rewrote policy handle code to be generic (it's needed for client-side too)

attempted to fix regsetsec command
(This used to be commit eaac0923e0e5e3f4c3d944272a71f3235ac2a741)

15 files changed, 469 insertions, 189 deletions

diff --git a/source3/include/includes.h b/source3/include/includes.h
index 03d1b3424b..4437e8710f 100644
--- a/source3/include/includes.h
+++ b/source3/include/includes.h
@@ -669,6 +669,10 @@ union semun {
 #define MAXPATHLEN 256
 #endif
 
+#ifndef MAX_SERVER_POLICY_HANDLES
+#define MAX_SERVER_POLICY_HANDLES 64
+#endif
+
 #ifndef SEEK_SET
 #define SEEK_SET 0
 #endif
diff --git a/source3/include/proto.h b/source3/include/proto.h
index d99ba9e27c..2307f67cef 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1904,8 +1904,10 @@ BOOL do_reg_query_info(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd,
 				const char* val_name,
 				uint32 *type, BUFFER2 *buffer);
 BOOL do_reg_set_key_sec(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd,
+				uint32 sec_info,
 				uint32 sec_buf_size, SEC_DESC *sec_buf);
 BOOL do_reg_get_key_sec(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd,
+				uint32 sec_info,
 				uint32 *sec_buf_size, SEC_DESC_BUF *sec_buf);
 BOOL do_reg_delete_val(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd, char *val_name);
 BOOL do_reg_delete_key(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd, char *key_name);
@@ -2651,10 +2653,12 @@ BOOL make_reg_q_close(REG_Q_CLOSE *q_c, POLICY_HND *hnd);
 BOOL reg_io_q_close(char *desc,  REG_Q_CLOSE *q_u, prs_struct *ps, int depth);
 BOOL reg_io_r_close(char *desc,  REG_R_CLOSE *r_u, prs_struct *ps, int depth);
 BOOL make_reg_q_set_key_sec(REG_Q_SET_KEY_SEC *q_i, POLICY_HND *pol,
+				uint32 sec_info,
 				uint32 buf_len, SEC_DESC *sec_desc);
 BOOL reg_io_q_set_key_sec(char *desc,  REG_Q_SET_KEY_SEC *r_q, prs_struct *ps, int depth);
 BOOL reg_io_r_set_key_sec(char *desc, REG_R_SET_KEY_SEC *r_q, prs_struct *ps, int depth);
 BOOL make_reg_q_get_key_sec(REG_Q_GET_KEY_SEC *q_i, POLICY_HND *pol, 
+				uint32 sec_info,
 				uint32 buf_len, SEC_DESC_BUF *sec_buf);
 BOOL reg_io_q_get_key_sec(char *desc,  REG_Q_GET_KEY_SEC *r_q, prs_struct *ps, int depth);
 BOOL reg_io_r_get_key_sec(char *desc,  REG_R_GET_KEY_SEC *r_q, prs_struct *ps, int depth);
@@ -3498,17 +3502,20 @@ BOOL api_ntlsa_rpc(pipes_struct *p, prs_struct *data);
 
 /*The following definitions come from  rpc_server/srv_lsa_hnd.c  */
 
-void init_lsa_policy_hnd(void);
-BOOL open_lsa_policy_hnd(POLICY_HND *hnd);
-int find_lsa_policy_by_hnd(POLICY_HND *hnd);
-BOOL set_lsa_policy_samr_rid(POLICY_HND *hnd, uint32 rid);
-BOOL set_lsa_policy_samr_pol_status(POLICY_HND *hnd, uint32 pol_status);
-BOOL set_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid);
-BOOL get_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid);
-uint32 get_lsa_policy_samr_rid(POLICY_HND *hnd);
-BOOL set_lsa_policy_reg_name(POLICY_HND *hnd, fstring name);
-BOOL get_lsa_policy_reg_name(POLICY_HND *hnd, fstring name);
-BOOL close_lsa_policy_hnd(POLICY_HND *hnd);
+void init_policy_hnd(int num_pol_hnds);
+BOOL open_policy_hnd(POLICY_HND *hnd);
+int find_policy_by_hnd(POLICY_HND *hnd);
+BOOL set_policy_samr_rid(POLICY_HND *hnd, uint32 rid);
+BOOL set_policy_samr_pol_status(POLICY_HND *hnd, uint32 pol_status);
+BOOL set_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid);
+BOOL get_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid);
+uint32 get_policy_samr_rid(POLICY_HND *hnd);
+BOOL set_policy_reg_name(POLICY_HND *hnd, fstring name);
+BOOL get_policy_reg_name(POLICY_HND *hnd, fstring name);
+BOOL set_policy_cli_state(POLICY_HND *hnd, struct cli_state *cli, uint16 fnum,
+				void (*free_fn)(struct cli_state *, uint16));
+BOOL get_policy_cli_state(POLICY_HND *hnd, struct cli_state **cli, uint16 *fnum);
+BOOL close_policy_hnd(POLICY_HND *hnd);
 
 /*The following definitions come from  rpc_server/srv_netlog.c  */
 
diff --git a/source3/include/rpc_reg.h b/source3/include/rpc_reg.h
index 6b141b9f47..7e74af8ab8 100644
--- a/source3/include/rpc_reg.h
+++ b/source3/include/rpc_reg.h
@@ -159,8 +159,6 @@ typedef struct q_reg_get_key_sec_info
 /* REG_R_GET_KEY_SEC */
 typedef struct r_reg_get_key_sec_info
 {
-	uint32 sec_info;       /* xxxx_SECURITY_INFORMATION */
-
 	uint32 ptr;       /* pointer */
 	BUFHDR hdr_sec;    /* header for security data */
 	SEC_DESC_BUF *data;    /* security data */
diff --git a/source3/lib/util_hnd.c b/source3/lib/util_hnd.c
index d53264a73e..7a14437482 100644
--- a/source3/lib/util_hnd.c
+++ b/source3/lib/util_hnd.c
@@ -31,6 +31,11 @@ extern int DEBUGLEVEL;
 #define MAX_OPEN_POLS 64
 #endif
 
+#define POL_NO_INFO 0
+#define POL_REG_INFO 1
+#define POL_SAMR_INFO 2
+#define POL_CLI_INFO 3
+
 struct reg_info
 {
     /* for use by \PIPE\winreg */
@@ -45,17 +50,28 @@ struct samr_info
     uint32 status; /* some sort of flag.  best to record it.  comes from opnum 0x39 */
 };
 
+struct cli_info
+{
+	struct cli_state *cli;
+	uint16 fnum;
+	void (*free)(struct cli_state*, uint16 fnum);
+};
+
 static struct policy
 {
 	struct policy *next, *prev;
 	int pnum;
 	BOOL open;
 	POLICY_HND pol_hnd;
+	int type;
 
 	union {
-		struct samr_info samr;
-		struct reg_info reg;
+		struct samr_info *samr;
+		struct reg_info *reg;
+		struct cli_info *cli;
+
 	} dev;
+
 } *Policy;
 
 static struct bitmap *bmap;
@@ -85,18 +101,18 @@ static void create_pol_hnd(POLICY_HND *hnd)
 /****************************************************************************
   initialise policy handle states...
 ****************************************************************************/
-void init_lsa_policy_hnd(void)
+void init_policy_hnd(int num_pol_hnds)
 {
-	bmap = bitmap_allocate(MAX_OPEN_POLS);
+	bmap = bitmap_allocate(num_pol_hnds);
 	if (!bmap) {
-		exit_server("out of memory in init_lsa_policy_hnd\n");
+		exit_server("out of memory in init_policy_hnd\n");
 	}
 }
 
 /****************************************************************************
   find first available policy slot.  creates a policy handle for you.
 ****************************************************************************/
-BOOL open_lsa_policy_hnd(POLICY_HND *hnd)
+BOOL open_policy_hnd(POLICY_HND *hnd)
 {
 	int i;
 	struct policy *p;
@@ -118,6 +134,7 @@ BOOL open_lsa_policy_hnd(POLICY_HND *hnd)
 
 	p->open = True;				
 	p->pnum = i;
+	p->type = POL_NO_INFO;
 
 	create_pol_hnd(hnd);
 	memcpy(&p->pol_hnd, hnd, sizeof(*hnd));
@@ -135,7 +152,7 @@ BOOL open_lsa_policy_hnd(POLICY_HND *hnd)
 /****************************************************************************
   find policy by handle
 ****************************************************************************/
-static struct policy *find_lsa_policy(POLICY_HND *hnd)
+static struct policy *find_policy(POLICY_HND *hnd)
 {
 	struct policy *p;
 
@@ -156,9 +173,9 @@ static struct policy *find_lsa_policy(POLICY_HND *hnd)
 /****************************************************************************
   find policy index by handle
 ****************************************************************************/
-int find_lsa_policy_by_hnd(POLICY_HND *hnd)
+int find_policy_by_hnd(POLICY_HND *hnd)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	return p?p->pnum:-1;
 }
@@ -166,15 +183,24 @@ int find_lsa_policy_by_hnd(POLICY_HND *hnd)
 /****************************************************************************
   set samr rid
 ****************************************************************************/
-BOOL set_lsa_policy_samr_rid(POLICY_HND *hnd, uint32 rid)
+BOOL set_policy_samr_rid(POLICY_HND *hnd, uint32 rid)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
-	if (p && p->open) {
+	if (p && p->open)
+	{
 		DEBUG(3,("Setting policy device rid=%x pnum=%x\n",
 			 rid, p->pnum));
 
-		p->dev.samr.rid = rid;
+		if (p->dev.samr == NULL)
+		{
+			p->dev.samr = (struct samr_info*)malloc(sizeof(*p->dev.samr));
+		}
+		if (p->dev.samr == NULL)
+		{
+			return False;
+		}
+		p->dev.samr->rid = rid;
 		return True;
 	}
 
@@ -186,15 +212,25 @@ BOOL set_lsa_policy_samr_rid(POLICY_HND *hnd, uint32 rid)
 /****************************************************************************
   set samr pol status.  absolutely no idea what this is.
 ****************************************************************************/
-BOOL set_lsa_policy_samr_pol_status(POLICY_HND *hnd, uint32 pol_status)
+BOOL set_policy_samr_pol_status(POLICY_HND *hnd, uint32 pol_status)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
-	if (p && p->open) {
+	if (p && p->open)
+	{
 		DEBUG(3,("Setting policy status=%x pnum=%x\n",
 		          pol_status, p->pnum));
 
-		p->dev.samr.status = pol_status;
+		if (p->dev.samr == NULL)
+		{
+			p->type = POL_SAMR_INFO;
+			p->dev.samr = (struct samr_info*)malloc(sizeof(*p->dev.samr));
+		}
+		if (p->dev.samr == NULL)
+		{
+			return False;
+		}
+		p->dev.samr->status = pol_status;
 		return True;
 	} 
 
@@ -206,16 +242,25 @@ BOOL set_lsa_policy_samr_pol_status(POLICY_HND *hnd, uint32 pol_status)
 /****************************************************************************
   set samr sid
 ****************************************************************************/
-BOOL set_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
+BOOL set_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
 {
 	pstring sidstr;
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p && p->open) {
 		DEBUG(3,("Setting policy sid=%s pnum=%x\n",
 			 sid_to_string(sidstr, sid), p->pnum));
 
-		memcpy(&p->dev.samr.sid, sid, sizeof(*sid));
+		if (p->dev.samr == NULL)
+		{
+			p->type = POL_SAMR_INFO;
+			p->dev.samr = (struct samr_info*)malloc(sizeof(*p->dev.samr));
+		}
+		if (p->dev.samr == NULL)
+		{
+			return False;
+		}
+		memcpy(&p->dev.samr->sid, sid, sizeof(*sid));
 		return True;
 	}
 
@@ -227,14 +272,14 @@ BOOL set_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
 /****************************************************************************
   get samr sid
 ****************************************************************************/
-BOOL get_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
+BOOL get_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p != NULL && p->open)
 	{
 		pstring sidstr;
-		memcpy(sid, &p->dev.samr.sid, sizeof(*sid));
+		memcpy(sid, &p->dev.samr->sid, sizeof(*sid));
 		DEBUG(3,("Getting policy sid=%s pnum=%x\n",
 			 sid_to_string(sidstr, sid), p->pnum));
 
@@ -248,12 +293,12 @@ BOOL get_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
 /****************************************************************************
   get samr rid
 ****************************************************************************/
-uint32 get_lsa_policy_samr_rid(POLICY_HND *hnd)
+uint32 get_policy_samr_rid(POLICY_HND *hnd)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p && p->open) {
-		uint32 rid = p->dev.samr.rid;
+		uint32 rid = p->dev.samr->rid;
 		DEBUG(3,("Getting policy device rid=%x pnum=%x\n",
 		          rid, p->pnum));
 
@@ -267,16 +312,25 @@ uint32 get_lsa_policy_samr_rid(POLICY_HND *hnd)
 /****************************************************************************
   set reg name 
 ****************************************************************************/
-BOOL set_lsa_policy_reg_name(POLICY_HND *hnd, fstring name)
+BOOL set_policy_reg_name(POLICY_HND *hnd, fstring name)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p && p->open)
 	{
 		DEBUG(3,("Getting policy pnum=%x\n",
 			 p->pnum));
 
-		fstrcpy(p->dev.reg.name, name);
+		if (p->dev.reg == NULL)
+		{
+			p->type = POL_REG_INFO;
+			p->dev.reg = (struct reg_info*)malloc(sizeof(*p->dev.reg));
+		}
+		if (p->dev.reg == NULL)
+		{
+			return False;
+		}
+		fstrcpy(p->dev.reg->name, name);
 		return True;
 	}
 
@@ -287,16 +341,16 @@ BOOL set_lsa_policy_reg_name(POLICY_HND *hnd, fstring name)
 /****************************************************************************
   set reg name 
 ****************************************************************************/
-BOOL get_lsa_policy_reg_name(POLICY_HND *hnd, fstring name)
+BOOL get_policy_reg_name(POLICY_HND *hnd, fstring name)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p && p->open)
 	{
 		DEBUG(3,("Setting policy pnum=%x name=%s\n",
 			 p->pnum, name));
 
-		fstrcpy(name, p->dev.reg.name);
+		fstrcpy(name, p->dev.reg->name);
 		DEBUG(5,("getting policy reg name=%s\n", name));
 		return True;
 	}
@@ -306,11 +360,64 @@ BOOL get_lsa_policy_reg_name(POLICY_HND *hnd, fstring name)
 }
 
 /****************************************************************************
+  set cli state
+****************************************************************************/
+BOOL set_policy_cli_state(POLICY_HND *hnd, struct cli_state *cli, uint16 fnum,
+				void (*free_fn)(struct cli_state *, uint16))
+{
+	struct policy *p = find_policy(hnd);
+
+	if (p && p->open)
+	{
+		DEBUG(3,("Setting policy cli state pnum=%x\n", p->pnum));
+
+		if (p->dev.cli == NULL)
+		{
+			p->type = POL_CLI_INFO;
+			p->dev.cli = (struct cli_info*)malloc(sizeof(*p->dev.cli));
+		}
+		if (p->dev.cli == NULL)
+		{
+			return False;
+		}
+		p->dev.cli->cli  = cli;
+		p->dev.cli->free = free_fn;
+		p->dev.cli->fnum = fnum;
+		return True;
+	}
+
+	DEBUG(3,("Error setting policy cli state\n"));
+
+	return False;
+}
+
+/****************************************************************************
+  get cli state
+****************************************************************************/
+BOOL get_policy_cli_state(POLICY_HND *hnd, struct cli_state **cli, uint16 *fnum)
+{
+	struct policy *p = find_policy(hnd);
+
+	if (p != NULL && p->open)
+	{
+		DEBUG(3,("Getting cli state pnum=%x\n", p->pnum));
+
+		(*cli ) = p->dev.cli->cli;
+		(*fnum) = p->dev.cli->fnum;
+
+		return True;
+	}
+
+	DEBUG(3,("Error getting policy\n"));
+	return False;
+}
+
+/****************************************************************************
   close an lsa policy
 ****************************************************************************/
-BOOL close_lsa_policy_hnd(POLICY_HND *hnd)
+BOOL close_policy_hnd(POLICY_HND *hnd)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (!p)
 	{
@@ -327,6 +434,29 @@ BOOL close_lsa_policy_hnd(POLICY_HND *hnd)
 	ZERO_STRUCTP(p);
 	ZERO_STRUCTP(hnd);
 
+	switch (p->type)
+	{
+		case POL_REG_INFO:
+		{
+			free(p->dev.reg);
+			break;
+		}
+		case POL_SAMR_INFO:
+		{
+			free(p->dev.samr);
+			break;
+		}
+		case POL_CLI_INFO:
+		{
+			if (p->dev.cli->free != NULL)
+			{
+				p->dev.cli->free(p->dev.cli->cli,
+				                 p->dev.cli->fnum);
+			}
+			break;
+		}
+	}
+
 	free(p);
 
 	return True;
diff --git a/source3/lsarpcd/srv_lsa.c b/source3/lsarpcd/srv_lsa.c
index b1761219af..9b6a98e9a6 100644
--- a/source3/lsarpcd/srv_lsa.c
+++ b/source3/lsarpcd/srv_lsa.c
@@ -48,7 +48,7 @@ static void lsa_reply_open_policy2(prs_struct *rdata)
 	r_o.status = 0x0;
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (!open_lsa_policy_hnd(&r_o.pol))
+	if (!open_policy_hnd(&r_o.pol))
 	{
 		r_o.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -71,7 +71,7 @@ static void lsa_reply_open_policy(prs_struct *rdata)
 	r_o.status = 0x0;
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (!open_lsa_policy_hnd(&r_o.pol))
+	if (!open_policy_hnd(&r_o.pol))
 	{
 		r_o.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -132,7 +132,7 @@ static void lsa_reply_query_info(LSA_Q_QUERY_INFO *q_q, prs_struct *rdata,
 	ZERO_STRUCT(r_q);
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (r_q.status == 0x0 && !open_lsa_policy_hnd(&q_q->pol))
+	if (r_q.status == 0x0 && !open_policy_hnd(&q_q->pol))
 	{
 		r_q.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -591,13 +591,13 @@ static void api_lsa_close( pipes_struct *p, prs_struct *data,
 	r_c.status = 0x0;
 
 	/* find the connection policy handle. */
-	if (r_c.status == 0x0 && (find_lsa_policy_by_hnd(&(q_c.pol)) == -1))
+	if (r_c.status == 0x0 && (find_policy_by_hnd(&(q_c.pol)) == -1))
 	{
 		r_c.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 	if (r_c.status == 0x0)
 	{
-		close_lsa_policy_hnd(&(q_c.pol));
+		close_policy_hnd(&(q_c.pol));
 	}
 
 	/* store the response in the SMB stream */
diff --git a/source3/rpc_client/cli_reg.c b/source3/rpc_client/cli_reg.c
index dbdf98dcf7..1bad3e16a4 100644
--- a/source3/rpc_client/cli_reg.c
+++ b/source3/rpc_client/cli_reg.c
@@ -509,6 +509,7 @@ BOOL do_reg_query_info(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd,
 do a REG Set Key Security 
 ****************************************************************************/
 BOOL do_reg_set_key_sec(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd,
+				uint32 sec_info,
 				uint32 sec_buf_size, SEC_DESC *sec_buf)
 {
 	prs_struct rbuf;
@@ -525,7 +526,7 @@ BOOL do_reg_set_key_sec(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd,
 
 	DEBUG(4,("REG Set Key security.\n"));
 
-	make_reg_q_set_key_sec(&q_o, hnd, sec_buf_size, sec_buf);
+	make_reg_q_set_key_sec(&q_o, hnd, sec_info, sec_buf_size, sec_buf);
 
 	/* turn parameters into data stream */
 	reg_io_q_set_key_sec("", &q_o, &buf, 0);
@@ -558,6 +559,7 @@ BOOL do_reg_set_key_sec(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd,
 do a REG Query Key Security 
 ****************************************************************************/
 BOOL do_reg_get_key_sec(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd,
+				uint32 sec_info,
 				uint32 *sec_buf_size, SEC_DESC_BUF *sec_buf)
 {
 	prs_struct rbuf;
@@ -574,7 +576,7 @@ BOOL do_reg_get_key_sec(struct cli_state *cli, uint16 fnum, POLICY_HND *hnd,
 
 	DEBUG(4,("REG query key security.  buf_size: %d\n", *sec_buf_size));
 
-	make_reg_q_get_key_sec(&q_o, hnd, *sec_buf_size, sec_buf);
+	make_reg_q_get_key_sec(&q_o, hnd, sec_info, *sec_buf_size, sec_buf);
 
 	/* turn parameters into data stream */
 	reg_io_q_get_key_sec("", &q_o, &buf, 0);
diff --git a/source3/rpc_parse/parse_reg.c b/source3/rpc_parse/parse_reg.c
index ec2699e745..5e7e950ae4 100644
--- a/source3/rpc_parse/parse_reg.c
+++ b/source3/rpc_parse/parse_reg.c
@@ -664,13 +664,14 @@ BOOL reg_io_r_close(char *desc,  REG_R_CLOSE *r_u, prs_struct *ps, int depth)
 makes a structure.
 ********************************************************************/
 BOOL make_reg_q_set_key_sec(REG_Q_SET_KEY_SEC *q_i, POLICY_HND *pol,
+				uint32 sec_info,
 				uint32 buf_len, SEC_DESC *sec_desc)
 {
 	if (q_i == NULL) return False;
 
 	memcpy(&(q_i->pol), pol, sizeof(q_i->pol));
 
-	q_i->sec_info = DACL_SECURITY_INFORMATION;
+	q_i->sec_info = sec_info;
 
 	q_i->ptr = 1;
 	make_buf_hdr(&(q_i->hdr_sec), buf_len, buf_len);
@@ -723,15 +724,14 @@ BOOL reg_io_r_set_key_sec(char *desc, REG_R_SET_KEY_SEC *r_q, prs_struct *ps, in
 makes a structure.
 ********************************************************************/
 BOOL make_reg_q_get_key_sec(REG_Q_GET_KEY_SEC *q_i, POLICY_HND *pol, 
+				uint32 sec_info,
 				uint32 buf_len, SEC_DESC_BUF *sec_buf)
 {
 	if (q_i == NULL) return False;
 
 	memcpy(&(q_i->pol), pol, sizeof(q_i->pol));
 
-	q_i->sec_info = OWNER_SECURITY_INFORMATION |
-	                GROUP_SECURITY_INFORMATION |
-	                DACL_SECURITY_INFORMATION;
+	q_i->sec_info = sec_info;
 
 	q_i->ptr = sec_buf != NULL ? 1 : 0;
 	q_i->data = sec_buf;
diff --git a/source3/rpc_parse/parse_sec.c b/source3/rpc_parse/parse_sec.c
index 161e42c9ff..d4f4f8185f 100644
--- a/source3/rpc_parse/parse_sec.c
+++ b/source3/rpc_parse/parse_sec.c
@@ -94,6 +94,7 @@ BOOL sec_io_ace(char *desc, SEC_ACE *t, prs_struct *ps, int depth)
 	sec_io_access   ("info ", &t->info, ps, depth);
 	prs_align(ps);
 	smb_io_dom_sid("sid  ", &t->sid , ps, depth);
+	prs_align(ps);
 
 	prs_uint16_post("size ", ps, depth, &t->size, offset_ace_size, old_offset);
 
@@ -519,9 +520,11 @@ BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF *sec, prs_struct *ps, int depth)
 		sec_io_desc("sec   ", sec->sec, ps, depth);
 	}
 
+	prs_align(ps);
+	
 	size = ps->offset - old_offset;
-	prs_uint32_post("max_len", ps, depth, &(sec->max_len), off_max_len, size == 0 ? sec->max_len : size);
-	prs_uint32_post("len    ", ps, depth, &(sec->len    ), off_len    , size);
+	prs_uint32_post("max_len", ps, depth, &(sec->max_len), off_max_len, size == 0 ? sec->max_len : size + 8);
+	prs_uint32_post("len    ", ps, depth, &(sec->len    ), off_len    , size == 0 ? 0 : size + 8);
 
 	return True;
 }
diff --git a/source3/rpc_server/srv_lsa.c b/source3/rpc_server/srv_lsa.c
index b1761219af..9b6a98e9a6 100644
--- a/source3/rpc_server/srv_lsa.c
+++ b/source3/rpc_server/srv_lsa.c
@@ -48,7 +48,7 @@ static void lsa_reply_open_policy2(prs_struct *rdata)
 	r_o.status = 0x0;
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (!open_lsa_policy_hnd(&r_o.pol))
+	if (!open_policy_hnd(&r_o.pol))
 	{
 		r_o.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -71,7 +71,7 @@ static void lsa_reply_open_policy(prs_struct *rdata)
 	r_o.status = 0x0;
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (!open_lsa_policy_hnd(&r_o.pol))
+	if (!open_policy_hnd(&r_o.pol))
 	{
 		r_o.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -132,7 +132,7 @@ static void lsa_reply_query_info(LSA_Q_QUERY_INFO *q_q, prs_struct *rdata,
 	ZERO_STRUCT(r_q);
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (r_q.status == 0x0 && !open_lsa_policy_hnd(&q_q->pol))
+	if (r_q.status == 0x0 && !open_policy_hnd(&q_q->pol))
 	{
 		r_q.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -591,13 +591,13 @@ static void api_lsa_close( pipes_struct *p, prs_struct *data,
 	r_c.status = 0x0;
 
 	/* find the connection policy handle. */
-	if (r_c.status == 0x0 && (find_lsa_policy_by_hnd(&(q_c.pol)) == -1))
+	if (r_c.status == 0x0 && (find_policy_by_hnd(&(q_c.pol)) == -1))
 	{
 		r_c.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 	if (r_c.status == 0x0)
 	{
-		close_lsa_policy_hnd(&(q_c.pol));
+		close_policy_hnd(&(q_c.pol));
 	}
 
 	/* store the response in the SMB stream */
diff --git a/source3/rpc_server/srv_lsa_hnd.c b/source3/rpc_server/srv_lsa_hnd.c
index d53264a73e..7a14437482 100644
--- a/source3/rpc_server/srv_lsa_hnd.c
+++ b/source3/rpc_server/srv_lsa_hnd.c
@@ -31,6 +31,11 @@ extern int DEBUGLEVEL;
 #define MAX_OPEN_POLS 64
 #endif
 
+#define POL_NO_INFO 0
+#define POL_REG_INFO 1
+#define POL_SAMR_INFO 2
+#define POL_CLI_INFO 3
+
 struct reg_info
 {
     /* for use by \PIPE\winreg */
@@ -45,17 +50,28 @@ struct samr_info
     uint32 status; /* some sort of flag.  best to record it.  comes from opnum 0x39 */
 };
 
+struct cli_info
+{
+	struct cli_state *cli;
+	uint16 fnum;
+	void (*free)(struct cli_state*, uint16 fnum);
+};
+
 static struct policy
 {
 	struct policy *next, *prev;
 	int pnum;
 	BOOL open;
 	POLICY_HND pol_hnd;
+	int type;
 
 	union {
-		struct samr_info samr;
-		struct reg_info reg;
+		struct samr_info *samr;
+		struct reg_info *reg;
+		struct cli_info *cli;
+
 	} dev;
+
 } *Policy;
 
 static struct bitmap *bmap;
@@ -85,18 +101,18 @@ static void create_pol_hnd(POLICY_HND *hnd)
 /****************************************************************************
   initialise policy handle states...
 ****************************************************************************/
-void init_lsa_policy_hnd(void)
+void init_policy_hnd(int num_pol_hnds)
 {
-	bmap = bitmap_allocate(MAX_OPEN_POLS);
+	bmap = bitmap_allocate(num_pol_hnds);
 	if (!bmap) {
-		exit_server("out of memory in init_lsa_policy_hnd\n");
+		exit_server("out of memory in init_policy_hnd\n");
 	}
 }
 
 /****************************************************************************
   find first available policy slot.  creates a policy handle for you.
 ****************************************************************************/
-BOOL open_lsa_policy_hnd(POLICY_HND *hnd)
+BOOL open_policy_hnd(POLICY_HND *hnd)
 {
 	int i;
 	struct policy *p;
@@ -118,6 +134,7 @@ BOOL open_lsa_policy_hnd(POLICY_HND *hnd)
 
 	p->open = True;				
 	p->pnum = i;
+	p->type = POL_NO_INFO;
 
 	create_pol_hnd(hnd);
 	memcpy(&p->pol_hnd, hnd, sizeof(*hnd));
@@ -135,7 +152,7 @@ BOOL open_lsa_policy_hnd(POLICY_HND *hnd)
 /****************************************************************************
   find policy by handle
 ****************************************************************************/
-static struct policy *find_lsa_policy(POLICY_HND *hnd)
+static struct policy *find_policy(POLICY_HND *hnd)
 {
 	struct policy *p;
 
@@ -156,9 +173,9 @@ static struct policy *find_lsa_policy(POLICY_HND *hnd)
 /****************************************************************************
   find policy index by handle
 ****************************************************************************/
-int find_lsa_policy_by_hnd(POLICY_HND *hnd)
+int find_policy_by_hnd(POLICY_HND *hnd)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	return p?p->pnum:-1;
 }
@@ -166,15 +183,24 @@ int find_lsa_policy_by_hnd(POLICY_HND *hnd)
 /****************************************************************************
   set samr rid
 ****************************************************************************/
-BOOL set_lsa_policy_samr_rid(POLICY_HND *hnd, uint32 rid)
+BOOL set_policy_samr_rid(POLICY_HND *hnd, uint32 rid)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
-	if (p && p->open) {
+	if (p && p->open)
+	{
 		DEBUG(3,("Setting policy device rid=%x pnum=%x\n",
 			 rid, p->pnum));
 
-		p->dev.samr.rid = rid;
+		if (p->dev.samr == NULL)
+		{
+			p->dev.samr = (struct samr_info*)malloc(sizeof(*p->dev.samr));
+		}
+		if (p->dev.samr == NULL)
+		{
+			return False;
+		}
+		p->dev.samr->rid = rid;
 		return True;
 	}
 
@@ -186,15 +212,25 @@ BOOL set_lsa_policy_samr_rid(POLICY_HND *hnd, uint32 rid)
 /****************************************************************************
   set samr pol status.  absolutely no idea what this is.
 ****************************************************************************/
-BOOL set_lsa_policy_samr_pol_status(POLICY_HND *hnd, uint32 pol_status)
+BOOL set_policy_samr_pol_status(POLICY_HND *hnd, uint32 pol_status)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
-	if (p && p->open) {
+	if (p && p->open)
+	{
 		DEBUG(3,("Setting policy status=%x pnum=%x\n",
 		          pol_status, p->pnum));
 
-		p->dev.samr.status = pol_status;
+		if (p->dev.samr == NULL)
+		{
+			p->type = POL_SAMR_INFO;
+			p->dev.samr = (struct samr_info*)malloc(sizeof(*p->dev.samr));
+		}
+		if (p->dev.samr == NULL)
+		{
+			return False;
+		}
+		p->dev.samr->status = pol_status;
 		return True;
 	} 
 
@@ -206,16 +242,25 @@ BOOL set_lsa_policy_samr_pol_status(POLICY_HND *hnd, uint32 pol_status)
 /****************************************************************************
   set samr sid
 ****************************************************************************/
-BOOL set_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
+BOOL set_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
 {
 	pstring sidstr;
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p && p->open) {
 		DEBUG(3,("Setting policy sid=%s pnum=%x\n",
 			 sid_to_string(sidstr, sid), p->pnum));
 
-		memcpy(&p->dev.samr.sid, sid, sizeof(*sid));
+		if (p->dev.samr == NULL)
+		{
+			p->type = POL_SAMR_INFO;
+			p->dev.samr = (struct samr_info*)malloc(sizeof(*p->dev.samr));
+		}
+		if (p->dev.samr == NULL)
+		{
+			return False;
+		}
+		memcpy(&p->dev.samr->sid, sid, sizeof(*sid));
 		return True;
 	}
 
@@ -227,14 +272,14 @@ BOOL set_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
 /****************************************************************************
   get samr sid
 ****************************************************************************/
-BOOL get_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
+BOOL get_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p != NULL && p->open)
 	{
 		pstring sidstr;
-		memcpy(sid, &p->dev.samr.sid, sizeof(*sid));
+		memcpy(sid, &p->dev.samr->sid, sizeof(*sid));
 		DEBUG(3,("Getting policy sid=%s pnum=%x\n",
 			 sid_to_string(sidstr, sid), p->pnum));
 
@@ -248,12 +293,12 @@ BOOL get_lsa_policy_samr_sid(POLICY_HND *hnd, DOM_SID *sid)
 /****************************************************************************
   get samr rid
 ****************************************************************************/
-uint32 get_lsa_policy_samr_rid(POLICY_HND *hnd)
+uint32 get_policy_samr_rid(POLICY_HND *hnd)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p && p->open) {
-		uint32 rid = p->dev.samr.rid;
+		uint32 rid = p->dev.samr->rid;
 		DEBUG(3,("Getting policy device rid=%x pnum=%x\n",
 		          rid, p->pnum));
 
@@ -267,16 +312,25 @@ uint32 get_lsa_policy_samr_rid(POLICY_HND *hnd)
 /****************************************************************************
   set reg name 
 ****************************************************************************/
-BOOL set_lsa_policy_reg_name(POLICY_HND *hnd, fstring name)
+BOOL set_policy_reg_name(POLICY_HND *hnd, fstring name)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p && p->open)
 	{
 		DEBUG(3,("Getting policy pnum=%x\n",
 			 p->pnum));
 
-		fstrcpy(p->dev.reg.name, name);
+		if (p->dev.reg == NULL)
+		{
+			p->type = POL_REG_INFO;
+			p->dev.reg = (struct reg_info*)malloc(sizeof(*p->dev.reg));
+		}
+		if (p->dev.reg == NULL)
+		{
+			return False;
+		}
+		fstrcpy(p->dev.reg->name, name);
 		return True;
 	}
 
@@ -287,16 +341,16 @@ BOOL set_lsa_policy_reg_name(POLICY_HND *hnd, fstring name)
 /****************************************************************************
   set reg name 
 ****************************************************************************/
-BOOL get_lsa_policy_reg_name(POLICY_HND *hnd, fstring name)
+BOOL get_policy_reg_name(POLICY_HND *hnd, fstring name)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (p && p->open)
 	{
 		DEBUG(3,("Setting policy pnum=%x name=%s\n",
 			 p->pnum, name));
 
-		fstrcpy(name, p->dev.reg.name);
+		fstrcpy(name, p->dev.reg->name);
 		DEBUG(5,("getting policy reg name=%s\n", name));
 		return True;
 	}
@@ -306,11 +360,64 @@ BOOL get_lsa_policy_reg_name(POLICY_HND *hnd, fstring name)
 }
 
 /****************************************************************************
+  set cli state
+****************************************************************************/
+BOOL set_policy_cli_state(POLICY_HND *hnd, struct cli_state *cli, uint16 fnum,
+				void (*free_fn)(struct cli_state *, uint16))
+{
+	struct policy *p = find_policy(hnd);
+
+	if (p && p->open)
+	{
+		DEBUG(3,("Setting policy cli state pnum=%x\n", p->pnum));
+
+		if (p->dev.cli == NULL)
+		{
+			p->type = POL_CLI_INFO;
+			p->dev.cli = (struct cli_info*)malloc(sizeof(*p->dev.cli));
+		}
+		if (p->dev.cli == NULL)
+		{
+			return False;
+		}
+		p->dev.cli->cli  = cli;
+		p->dev.cli->free = free_fn;
+		p->dev.cli->fnum = fnum;
+		return True;
+	}
+
+	DEBUG(3,("Error setting policy cli state\n"));
+
+	return False;
+}
+
+/****************************************************************************
+  get cli state
+****************************************************************************/
+BOOL get_policy_cli_state(POLICY_HND *hnd, struct cli_state **cli, uint16 *fnum)
+{
+	struct policy *p = find_policy(hnd);
+
+	if (p != NULL && p->open)
+	{
+		DEBUG(3,("Getting cli state pnum=%x\n", p->pnum));
+
+		(*cli ) = p->dev.cli->cli;
+		(*fnum) = p->dev.cli->fnum;
+
+		return True;
+	}
+
+	DEBUG(3,("Error getting policy\n"));
+	return False;
+}
+
+/****************************************************************************
   close an lsa policy
 ****************************************************************************/
-BOOL close_lsa_policy_hnd(POLICY_HND *hnd)
+BOOL close_policy_hnd(POLICY_HND *hnd)
 {
-	struct policy *p = find_lsa_policy(hnd);
+	struct policy *p = find_policy(hnd);
 
 	if (!p)
 	{
@@ -327,6 +434,29 @@ BOOL close_lsa_policy_hnd(POLICY_HND *hnd)
 	ZERO_STRUCTP(p);
 	ZERO_STRUCTP(hnd);
 
+	switch (p->type)
+	{
+		case POL_REG_INFO:
+		{
+			free(p->dev.reg);
+			break;
+		}
+		case POL_SAMR_INFO:
+		{
+			free(p->dev.samr);
+			break;
+		}
+		case POL_CLI_INFO:
+		{
+			if (p->dev.cli->free != NULL)
+			{
+				p->dev.cli->free(p->dev.cli->cli,
+				                 p->dev.cli->fnum);
+			}
+			break;
+		}
+	}
+
 	free(p);
 
 	return True;
diff --git a/source3/rpc_server/srv_reg.c b/source3/rpc_server/srv_reg.c
index 10b9bac90c..22314d9c5e 100644
--- a/source3/rpc_server/srv_reg.c
+++ b/source3/rpc_server/srv_reg.c
@@ -41,7 +41,7 @@ static void reg_reply_close(REG_Q_CLOSE *q_r,
 	bzero(r_u.pol.data, POL_HND_SIZE);
 
 	/* close the policy handle */
-	if (close_lsa_policy_hnd(&(q_r->pol)))
+	if (close_policy_hnd(&(q_r->pol)))
 	{
 		r_u.status = 0;
 	}
@@ -84,7 +84,7 @@ static void reg_reply_open(REG_Q_OPEN_HKLM *q_r,
 
 	r_u.status = 0x0;
 	/* get a (unique) handle.  open a policy on it. */
-	if (r_u.status == 0x0 && !open_lsa_policy_hnd(&(r_u.pol)))
+	if (r_u.status == 0x0 && !open_policy_hnd(&(r_u.pol)))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -126,12 +126,12 @@ static void reg_reply_open_entry(REG_Q_OPEN_ENTRY *q_u,
 
 	DEBUG(5,("reg_open_entry: %d\n", __LINE__));
 
-	if (status == 0 && find_lsa_policy_by_hnd(&(q_u->pol)) == -1)
+	if (status == 0 && find_policy_by_hnd(&(q_u->pol)) == -1)
 	{
 		status = 0xC000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
-	if (status == 0x0 && !open_lsa_policy_hnd(&pol))
+	if (status == 0x0 && !open_policy_hnd(&pol))
 	{
 		status = 0xC000000 | NT_STATUS_TOO_MANY_SECRETS; /* ha ha very droll */
 	}
@@ -149,7 +149,7 @@ static void reg_reply_open_entry(REG_Q_OPEN_ENTRY *q_u,
 		}
 	}
 
-	if (status == 0x0 && !set_lsa_policy_reg_name(&pol, name))
+	if (status == 0x0 && !set_policy_reg_name(&pol, name))
 	{
 		status = 0xC000000 | NT_STATUS_TOO_MANY_SECRETS; /* ha ha very droll */
 	}
@@ -195,7 +195,7 @@ static void reg_reply_info(REG_Q_INFO *q_u,
 
 	DEBUG(5,("reg_info: %d\n", __LINE__));
 
-	if (status == 0x0 && !get_lsa_policy_reg_name(&q_u->pol, name))
+	if (status == 0x0 && !get_policy_reg_name(&q_u->pol, name))
 	{
 		status = 0xC000000 | NT_STATUS_INVALID_HANDLE;
 	}
diff --git a/source3/rpc_server/srv_samr.c b/source3/rpc_server/srv_samr.c
index bc3a842677..894e8f2e2c 100644
--- a/source3/rpc_server/srv_samr.c
+++ b/source3/rpc_server/srv_samr.c
@@ -124,7 +124,7 @@ static void samr_reply_close_hnd(SAMR_Q_CLOSE_HND *q_u,
 	bzero(r_u.pol.data, POL_HND_SIZE);
 
 	/* close the policy handle */
-	if (close_lsa_policy_hnd(&(q_u->pol)))
+	if (close_policy_hnd(&(q_u->pol)))
 	{
 		r_u.status = 0;
 	}
@@ -165,19 +165,19 @@ static void samr_reply_open_domain(SAMR_Q_OPEN_DOMAIN *q_u,
 	r_u.status = 0x0;
 
 	/* find the connection policy handle. */
-	if (r_u.status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->connect_pol)) == -1))
+	if (r_u.status == 0x0 && (find_policy_by_hnd(&(q_u->connect_pol)) == -1))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (r_u.status == 0x0 && !(pol_open = open_lsa_policy_hnd(&(r_u.domain_pol))))
+	if (r_u.status == 0x0 && !(pol_open = open_policy_hnd(&(r_u.domain_pol))))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
 
 	/* associate the domain SID with the (unique) handle. */
-	if (r_u.status == 0x0 && !set_lsa_policy_samr_sid(&(r_u.domain_pol), &(q_u->dom_sid.sid)))
+	if (r_u.status == 0x0 && !set_policy_samr_sid(&(r_u.domain_pol), &(q_u->dom_sid.sid)))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -185,7 +185,7 @@ static void samr_reply_open_domain(SAMR_Q_OPEN_DOMAIN *q_u,
 
 	if (r_u.status != 0 && pol_open)
 	{
-		close_lsa_policy_hnd(&(r_u.domain_pol));
+		close_policy_hnd(&(r_u.domain_pol));
 	}
 
 	DEBUG(5,("samr_open_domain: %d\n", __LINE__));
@@ -218,13 +218,13 @@ static void samr_reply_unknown_2c(SAMR_Q_UNKNOWN_2C *q_u,
 	uint32 status = 0x0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->user_pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->user_pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* find the user's rid */
-	if ((status == 0x0) && (get_lsa_policy_samr_rid(&(q_u->user_pol)) == 0xffffffff))
+	if ((status == 0x0) && (get_policy_samr_rid(&(q_u->user_pol)) == 0xffffffff))
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -265,13 +265,13 @@ static void samr_reply_unknown_3(SAMR_Q_UNKNOWN_3 *q_u,
 	status = 0x0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->user_pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->user_pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* find the user's rid */
-	if (status == 0x0 && (rid = get_lsa_policy_samr_rid(&(q_u->user_pol))) == 0xffffffff)
+	if (status == 0x0 && (rid = get_policy_samr_rid(&(q_u->user_pol))) == 0xffffffff)
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -334,7 +334,7 @@ static void samr_reply_enum_dom_users(SAMR_Q_ENUM_DOM_USERS *q_u,
 	r_e.status = 0x0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_e.status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (r_e.status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -392,7 +392,7 @@ static void samr_reply_add_groupmem(SAMR_Q_ADD_GROUPMEM *q_u,
 	r_e.status = 0x0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_e.status == 0x0 && !get_lsa_policy_samr_sid(&q_u->pol, &group_sid))
+	if (r_e.status == 0x0 && !get_policy_samr_sid(&q_u->pol, &group_sid))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -450,7 +450,7 @@ static void samr_reply_del_groupmem(SAMR_Q_DEL_GROUPMEM *q_u,
 	r_e.status = 0x0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_e.status == 0x0 && !get_lsa_policy_samr_sid(&q_u->pol, &group_sid))
+	if (r_e.status == 0x0 && !get_policy_samr_sid(&q_u->pol, &group_sid))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -508,7 +508,7 @@ static void samr_reply_add_aliasmem(SAMR_Q_ADD_ALIASMEM *q_u,
 	r_e.status = 0x0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_e.status == 0x0 && !get_lsa_policy_samr_sid(&q_u->alias_pol, &alias_sid))
+	if (r_e.status == 0x0 && !get_policy_samr_sid(&q_u->alias_pol, &alias_sid))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -574,7 +574,7 @@ static void samr_reply_del_aliasmem(SAMR_Q_DEL_ALIASMEM *q_u,
 	r_e.status = 0x0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_e.status == 0x0 && !get_lsa_policy_samr_sid(&q_u->alias_pol, &alias_sid))
+	if (r_e.status == 0x0 && !get_policy_samr_sid(&q_u->alias_pol, &alias_sid))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -644,7 +644,7 @@ static void samr_reply_enum_domains(SAMR_Q_ENUM_DOMAINS *q_u,
 	r_e.status = 0x0;
 
 	/* find the connection policy handle. */
-	if (r_e.status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (r_e.status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -711,7 +711,7 @@ static void samr_reply_enum_dom_groups(SAMR_Q_ENUM_DOM_GROUPS *q_u,
 	r_e.num_entries2 = 0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_e.status == 0x0 && !get_lsa_policy_samr_sid(&q_u->pol, &sid))
+	if (r_e.status == 0x0 && !get_policy_samr_sid(&q_u->pol, &sid))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -792,7 +792,7 @@ static void samr_reply_enum_dom_aliases(SAMR_Q_ENUM_DOM_ALIASES *q_u,
 	r_e.num_entries2 = 0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_e.status == 0x0 && !get_lsa_policy_samr_sid(&q_u->pol, &sid))
+	if (r_e.status == 0x0 && !get_policy_samr_sid(&q_u->pol, &sid))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -894,7 +894,7 @@ static void samr_reply_query_dispinfo(SAMR_Q_QUERY_DISPINFO *q_u,
 	DEBUG(5,("samr_reply_query_dispinfo: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (find_lsa_policy_by_hnd(&(q_u->domain_pol)) == -1)
+	if (find_policy_by_hnd(&(q_u->domain_pol)) == -1)
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 		DEBUG(5,("samr_reply_query_dispinfo: invalid handle\n"));
@@ -1058,7 +1058,7 @@ static void samr_reply_delete_dom_group(SAMR_Q_DELETE_DOM_GROUP *q_u,
 	DEBUG(5,("samr_delete_dom_group: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->group_pol, &group_sid))
+	if (status == 0x0 && !get_policy_samr_sid(&q_u->group_pol, &group_sid))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -1124,7 +1124,7 @@ static void samr_reply_query_groupmem(SAMR_Q_QUERY_GROUPMEM *q_u,
 	DEBUG(5,("samr_query_groupmem: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->group_pol, &group_sid))
+	if (status == 0x0 && !get_policy_samr_sid(&q_u->group_pol, &group_sid))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -1211,7 +1211,7 @@ static void samr_reply_query_groupinfo(SAMR_Q_QUERY_GROUPINFO *q_u,
 	r_e.ptr = 0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_e.status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (r_e.status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -1274,7 +1274,7 @@ static void samr_reply_query_aliasinfo(SAMR_Q_QUERY_ALIASINFO *q_u,
 	r_e.ptr = 0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_e.status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (r_e.status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		r_e.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -1340,7 +1340,7 @@ static void samr_reply_query_useraliases(SAMR_Q_QUERY_USERALIASES *q_u,
 	DEBUG(5,("samr_query_useraliases: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->pol, &dom_sid))
+	if (status == 0x0 && !get_policy_samr_sid(&q_u->pol, &dom_sid))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -1455,7 +1455,7 @@ static void samr_reply_delete_dom_alias(SAMR_Q_DELETE_DOM_ALIAS *q_u,
 	DEBUG(5,("samr_delete_dom_alias: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->alias_pol, &alias_sid))
+	if (status == 0x0 && !get_policy_samr_sid(&q_u->alias_pol, &alias_sid))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -1520,7 +1520,7 @@ static void samr_reply_query_aliasmem(SAMR_Q_QUERY_ALIASMEM *q_u,
 	DEBUG(5,("samr_query_aliasmem: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->alias_pol, &alias_sid))
+	if (status == 0x0 && !get_policy_samr_sid(&q_u->alias_pol, &alias_sid))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -1611,7 +1611,7 @@ static void samr_reply_lookup_names(SAMR_Q_LOOKUP_NAMES *q_u,
 
 	DEBUG(5,("samr_lookup_names: %d\n", __LINE__));
 
-	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->pol, &pol_sid))
+	if (status == 0x0 && !get_policy_samr_sid(&q_u->pol, &pol_sid))
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -1755,12 +1755,12 @@ static void samr_reply_lookup_rids(SAMR_Q_LOOKUP_RIDS *q_u,
 	DEBUG(5,("samr_lookup_rids: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
-	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->pol, &pol_sid))
+	if (status == 0x0 && !get_policy_samr_sid(&q_u->pol, &pol_sid))
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -1822,13 +1822,13 @@ static void samr_reply_open_user(SAMR_Q_OPEN_USER *q_u,
 	r_u.status = 0x0;
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_u.status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->domain_pol)) == -1))
+	if (r_u.status == 0x0 && (find_policy_by_hnd(&(q_u->domain_pol)) == -1))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (r_u.status == 0x0 && !(pol_open = open_lsa_policy_hnd(&(r_u.user_pol))))
+	if (r_u.status == 0x0 && !(pol_open = open_policy_hnd(&(r_u.user_pol))))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -1844,7 +1844,7 @@ static void samr_reply_open_user(SAMR_Q_OPEN_USER *q_u,
 	}
 
 	/* associate the RID with the (unique) handle. */
-	if (r_u.status == 0x0 && !set_lsa_policy_samr_rid(&(r_u.user_pol), q_u->user_rid))
+	if (r_u.status == 0x0 && !set_policy_samr_rid(&(r_u.user_pol), q_u->user_rid))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -1852,7 +1852,7 @@ static void samr_reply_open_user(SAMR_Q_OPEN_USER *q_u,
 
 	if (r_u.status != 0 && pol_open)
 	{
-		close_lsa_policy_hnd(&(r_u.user_pol));
+		close_policy_hnd(&(r_u.user_pol));
 	}
 
 	DEBUG(5,("samr_open_user: %d\n", __LINE__));
@@ -1981,13 +1981,13 @@ static void samr_reply_query_userinfo(SAMR_Q_QUERY_USERINFO *q_u,
 	DEBUG(5,("samr_reply_query_userinfo: %d\n", __LINE__));
 
 	/* search for the handle */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* find the user's rid */
-	if (status == 0x0 && (rid = get_lsa_policy_samr_rid(&(q_u->pol))) == 0xffffffff)
+	if (status == 0x0 && (rid = get_policy_samr_rid(&(q_u->pol))) == 0xffffffff)
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -2173,13 +2173,13 @@ static void samr_reply_set_userinfo2(SAMR_Q_SET_USERINFO2 *q_u,
 	DEBUG(5,("samr_reply_set_userinfo2: %d\n", __LINE__));
 
 	/* search for the handle */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* find the user's rid */
-	if (status == 0x0 && (rid = get_lsa_policy_samr_rid(&(q_u->pol))) == 0xffffffff)
+	if (status == 0x0 && (rid = get_policy_samr_rid(&(q_u->pol))) == 0xffffffff)
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -2254,13 +2254,13 @@ static void samr_reply_set_userinfo(SAMR_Q_SET_USERINFO *q_u,
 	DEBUG(5,("samr_reply_set_userinfo: %d\n", __LINE__));
 
 	/* search for the handle */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* find the user's rid */
-	if (status == 0x0 && (rid = get_lsa_policy_samr_rid(&(q_u->pol))) == 0xffffffff)
+	if (status == 0x0 && (rid = get_policy_samr_rid(&(q_u->pol))) == 0xffffffff)
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -2358,13 +2358,13 @@ static void samr_reply_query_usergroups(SAMR_Q_QUERY_USERGROUPS *q_u,
 	DEBUG(5,("samr_query_usergroups: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* find the user's rid */
-	if (status == 0x0 && (rid = get_lsa_policy_samr_rid(&(q_u->pol))) == 0xffffffff)
+	if (status == 0x0 && (rid = get_policy_samr_rid(&(q_u->pol))) == 0xffffffff)
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -2434,7 +2434,7 @@ static uint32 open_samr_alias(DOM_SID *sid, POLICY_HND *alias_pol,
 	uint32 status = 0x0;
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (status == 0x0 && !(pol_open = open_lsa_policy_hnd(alias_pol)))
+	if (status == 0x0 && !(pol_open = open_policy_hnd(alias_pol)))
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -2442,7 +2442,7 @@ static uint32 open_samr_alias(DOM_SID *sid, POLICY_HND *alias_pol,
 	DEBUG(0,("TODO: verify that the alias rid exists\n"));
 
 	/* associate a RID with the (unique) handle. */
-	if (status == 0x0 && !set_lsa_policy_samr_rid(alias_pol, alias_rid))
+	if (status == 0x0 && !set_policy_samr_rid(alias_pol, alias_rid))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -2451,7 +2451,7 @@ static uint32 open_samr_alias(DOM_SID *sid, POLICY_HND *alias_pol,
 	sid_append_rid(sid, alias_rid);
 
 	/* associate an alias SID with the (unique) handle. */
-	if (status == 0x0 && !set_lsa_policy_samr_sid(alias_pol, sid))
+	if (status == 0x0 && !set_policy_samr_sid(alias_pol, sid))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -2459,7 +2459,7 @@ static uint32 open_samr_alias(DOM_SID *sid, POLICY_HND *alias_pol,
 
 	if (status != 0 && pol_open)
 	{
-		close_lsa_policy_hnd(alias_pol);
+		close_policy_hnd(alias_pol);
 	}
 
 	return status;
@@ -2482,13 +2482,13 @@ static void samr_reply_create_dom_alias(SAMR_Q_CREATE_DOM_ALIAS *q_u,
 	DEBUG(5,("samr_create_dom_alias: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->dom_pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->dom_pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* find the domain sid */
-	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->dom_pol, &dom_sid))
+	if (status == 0x0 && !get_policy_samr_sid(&q_u->dom_pol, &dom_sid))
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -2545,7 +2545,7 @@ static uint32 open_samr_group(DOM_SID *sid, POLICY_HND *group_pol,
 	uint32 status = 0x0;
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (status == 0x0 && !(pol_open = open_lsa_policy_hnd(group_pol)))
+	if (status == 0x0 && !(pol_open = open_policy_hnd(group_pol)))
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -2553,7 +2553,7 @@ static uint32 open_samr_group(DOM_SID *sid, POLICY_HND *group_pol,
 	DEBUG(0,("TODO: verify that the group rid exists\n"));
 
 	/* associate a RID with the (unique) handle. */
-	if (status == 0x0 && !set_lsa_policy_samr_rid(group_pol, group_rid))
+	if (status == 0x0 && !set_policy_samr_rid(group_pol, group_rid))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -2562,7 +2562,7 @@ static uint32 open_samr_group(DOM_SID *sid, POLICY_HND *group_pol,
 	sid_append_rid(sid, group_rid);
 
 	/* associate an group SID with the (unique) handle. */
-	if (status == 0x0 && !set_lsa_policy_samr_sid(group_pol, sid))
+	if (status == 0x0 && !set_policy_samr_sid(group_pol, sid))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -2570,7 +2570,7 @@ static uint32 open_samr_group(DOM_SID *sid, POLICY_HND *group_pol,
 
 	if (status != 0 && pol_open)
 	{
-		close_lsa_policy_hnd(group_pol);
+		close_policy_hnd(group_pol);
 	}
 
 	return status;
@@ -2593,13 +2593,13 @@ static void samr_reply_create_dom_group(SAMR_Q_CREATE_DOM_GROUP *q_u,
 	DEBUG(5,("samr_create_dom_group: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* find the domain sid */
-	if (status == 0x0 && !get_lsa_policy_samr_sid(&q_u->pol, &dom_sid))
+	if (status == 0x0 && !get_policy_samr_sid(&q_u->pol, &dom_sid))
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_TYPE_MISMATCH;
 	}
@@ -2666,7 +2666,7 @@ static void samr_reply_query_dom_info(SAMR_Q_QUERY_DOMAIN_INFO *q_u,
 	DEBUG(5,("samr_reply_query_dom_info: %d\n", __LINE__));
 
 	/* find the policy handle.  open a policy on it. */
-	if (r_u.status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->domain_pol)) == -1))
+	if (r_u.status == 0x0 && (find_policy_by_hnd(&(q_u->domain_pol)) == -1))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 		DEBUG(5,("samr_reply_query_dom_info: invalid handle\n"));
@@ -2763,13 +2763,13 @@ static void samr_reply_create_user(SAMR_Q_CREATE_USER *q_u,
 	 */
 
 	/* find the policy handle.  open a policy on it. */
-	if (status == 0x0 && (find_lsa_policy_by_hnd(&(q_u->domain_pol)) == -1))
+	if (status == 0x0 && (find_policy_by_hnd(&(q_u->domain_pol)) == -1))
 	{
 		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (status == 0x0 && !(pol_open = open_lsa_policy_hnd(&pol)))
+	if (status == 0x0 && !(pol_open = open_policy_hnd(&pol)))
 	{
 		status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -2814,7 +2814,7 @@ static void samr_reply_create_user(SAMR_Q_CREATE_USER *q_u,
 	}
 
 	/* associate the RID with the (unique) handle. */
-	if (status == 0x0 && !set_lsa_policy_samr_rid(&pol, user_rid))
+	if (status == 0x0 && !set_policy_samr_rid(&pol, user_rid))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -2822,7 +2822,7 @@ static void samr_reply_create_user(SAMR_Q_CREATE_USER *q_u,
 
 	if (status != 0 && pol_open)
 	{
-		close_lsa_policy_hnd(&pol);
+		close_policy_hnd(&pol);
 	}
 
 	DEBUG(5,("samr_create_user: %d\n", __LINE__));
@@ -2864,13 +2864,13 @@ static void samr_reply_connect_anon(SAMR_Q_CONNECT_ANON *q_u,
 
 	r_u.status = 0x0;
 	/* get a (unique) handle.  open a policy on it. */
-	if (r_u.status == 0x0 && !(pol_open = open_lsa_policy_hnd(&(r_u.connect_pol))))
+	if (r_u.status == 0x0 && !(pol_open = open_policy_hnd(&(r_u.connect_pol))))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
 
 	/* associate the domain SID with the (unique) handle. */
-	if (r_u.status == 0x0 && !set_lsa_policy_samr_pol_status(&(r_u.connect_pol), q_u->unknown_0))
+	if (r_u.status == 0x0 && !set_policy_samr_pol_status(&(r_u.connect_pol), q_u->unknown_0))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -2878,7 +2878,7 @@ static void samr_reply_connect_anon(SAMR_Q_CONNECT_ANON *q_u,
 
 	if (r_u.status != 0 && pol_open)
 	{
-		close_lsa_policy_hnd(&(r_u.connect_pol));
+		close_policy_hnd(&(r_u.connect_pol));
 	}
 
 	DEBUG(5,("samr_connect_anon: %d\n", __LINE__));
@@ -2913,13 +2913,13 @@ static void samr_reply_connect(SAMR_Q_CONNECT *q_u,
 
 	r_u.status = 0x0;
 	/* get a (unique) handle.  open a policy on it. */
-	if (r_u.status == 0x0 && !(pol_open = open_lsa_policy_hnd(&(r_u.connect_pol))))
+	if (r_u.status == 0x0 && !(pol_open = open_policy_hnd(&(r_u.connect_pol))))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
 
 	/* associate the domain SID with the (unique) handle. */
-	if (r_u.status == 0x0 && !set_lsa_policy_samr_pol_status(&(r_u.connect_pol), q_u->unknown_0))
+	if (r_u.status == 0x0 && !set_policy_samr_pol_status(&(r_u.connect_pol), q_u->unknown_0))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -2927,7 +2927,7 @@ static void samr_reply_connect(SAMR_Q_CONNECT *q_u,
 
 	if (r_u.status != 0 && pol_open)
 	{
-		close_lsa_policy_hnd(&(r_u.connect_pol));
+		close_policy_hnd(&(r_u.connect_pol));
 	}
 
 	DEBUG(5,("samr_connect: %d\n", __LINE__));
@@ -2962,13 +2962,13 @@ static void samr_reply_open_alias(SAMR_Q_OPEN_ALIAS *q_u,
 	/* set up the SAMR open_alias response */
 
 	r_u.status = 0x0;
-	if (r_u.status == 0x0 && !get_lsa_policy_samr_sid(&q_u->dom_pol, &sid))
+	if (r_u.status == 0x0 && !get_policy_samr_sid(&q_u->dom_pol, &sid))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
 	/* get a (unique) handle.  open a policy on it. */
-	if (r_u.status == 0x0 && !(pol_open = open_lsa_policy_hnd(&(r_u.pol))))
+	if (r_u.status == 0x0 && !(pol_open = open_policy_hnd(&(r_u.pol))))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
 	}
@@ -2976,7 +2976,7 @@ static void samr_reply_open_alias(SAMR_Q_OPEN_ALIAS *q_u,
 	DEBUG(0,("TODO: verify that the alias rid exists\n"));
 
 	/* associate a RID with the (unique) handle. */
-	if (r_u.status == 0x0 && !set_lsa_policy_samr_rid(&(r_u.pol), q_u->rid_alias))
+	if (r_u.status == 0x0 && !set_policy_samr_rid(&(r_u.pol), q_u->rid_alias))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -2985,7 +2985,7 @@ static void samr_reply_open_alias(SAMR_Q_OPEN_ALIAS *q_u,
 	sid_append_rid(&sid, q_u->rid_alias);
 
 	/* associate an alias SID with the (unique) handle. */
-	if (r_u.status == 0x0 && !set_lsa_policy_samr_sid(&(r_u.pol), &sid))
+	if (r_u.status == 0x0 && !set_policy_samr_sid(&(r_u.pol), &sid))
 	{
 		/* oh, whoops.  don't know what error message to return, here */
 		r_u.status = 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -2993,7 +2993,7 @@ static void samr_reply_open_alias(SAMR_Q_OPEN_ALIAS *q_u,
 
 	if (r_u.status != 0 && pol_open)
 	{
-		close_lsa_policy_hnd(&(r_u.pol));
+		close_policy_hnd(&(r_u.pol));
 	}
 
 	DEBUG(5,("samr_open_alias: %d\n", __LINE__));
@@ -3030,7 +3030,7 @@ static void samr_reply_open_group(SAMR_Q_OPEN_GROUP *q_u,
 	r_u.status = 0x0;
 
 	/* find the domain sid associated with the policy handle */
-	if (r_u.status == 0x0 && !get_lsa_policy_samr_sid(&q_u->domain_pol, &sid))
+	if (r_u.status == 0x0 && !get_policy_samr_sid(&q_u->domain_pol, &sid))
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -3078,7 +3078,7 @@ static void samr_reply_lookup_domain(SAMR_Q_LOOKUP_DOMAIN *q_u,
 	r_u.status = 0x0;
 
 	/* find the connection policy handle */
-	if (find_lsa_policy_by_hnd(&(q_u->connect_pol)) == -1)
+	if (find_policy_by_hnd(&(q_u->connect_pol)) == -1)
 	{
 		r_u.status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
 	}
diff --git a/source3/rpc_server/srv_svcctl.c b/source3/rpc_server/srv_svcctl.c
index 39ec2c93ec..e67cafb9df 100644
--- a/source3/rpc_server/srv_svcctl.c
+++ b/source3/rpc_server/srv_svcctl.c
@@ -41,7 +41,7 @@ static void svc_reply_close(SVC_Q_CLOSE *q_r,
 	bzero(r_u.pol.data, POL_HND_SIZE);
 
 	/* close the policy handle */
-	if (close_lsa_policy_hnd(&(q_r->pol)))
+	if (close_policy_hnd(&(q_r->pol)))
 	{
 		r_u.status = 0;
 	}
@@ -83,12 +83,12 @@ static void svc_reply_open_service(SVC_Q_OPEN_SERVICE *q_u,
 
 	DEBUG(5,("svc_open_service: %d\n", __LINE__));
 
-	if (status == 0x0 && find_lsa_policy_by_hnd(&q_u->scman_pol) == -1)
+	if (status == 0x0 && find_policy_by_hnd(&q_u->scman_pol) == -1)
 	{
 		status = 0xC000000 | NT_STATUS_INVALID_HANDLE;
 	}
 
-	if (status == 0x0 && !open_lsa_policy_hnd(&pol))
+	if (status == 0x0 && !open_policy_hnd(&pol))
 	{
 		status = 0xC000000 | NT_STATUS_TOO_MANY_SECRETS; /* ha ha very droll */
 	}
@@ -101,7 +101,7 @@ static void svc_reply_open_service(SVC_Q_OPEN_SERVICE *q_u,
 		/* lkcl XXXX do a check on the name, here */
 	}
 
-	if (status == 0x0 && !set_lsa_policy_reg_name(&pol, name))
+	if (status == 0x0 && !set_policy_reg_name(&pol, name))
 	{
 		status = 0xC000000 | NT_STATUS_TOO_MANY_SECRETS; /* ha ha very droll */
 	}
@@ -137,7 +137,7 @@ static void svc_reply_start_service(SVC_Q_START_SERVICE *q_s,
 
 	r_s.status = 0x0;
 
-	if (find_lsa_policy_by_hnd(&q_s->pol) == -1)
+	if (find_policy_by_hnd(&q_s->pol) == -1)
 	{
 		r_s.status = 0xC000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -174,7 +174,7 @@ static void svc_reply_open_sc_man(SVC_Q_OPEN_SC_MAN *q_u,
 
 	DEBUG(5,("svc_open_sc_man: %d\n", __LINE__));
 
-	if (status == 0x0 && !open_lsa_policy_hnd(&pol))
+	if (status == 0x0 && !open_policy_hnd(&pol))
 	{
 		status = 0xC000000 | NT_STATUS_TOO_MANY_SECRETS; /* ha ha very droll */
 	}
@@ -187,7 +187,7 @@ static void svc_reply_open_sc_man(SVC_Q_OPEN_SC_MAN *q_u,
 		/* lkcl XXXX do a check on the name, here */
 	}
 
-	if (status == 0x0 && !set_lsa_policy_reg_name(&pol, name))
+	if (status == 0x0 && !set_policy_reg_name(&pol, name))
 	{
 		status = 0xC000000 | NT_STATUS_TOO_MANY_SECRETS; /* ha ha very droll */
 	}
@@ -242,7 +242,7 @@ static void svc_reply_enum_svcs_status(SVC_Q_ENUM_SVCS_STATUS *q_u,
 
 	DEBUG(5,("svc_enum_svcs_status: %d\n", __LINE__));
 
-	if (dos_status == 0x0 && find_lsa_policy_by_hnd(&q_u->pol) == -1)
+	if (dos_status == 0x0 && find_policy_by_hnd(&q_u->pol) == -1)
 	{
 		dos_status = 0xC000000 | NT_STATUS_INVALID_HANDLE;
 	}
@@ -338,7 +338,7 @@ static void svc_reply_query_disp_name(SVC_Q_QUERY_DISP_NAME *q_u,
 
 	DEBUG(5,("svc_query_disp_name: %d\n", __LINE__));
 
-	if (find_lsa_policy_by_hnd(&q_u->scman_pol) == -1)
+	if (find_policy_by_hnd(&q_u->scman_pol) == -1)
 	{
 		status = 0xC000000 | NT_STATUS_INVALID_HANDLE;
 	}
diff --git a/source3/rpcclient/cmd_reg.c b/source3/rpcclient/cmd_reg.c
index 962772fb8e..9911bc49c0 100644
--- a/source3/rpcclient/cmd_reg.c
+++ b/source3/rpcclient/cmd_reg.c
@@ -925,12 +925,13 @@ void cmd_reg_test_key_sec(struct client_info *info, int argc, char *argv[])
 
 	uint32 sec_buf_size;
 	SEC_DESC_BUF sec_buf;
+	uint32 sec_info = 0x7;
 
 	DEBUG(5, ("cmd_reg_get_key_sec: smb_cli->fd:%d\n", smb_cli->fd));
 
 	if (argc < 2)
 	{
-		report(out_hnd, "reggetsec <key_name>\n");
+		report(out_hnd, "regtestkeysec <key_name>\n");
 		return;
 	}
 
@@ -963,6 +964,7 @@ void cmd_reg_test_key_sec(struct client_info *info, int argc, char *argv[])
 	ZERO_STRUCT(sec_buf);
 
 	res4 = res3 ? do_reg_get_key_sec(smb_cli, fnum, &key_pol,
+	                        sec_info,
 				&sec_buf_size, &sec_buf) : False;
 	
 	if (res4)
@@ -971,6 +973,7 @@ void cmd_reg_test_key_sec(struct client_info *info, int argc, char *argv[])
 	}
 
 	res4 = res4 ? do_reg_get_key_sec(smb_cli, fnum, &key_pol,
+	                        sec_info,
 				&sec_buf_size, &sec_buf) : False;
 
 	if (res4 && sec_buf.len > 0 && sec_buf.sec != NULL)
@@ -980,7 +983,7 @@ void cmd_reg_test_key_sec(struct client_info *info, int argc, char *argv[])
 		display_sec_desc(out_hnd, ACTION_FOOTER   , sec_buf.sec);
 
 		res4 = res4 ? do_reg_set_key_sec(smb_cli, fnum, &key_pol,
-				sec_buf_size, sec_buf.sec) : False;
+				sec_info, sec_buf_size, sec_buf.sec) : False;
 
 		free_sec_desc_buf(&sec_buf);
 	}
@@ -1029,6 +1032,7 @@ void cmd_reg_get_key_sec(struct client_info *info, int argc, char *argv[])
 
 	uint32 sec_buf_size;
 	SEC_DESC_BUF sec_buf;
+	uint32 sec_info = 0x7;
 
 	DEBUG(5, ("cmd_reg_get_key_sec: smb_cli->fd:%d\n", smb_cli->fd));
 
@@ -1067,7 +1071,8 @@ void cmd_reg_get_key_sec(struct client_info *info, int argc, char *argv[])
 	ZERO_STRUCT(sec_buf);
 
 	res4 = res3 ? do_reg_get_key_sec(smb_cli, fnum, &key_pol,
-				&sec_buf_size, &sec_buf) : False;
+				sec_info,
+	                        &sec_buf_size, &sec_buf) : False;
 	
 	if (res4)
 	{
@@ -1075,7 +1080,8 @@ void cmd_reg_get_key_sec(struct client_info *info, int argc, char *argv[])
 	}
 
 	res4 = res4 ? do_reg_get_key_sec(smb_cli, fnum, &key_pol,
-				&sec_buf_size, &sec_buf) : False;
+				sec_info,
+	                        &sec_buf_size, &sec_buf) : False;
 
 	if (res4 && sec_buf.len > 0 && sec_buf.sec != NULL)
 	{
diff --git a/source3/smbd/server.c b/source3/smbd/server.c
index 590d8533b3..c2162a091b 100644
--- a/source3/smbd/server.c
+++ b/source3/smbd/server.c
@@ -476,7 +476,7 @@ static void init_structs(void)
 	conn_init();
 	file_init();
 	init_rpc_pipe_hnd(); /* for RPC pipes */
-	init_lsa_policy_hnd(); /* for LSA handles */
+	init_policy_hnd(MAX_SERVER_POLICY_HANDLES); /* for policy handles */
 	init_printer_hnd(); /* for SPOOLSS handles */
 	init_dptrs();
 	init_dfs_table();