  struct samr_CreateUser *r)
-{
-	p->rng_fault_state = true;
-	return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-/****************************************************************
-****************************************************************/
-
 NTSTATUS _samr_SetMemberAttributesOfGroup(pipes_struct *p,
 					  struct samr_SetMemberAttributesOfGroup *r)
 {
@@ -5892,16 +5861,6 @@ NTSTATUS _samr_TestPrivateFunctionsUser(pipes_struct *p,
 /****************************************************************
 ****************************************************************/
 
-NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
-			      struct samr_QueryUserInfo2 *r)
-{
-	p->rng_fault_state = true;
-	return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-/****************************************************************
-****************************************************************/
-
 NTSTATUS _samr_AddMultipleMembersToAlias(pipes_struct *p,
 					 struct samr_AddMultipleMembersToAlias *r)
 {
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 577f7f1ded..744de67db4 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -388,7 +388,8 @@ static WERROR delete_printer_handle(pipes_struct *p, POLICY_HND *hnd)
 		return WERR_BADFID;
 	}
 
-	return delete_printer_hook(p->mem_ctx, p->pipe_user.nt_user_token, Printer->sharename );
+	return delete_printer_hook(p->mem_ctx, p->server_info->ptok,
+				   Printer->sharename );
 }
 
 /****************************************************************************
@@ -1656,13 +1657,13 @@ WERROR _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u,
 			/* if the user is not root, doesn't have SE_PRINT_OPERATOR privilege,
 			   and not a printer admin, then fail */
 
-			if ((p->pipe_user.ut.uid != 0) &&
-			    !user_has_privileges(p->pipe_user.nt_user_token,
+			if ((p->server_info->utok.uid != 0) &&
+			    !user_has_privileges(p->server_info->ptok,
 						 &se_printop ) &&
 			    !token_contains_name_in_list(
-				    uidtoname(p->pipe_user.ut.uid),
+				    uidtoname(p->server_info->utok.uid),
 				    NULL, NULL,
-				    p->pipe_user.nt_user_token,
+				    p->server_info->ptok,
 				    lp_printer_admin(snum))) {
 				close_printer_handle(p, handle);
 				return WERR_ACCESS_DENIED;
@@ -1715,8 +1716,8 @@ WERROR _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u,
 			return WERR_ACCESS_DENIED;
 		}
 
-		if (!user_ok_token(uidtoname(p->pipe_user.ut.uid), NULL,
-				   p->pipe_user.nt_user_token, snum) ||
+		if (!user_ok_token(uidtoname(p->server_info->utok.uid), NULL,
+				   p->server_info->ptok, snum) ||
 		    !print_access_check(p->server_info, snum,
 					printer_default->access_required)) {
 			DEBUG(3, ("access DENIED for printer open\n"));
@@ -2018,11 +2019,11 @@ WERROR _spoolss_deleteprinterdriver(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIVER
 	/* if the user is not root, doesn't have SE_PRINT_OPERATOR privilege,
 	   and not a printer admin, then fail */
 
-	if ( (p->pipe_user.ut.uid != 0)
-		&& !user_has_privileges(p->pipe_user.nt_user_token, &se_printop )
+	if ( (p->server_info->utok.uid != 0)
+		&& !user_has_privileges(p->server_info->ptok, &se_printop )
 		&& !token_contains_name_in_list(
-			uidtoname(p->pipe_user.ut.uid), NULL,
-			NULL, p->pipe_user.nt_user_token,
+			uidtoname(p->server_info->utok.uid), NULL,
+			NULL, p->server_info->ptok,
 			lp_printer_admin(-1)) )
 	{
 		return WERR_ACCESS_DENIED;
@@ -2070,7 +2071,8 @@ WERROR _spoolss_deleteprinterdriver(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIVER
 			/* if we get to here, we now have 2 driver info structures to remove */
 			/* remove the Win2k driver first*/
 
-			status_win2k = delete_printer_driver(info_win2k.info_3, &p->pipe_user, 3, False );
+			status_win2k = delete_printer_driver(
+				p, info_win2k.info_3, 3, False );
 			free_a_printer_driver( info_win2k, 3 );
 
 			/* this should not have failed---if it did, report to client */
@@ -2082,7 +2084,7 @@ WERROR _spoolss_deleteprinterdriver(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIVER
 		}
 	}
 
-	status = delete_printer_driver(info.info_3, &p->pipe_user, version, False);
+	status = delete_printer_driver(p, info.info_3, version, False);
 
 	/* if at least one of the deletes succeeded return OK */
 
@@ -2115,11 +2117,11 @@ WERROR _spoolss_deleteprinterdriverex(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIV
 	/* if the user is not root, doesn't have SE_PRINT_OPERATOR privilege,
 	   and not a printer admin, then fail */
 
-	if ( (p->pipe_user.ut.uid != 0)
-		&& !user_has_privileges(p->pipe_user.nt_user_token, &se_printop )
+	if ( (p->server_info->utok.uid != 0)
+		&& !user_has_privileges(p->server_info->ptok, &se_printop )
 		&& !token_contains_name_in_list(
-			uidtoname(p->pipe_user.ut.uid), NULL, NULL,
-			p->pipe_user.nt_user_token, lp_printer_admin(-1)) )
+			uidtoname(p->server_info->utok.uid), NULL, NULL,
+			p->server_info->ptok, lp_printer_admin(-1)) )
 	{
 		return WERR_ACCESS_DENIED;
 	}
@@ -2205,7 +2207,8 @@ WERROR _spoolss_deleteprinterdriverex(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIV
 			/* if we get to here, we now have 2 driver info structures to remove */
 			/* remove the Win2k driver first*/
 
-			status_win2k = delete_printer_driver(info_win2k.info_3, &p->pipe_user, 3, delete_files);
+			status_win2k = delete_printer_driver(
+				p, info_win2k.info_3, 3, delete_files);
 			free_a_printer_driver( info_win2k, 3 );
 
 			/* this should not have failed---if it did, report to client */
@@ -2215,7 +2218,7 @@ WERROR _spoolss_deleteprinterdriverex(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIV
 		}
 	}
 
-	status = delete_printer_driver(info.info_3, &p->pipe_user, version, delete_files);
+	status = delete_printer_driver(p, info.info_3, version, delete_files);
 
 	if ( W_ERROR_IS_OK(status) || W_ERROR_IS_OK(status_win2k) )
 		status = WERR_OK;
@@ -6388,7 +6391,8 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level,
 	{
 		/* add_printer_hook() will call reload_services() */
 
-		if ( !add_printer_hook(p->mem_ctx, p->pipe_user.nt_user_token, printer) ) {
+		if ( !add_printer_hook(p->mem_ctx, p->server_info->ptok,
+				       printer) ) {
 			result = WERR_ACCESS_DENIED;
 			goto done;
 		}
@@ -7482,11 +7486,11 @@ WERROR enumports_hook(TALLOC_CTX *ctx, int *count, char ***lines )
 	/* if no hook then just fill in the default port */
 
 	if ( !*cmd ) {
-		if (!(qlines = SMB_MALLOC_ARRAY( char*, 2 ))) {
+		if (!(qlines = TALLOC_ARRAY( NULL, char*, 2 ))) {
 			return WERR_NOMEM;
 		}
-		if (!(qlines[0] = SMB_STRDUP( SAMBA_PRINTER_PORT_NAME ))) {
-			SAFE_FREE(qlines);
+		if (!(qlines[0] = talloc_strdup(qlines, SAMBA_PRINTER_PORT_NAME ))) {
+			TALLOC_FREE(qlines);
 			return WERR_NOMEM;
 		}
 		qlines[1] = NULL;
@@ -7728,7 +7732,8 @@ static WERROR spoolss_addprinterex_level_2( pipes_struct *p, const UNISTR2 *uni_
 	   trying to add a printer like this  --jerry */
 
 	if (*lp_addprinter_cmd() ) {
-		if ( !add_printer_hook(p->mem_ctx, p->pipe_user.nt_user_token, printer) ) {
+		if ( !add_printer_hook(p->mem_ctx, p->server_info->ptok,
+				       printer) ) {
 			free_a_printer(&printer,2);
 			return WERR_ACCESS_DENIED;
 		}
@@ -7855,12 +7860,13 @@ WERROR _spoolss_addprinterdriver(pipes_struct *p, SPOOL_Q_ADDPRINTERDRIVER *q_u,
 	}
 
 	DEBUG(5,("Cleaning driver's information\n"));
-	err = clean_up_driver_struct(driver, level, &p->pipe_user);
+	err = clean_up_driver_struct(p, driver, level);
 	if (!W_ERROR_IS_OK(err))
 		goto done;
 
 	DEBUG(5,("Moving driver to final destination\n"));
-	if( !W_ERROR_IS_OK(err = move_driver_to_download_area(driver, level, &p->pipe_user, &err)) ) {
+	if( !W_ERROR_IS_OK(err = move_driver_to_download_area(p, driver, level,
+							      &err)) ) {
 		goto done;
 	}
 
@@ -9935,10 +9941,10 @@ WERROR _spoolss_xcvdataport(pipes_struct *p, SPOOL_Q_XCVDATAPORT *q_u, SPOOL_R_X
 
 	switch ( Printer->printer_type ) {
 	case SPLHND_PORTMON_TCP:
-		return process_xcvtcp_command( p->pipe_user.nt_user_token, command,
+		return process_xcvtcp_command( p->server_info->ptok, command,
 			&q_u->indata, &r_u->outdata, &r_u->needed );
 	case SPLHND_PORTMON_LOCAL:
-		return process_xcvlocal_command( p->pipe_user.nt_user_token, command,
+		return process_xcvlocal_command( p->server_info->ptok, command,
 			&q_u->indata, &r_u->outdata, &r_u->needed );
 	}
 
diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c
index 9d9e9af59b..bf3669022d 100644
--- a/source3/rpc_server/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srv_srvsvc_nt.c
@@ -262,7 +262,7 @@ static void init_srv_share_info_1(pipes_struct *p, struct srvsvc_NetShareInfo1 *
 		remark = talloc_sub_advanced(
 			p->mem_ctx, lp_servicename(snum),
 			get_current_username(), lp_pathname(snum),
-			p->pipe_user.ut.uid, get_current_username(),
+			p->server_info->utok.uid, get_current_username(),
 			"", remark);
 	}
 
@@ -289,7 +289,7 @@ static void init_srv_share_info_2(pipes_struct *p, struct srvsvc_NetShareInfo2 *
 		remark = talloc_sub_advanced(
 			p->mem_ctx, lp_servicename(snum),
 			get_current_username(), lp_pathname(snum),
-			p->pipe_user.ut.uid, get_current_username(),
+			p->server_info->utok.uid, get_current_username(),
 			"", remark);
 	}
 	path = talloc_asprintf(p->mem_ctx,
@@ -355,7 +355,7 @@ static void init_srv_share_info_501(pipes_struct *p, struct srvsvc_NetShareInfo5
 		remark = talloc_sub_advanced(
 			p->mem_ctx, lp_servicename(snum),
 			get_current_username(), lp_pathname(snum),
-			p->pipe_user.ut.uid, get_current_username(),
+			p->server_info->utok.uid, get_current_username(),
 			"", remark);
 	}
 
@@ -383,7 +383,7 @@ static void init_srv_share_info_502(pipes_struct *p, struct srvsvc_NetShareInfo5
 		remark = talloc_sub_advanced(
 			p->mem_ctx, lp_servicename(snum),
 			get_current_username(), lp_pathname(snum),
-			p->pipe_user.ut.uid, get_current_username(),
+			p->server_info->utok.uid, get_current_username(),
 			"", remark);
 	}
 	path = talloc_asprintf(ctx, "C:%s", lp_pathname(snum));
@@ -422,7 +422,7 @@ static void init_srv_share_info_1004(pipes_struct *p, struct srvsvc_NetShareInfo
 		remark = talloc_sub_advanced(
 			p->mem_ctx, lp_servicename(snum),
 			get_current_username(), lp_pathname(snum),
-			p->pipe_user.ut.uid, get_current_username(),
+			p->server_info->utok.uid, get_current_username(),
 			"", remark);
 	}
 
@@ -1225,7 +1225,6 @@ WERROR _srvsvc_NetSessDel(pipes_struct *p,
 			  struct srvsvc_NetSessDel *r)
 {
 	struct sessionid *session_list;
-	struct current_user user;
 	int num_sessions, snum;
 	const char *username;
 	const char *machine;
@@ -1246,12 +1245,11 @@ WERROR _srvsvc_NetSessDel(pipes_struct *p,
 
 	werr = WERR_ACCESS_DENIED;
 
-	get_current_user(&user, p);
-
 	/* fail out now if you are not root or not a domain admin */
 
-	if ((user.ut.uid != sec_initial_uid()) &&
-		( ! nt_token_check_domain_rid(p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS))) {
+	if ((p->server_info->utok.uid != sec_initial_uid()) &&
+		( ! nt_token_check_domain_rid(p->server_info->ptok,
+					      DOMAIN_GROUP_RID_ADMINS))) {
 
 		goto done;
 	}
@@ -1263,7 +1261,7 @@ WERROR _srvsvc_NetSessDel(pipes_struct *p,
 
 			NTSTATUS ntstat;
 
-			if (user.ut.uid != sec_initial_uid()) {
+			if (p->server_info->utok.uid != sec_initial_uid()) {
 				not_root = True;
 				become_root();
 			}
@@ -1466,7 +1464,6 @@ char *valid_share_pathname(TALLOC_CTX *ctx, const char *dos_pathname)
 WERROR _srvsvc_NetShareSetInfo(pipes_struct *p,
 			       struct srvsvc_NetShareSetInfo *r)
 {
-	struct current_user user;
 	char *command = NULL;
 	char *share_name = NULL;
 	char *comment = NULL;
@@ -1510,13 +1507,11 @@ WERROR _srvsvc_NetShareSetInfo(pipes_struct *p,
 	if (lp_print_ok(snum))
 		return WERR_ACCESS_DENIED;
 
-	get_current_user(&user,p);
-
-	is_disk_op = user_has_privileges( p->pipe_user.nt_user_token, &se_diskop );
+	is_disk_op = user_has_privileges( p->server_info->ptok, &se_diskop );
 
 	/* fail out now if you are not root and not a disk op */
 
-	if ( user.ut.uid != sec_initial_uid() && !is_disk_op )
+	if ( p->server_info->utok.uid != sec_initial_uid() && !is_disk_op )
 		return WERR_ACCESS_DENIED;
 
 	switch (r->in.level) {
@@ -1683,7 +1678,6 @@ WERROR _srvsvc_NetShareSetInfo(pipes_struct *p,
 WERROR _srvsvc_NetShareAdd(pipes_struct *p,
 			   struct srvsvc_NetShareAdd *r)
 {
-	struct current_user user;
 	char *command = NULL;
 	char *share_name = NULL;
 	char *comment = NULL;
@@ -1704,11 +1698,9 @@ WERROR _srvsvc_NetShareAdd(pipes_struct *p,
 		*r->out.parm_error = 0;
 	}
 
-	get_current_user(&user,p);
+	is_disk_op = user_has_privileges( p->server_info->ptok, &se_diskop );
 
-	is_disk_op = user_has_privileges( p->pipe_user.nt_user_token, &se_diskop );
-
-	if (user.ut.uid != sec_initial_uid()  && !is_disk_op )
+	if (p->server_info->utok.uid != sec_initial_uid()  && !is_disk_op )
 		return WERR_ACCESS_DENIED;
 
 	if (!lp_add_share_cmd() || !*lp_add_share_cmd()) {
@@ -1868,7 +1860,6 @@ WERROR _srvsvc_NetShareAdd(pipes_struct *p,
 WERROR _srvsvc_NetShareDel(pipes_struct *p,
 			   struct srvsvc_NetShareDel *r)
 {
-	struct current_user user;
 	char *command = NULL;
 	char *share_name = NULL;
 	int ret;
@@ -1901,11 +1892,9 @@ WERROR _srvsvc_NetShareDel(pipes_struct *p,
 	if (lp_print_ok(snum))
 		return WERR_ACCESS_DENIED;
 
-	get_current_user(&user,p);
-
-	is_disk_op = user_has_privileges( p->pipe_user.nt_user_token, &se_diskop );
+	is_disk_op = user_has_privileges( p->server_info->ptok, &se_diskop );
 
-	if (user.ut.uid != sec_initial_uid()  && !is_disk_op )
+	if (p->server_info->utok.uid != sec_initial_uid()  && !is_disk_op )
 		return WERR_ACCESS_DENIED;
 
 	if (!lp_delete_share_cmd() || !*lp_delete_share_cmd()) {
@@ -2050,7 +2039,8 @@ WERROR _srvsvc_NetGetFileSecurity(pipes_struct *p,
 	}
 
 	nt_status = create_conn_struct(talloc_tos(), &conn, snum,
-				       lp_pathname(snum), &oldcwd);
+				       lp_pathname(snum), p->server_info,
+				       &oldcwd);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		DEBUG(10, ("create_conn_struct failed: %s\n",
 			   nt_errstr(nt_status)));
@@ -2058,8 +2048,6 @@ WERROR _srvsvc_NetGetFileSecurity(pipes_struct *p,
 		goto error_exit;
 	}
 
-	conn->server_info = p->server_info;
-
 	nt_status = create_file(
 		conn,					/* conn */
 		NULL,					/* req */
@@ -2165,7 +2153,8 @@ WERROR _srvsvc_NetSetFileSecurity(pipes_struct *p,
 	}
 
 	nt_status = create_conn_struct(talloc_tos(), &conn, snum,
-				       lp_pathname(snum), &oldcwd);
+				       lp_pathname(snum), p->server_info,
+				       &oldcwd);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		DEBUG(10, ("create_conn_struct failed: %s\n",
 			   nt_errstr(nt_status)));
@@ -2173,8 +2162,6 @@ WERROR _srvsvc_NetSetFileSecurity(pipes_struct *p,
 		goto error_exit;
 	}
 
-	conn->server_info = p->server_info;
-
 	nt_status = create_file(
 		conn,					/* conn */
 		NULL,					/* req */
@@ -2411,17 +2398,14 @@ static void enum_file_close_fn( const struct share_mode_entry *e,
 
 WERROR _srvsvc_NetFileClose(pipes_struct *p, struct srvsvc_NetFileClose *r)
 {
-	struct current_user user;
 	SE_PRIV se_diskop = SE_DISK_OPERATOR;
 	bool is_disk_op;
 
 	DEBUG(5,("_srvsvc_NetFileClose: %d\n", __LINE__));
 
-	get_current_user(&user,p);
-
-	is_disk_op = user_has_privileges( p->pipe_user.nt_user_token, &se_diskop );
+	is_disk_op = user_has_privileges( p->server_info->ptok, &se_diskop );
 
-	if (user.ut.uid != sec_initial_uid() && !is_disk_op) {
+	if (p->server_info->utok.uid != sec_initial_uid() && !is_disk_op) {
 		return WERR_ACCESS_DENIED;
 	}
 
diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c
index cb6657400f..6692160ba2 100644
--- a/source3/rpc_server/srv_svcctl_nt.c
+++ b/source3/rpc_server/srv_svcctl_nt.c
@@ -272,7 +272,8 @@ WERROR _svcctl_OpenSCManagerW(pipes_struct *p,
 		return WERR_NOMEM;
 
 	se_map_generic( &r->in.access_mask, &scm_generic_map );
-	status = svcctl_access_check( sec_desc, p->pipe_user.nt_user_token, r->in.access_mask, &access_granted );
+	status = svcctl_access_check( sec_desc, p->server_info->ptok,
+				      r->in.access_mask, &access_granted );
 	if ( !NT_STATUS_IS_OK(status) )
 		return ntstatus_to_werror( status );
 
@@ -309,7 +310,8 @@ WERROR _svcctl_OpenServiceW(pipes_struct *p,
 		return WERR_NOMEM;
 
 	se_map_generic( &r->in.access_mask, &svc_generic_map );
-	status = svcctl_access_check( sec_desc, p->pipe_user.nt_user_token, r->in.access_mask, &access_granted );
+	status = svcctl_access_check( sec_desc, p->server_info->ptok,
+				      r->in.access_mask, &access_granted );
 	if ( !NT_STATUS_IS_OK(status) )
 		return ntstatus_to_werror( status );
 
@@ -347,7 +349,8 @@ WERROR _svcctl_GetServiceDisplayNameW(pipes_struct *p,
 
 	service = r->in.service_name;
 
-	display_name = svcctl_lookup_dispname(p->mem_ctx, service, p->pipe_user.nt_user_token );
+	display_name = svcctl_lookup_dispname(p->mem_ctx, service,
+					      p->server_info->ptok);
 	if (!display_name) {
 		display_name = "";
 	}
@@ -424,7 +427,7 @@ WERROR _svcctl_enum_services_status(pipes_struct *p, SVCCTL_Q_ENUM_SERVICES_STAT
 	size_t buffer_size = 0;
 	WERROR result = WERR_OK;
 	SERVICE_INFO *info = find_service_info_by_hnd( p, &q_u->handle );
-	NT_USER_TOKEN *token = p->pipe_user.nt_user_token;
+	NT_USER_TOKEN *token = p->server_info->ptok;
 
 	/* perform access checks */
 
@@ -517,11 +520,9 @@ WERROR _svcctl_ControlService(pipes_struct *p,
 
 		return info->ops->service_status( info->name,
 						  r->out.service_status );
+	default:
+		return WERR_ACCESS_DENIED;
 	}
-
-	/* default control action */
-
-	return WERR_ACCESS_DENIED;
 }
 
 /********************************************************************
@@ -682,7 +683,8 @@ WERROR _svcctl_QueryServiceConfigW(pipes_struct *p,
 
 	*r->out.bytes_needed = r->in.buf_size;
 
-	wresult = fill_svc_config( p->mem_ctx, info->name, r->out.query, p->pipe_user.nt_user_token );
+	wresult = fill_svc_config( p->mem_ctx, info->name, r->out.query,
+				   p->server_info->ptok);
 	if ( !W_ERROR_IS_OK(wresult) )
 		return wresult;
 
@@ -690,7 +692,7 @@ WERROR _svcctl_QueryServiceConfigW(pipes_struct *p,
 	*r->out.bytes_needed = (buffer_size > r->in.buf_size) ? buffer_size : r->in.buf_size;
 
         if (buffer_size > r->in.buf_size ) {
-		TALLOC_FREE(r->out.query);
+		ZERO_STRUCTP(r->out.query);
                 return WERR_INSUFFICIENT_BUFFER;
 	}
 
@@ -725,7 +727,8 @@ WERROR _svcctl_query_service_config2( pipes_struct *p, SVCCTL_Q_QUERY_SERVICE_CO
 			SERVICE_DESCRIPTION desc_buf;
 			const char *description;
 
-			description = svcctl_lookup_description(p->mem_ctx, info->name, p->pipe_user.nt_user_token );
+			description = svcctl_lookup_description(
+				p->mem_ctx, info->name, p->server_info->ptok);
 
 			ZERO_STRUCTP( &desc_buf );
 
@@ -905,7 +908,8 @@ WERROR _svcctl_SetServiceObjectSecurity(pipes_struct *p,
 
 	/* store the new SD */
 
-	if ( !svcctl_set_secdesc( p->mem_ctx, info->name, sec_desc, p->pipe_user.nt_user_token ) )
+	if ( !svcctl_set_secdesc( p->mem_ctx, info->name, sec_desc,
+				  p->server_info->ptok) )
 		return WERR_ACCESS_DENIED;
 
 	return WERR_OK;
diff --git a/source3/rpc_server/srv_winreg_nt.c b/source3/rpc_server/srv_winreg_nt.c
index 7e842ed54d..1131033b04 100644
--- a/source3/rpc_server/srv_winreg_nt.c
+++ b/source3/rpc_server/srv_winreg_nt.c
@@ -70,7 +70,7 @@ static WERROR open_registry_key( pipes_struct *p, POLICY_HND *hnd,
 
 	if (parent == NULL) {
 		result = reg_openhive(NULL, subkeyname, access_desired,
-				      p->pipe_user.nt_user_token, &key);
+				      p->server_info->ptok, &key);
 	}
 	else {
 		result = reg_openkey(NULL, parent, subkeyname, access_desired,
@@ -556,7 +556,8 @@ WERROR _winreg_InitiateSystemShutdownEx(pipes_struct *p, struct winreg_InitiateS
 		return WERR_NOMEM;
 	}
 
-	can_shutdown = user_has_privileges( p->pipe_user.nt_user_token, &se_remote_shutdown );
+	can_shutdown = user_has_privileges( p->server_info->ptok,
+					    &se_remote_shutdown );
 
 	/* IF someone has privs, run the shutdown script as root. OTHERWISE run it as not root
 	   Take the error return from the script and provide it as the Windows return code. */
@@ -594,7 +595,8 @@ WERROR _winreg_AbortSystemShutdown(pipes_struct *p, struct winreg_AbortSystemShu
 	if (!*abort_shutdown_script)
 		return WERR_ACCESS_DENIED;
 
-	can_shutdown = user_has_privileges( p->pipe_user.nt_user_token, &se_remote_shutdown );
+	can_shutdown = user_has_privileges( p->server_info->ptok,
+					    &se_remote_shutdown );
 
 	/********** BEGIN SeRemoteShutdownPrivilege BLOCK **********/
 
@@ -682,7 +684,7 @@ WERROR _winreg_RestoreKey(pipes_struct *p, struct winreg_RestoreKey *r)
 
 	/* user must posses SeRestorePrivilege for this this proceed */
 
-	if ( !user_has_privileges( p->pipe_user.nt_user_token, &se_restore ) )
+	if ( !user_has_privileges( p->server_info->ptok, &se_restore ) )
 		return WERR_ACCESS_DENIED;
 
 	DEBUG(2,("_winreg_RestoreKey: Restoring [%s] from %s in share %s\n",
diff --git a/source3/rpc_server/srv_wkssvc_nt.c b/source3/rpc_server/srv_wkssvc_nt.c
index 0a54b0dd3f..7071b55e7c 100644
--- a/source3/rpc_server/srv_wkssvc_nt.c
+++ b/source3/rpc_server/srv_wkssvc_nt.c
@@ -293,7 +293,7 @@ WERROR _wkssvc_NetrJoinDomain2(pipes_struct *p,
 	char *admin_domain = NULL;
 	char *admin_account = NULL;
 	WERROR werr;
-	struct nt_user_token *token = p->pipe_user.nt_user_token;
+	struct nt_user_token *token = p->server_info->ptok;
 
 	if (!r->in.domain_name) {
 		return WERR_INVALID_PARAM;
@@ -368,7 +368,7 @@ WERROR _wkssvc_NetrUnjoinDomain2(pipes_struct *p,
 	char *admin_domain = NULL;
 	char *admin_account = NULL;
 	WERROR werr;
-	struct nt_user_token *token = p->pipe_user.nt_user_token;
+	struct nt_user_token *token = p->server_info->ptok;
 
 	if (!r->in.account || !r->in.encrypted_password) {
 		return WERR_INVALID_PARAM;