s4:torture/rpc/lsa.c: add explicit check for NTSTATUS r.out.result

metze

1 files changed, 361 insertions, 306 deletions

diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c
index 4353f4bf7c..7ad6697084 100644
--- a/source4/torture/rpc/lsa.c
+++ b/source4/torture/rpc/lsa.c
@@ -44,7 +44,6 @@ static bool test_OpenPolicy(struct dcerpc_binding_handle *b,
 	struct policy_handle handle;
 	struct lsa_QosInfo qos;
 	struct lsa_OpenPolicy r;
-	NTSTATUS status;
 	uint16_t system_name = '\\';
 
 	torture_comment(tctx, "\nTesting OpenPolicy\n");
@@ -66,14 +65,17 @@ static bool test_OpenPolicy(struct dcerpc_binding_handle *b,
 	r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 	r.out.handle = &handle;
 
-	status = dcerpc_lsa_OpenPolicy_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
-		    NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
-			torture_comment(tctx, "not considering %s to be an error\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenPolicy_r(b, tctx, &r),
+				   "OpenPolicy failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
+		    NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
+			torture_comment(tctx, "not considering %s to be an error\n",
+					nt_errstr(r.out.result));
 			return true;
 		}
-		torture_comment(tctx, "OpenPolicy failed - %s\n", nt_errstr(status));
+		torture_comment(tctx, "OpenPolicy failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -88,7 +90,6 @@ bool test_lsa_OpenPolicy2(struct dcerpc_binding_handle *b,
 	struct lsa_ObjectAttribute attr;
 	struct lsa_QosInfo qos;
 	struct lsa_OpenPolicy2 r;
-	NTSTATUS status;
 
 	torture_comment(tctx, "\nTesting OpenPolicy2\n");
 
@@ -114,16 +115,19 @@ bool test_lsa_OpenPolicy2(struct dcerpc_binding_handle *b,
 	r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 	r.out.handle = *handle;
 
-	status = dcerpc_lsa_OpenPolicy2_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
-		    NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
-			torture_comment(tctx, "not considering %s to be an error\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenPolicy2_r(b, tctx, &r),
+				   "OpenPolicy2 failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
+		    NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
+			torture_comment(tctx, "not considering %s to be an error\n",
+					nt_errstr(r.out.result));
 			talloc_free(*handle);
 			*handle = NULL;
 			return true;
 		}
-		torture_comment(tctx, "OpenPolicy2 failed - %s\n", nt_errstr(status));
+		torture_comment(tctx, "OpenPolicy2 failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -158,7 +162,6 @@ static bool test_LookupNames(struct dcerpc_binding_handle *b,
 	struct lsa_RefDomainList *domains = NULL;
 	struct lsa_String *names;
 	uint32_t count = 0;
-	NTSTATUS status;
 	int i;
 
 	torture_comment(tctx, "\nTesting LookupNames with %d names\n", tnames->count);
@@ -181,10 +184,10 @@ static bool test_LookupNames(struct dcerpc_binding_handle *b,
 	r.out.sids = &sids;
 	r.out.domains = &domains;
 
-	status = dcerpc_lsa_LookupNames_r(b, tctx, &r);
-
-	if (NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED) ||
-	    NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
+				   "LookupNames failed");
+	if (NT_STATUS_EQUAL(r.out.result, STATUS_SOME_UNMAPPED) ||
+	    NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
 		for (i=0;i< tnames->count;i++) {
 			if (i < count && sids.sids[i].sid_type == SID_NAME_UNKNOWN) {
 				torture_comment(tctx, "LookupName of %s was unmapped\n",
@@ -194,10 +197,12 @@ static bool test_LookupNames(struct dcerpc_binding_handle *b,
 				       tnames->names[i].name.string);
 			}
 		}
-		torture_comment(tctx, "LookupNames failed - %s\n", nt_errstr(status));
+		torture_comment(tctx, "LookupNames failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
-	} else if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "LookupNames failed - %s\n", nt_errstr(status));
+	} else if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "LookupNames failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -234,7 +239,6 @@ static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b,
 	struct lsa_RefDomainList *domains = NULL;
 	struct lsa_String names[1];
 	uint32_t count = 0;
-	NTSTATUS status;
 
 	torture_comment(tctx, "\nTesting LookupNames with bogus name\n");
 
@@ -253,9 +257,11 @@ static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b,
 	r.out.sids = &sids;
 	r.out.domains = &domains;
 
-	status = dcerpc_lsa_LookupNames_r(b, tctx, &r);
-	if (!NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
-		torture_comment(tctx, "LookupNames failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
+				   "LookupNames bogus failed");
+	if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_NONE_MAPPED)) {
+		torture_comment(tctx, "LookupNames failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -300,6 +306,8 @@ static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b,
 
 	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames_r(b, tctx, &r),
 		"LookupNames with NULL name failed");
+	torture_assert_ntstatus_ok(tctx, r.out.result,
+		"LookupNames with NULL name failed");
 
 	torture_comment(tctx, "\n");
 
@@ -367,7 +375,6 @@ static bool test_LookupNames2(struct dcerpc_binding_handle *b,
 	struct lsa_RefDomainList *domains = NULL;
 	struct lsa_String *names;
 	uint32_t count = 0;
-	NTSTATUS status;
 	int i;
 
 	torture_comment(tctx, "\nTesting LookupNames2 with %d names\n", tnames->count);
@@ -392,9 +399,11 @@ static bool test_LookupNames2(struct dcerpc_binding_handle *b,
 	r.out.sids = &sids;
 	r.out.domains = &domains;
 
-	status = dcerpc_lsa_LookupNames2_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "LookupNames2 failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames2_r(b, tctx, &r),
+		"LookupNames2 failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "LookupNames2 failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -423,7 +432,6 @@ static bool test_LookupNames3(struct dcerpc_binding_handle *b,
 	struct lsa_RefDomainList *domains = NULL;
 	struct lsa_String *names;
 	uint32_t count = 0;
-	NTSTATUS status;
 	int i;
 
 	torture_comment(tctx, "\nTesting LookupNames3 with %d names\n", tnames->count);
@@ -448,9 +456,11 @@ static bool test_LookupNames3(struct dcerpc_binding_handle *b,
 	r.out.sids = &sids;
 	r.out.domains = &domains;
 
-	status = dcerpc_lsa_LookupNames3_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "LookupNames3 failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames3_r(b, tctx, &r),
+		"LookupNames3 failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "LookupNames3 failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -477,7 +487,6 @@ static bool test_LookupNames4(struct dcerpc_binding_handle *b,
 	struct lsa_RefDomainList *domains = NULL;
 	struct lsa_String *names;
 	uint32_t count = 0;
-	NTSTATUS status;
 	int i;
 
 	torture_comment(tctx, "\nTesting LookupNames4 with %d names\n", tnames->count);
@@ -501,9 +510,11 @@ static bool test_LookupNames4(struct dcerpc_binding_handle *b,
 	r.out.sids = &sids;
 	r.out.domains = &domains;
 
-	status = dcerpc_lsa_LookupNames4_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "LookupNames4 failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupNames4_r(b, tctx, &r),
+		"LookupNames4 failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "LookupNames4 failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -530,7 +541,6 @@ static bool test_LookupSids(struct dcerpc_binding_handle *b,
 	struct lsa_TransNameArray names;
 	struct lsa_RefDomainList *domains = NULL;
 	uint32_t count = sids->num_sids;
-	NTSTATUS status;
 
 	torture_comment(tctx, "\nTesting LookupSids\n");
 
@@ -546,9 +556,11 @@ static bool test_LookupSids(struct dcerpc_binding_handle *b,
 	r.out.names = &names;
 	r.out.domains = &domains;
 
-	status = dcerpc_lsa_LookupSids_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "LookupSids failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids_r(b, tctx, &r),
+		"LookupSids failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "LookupSids failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -571,7 +583,6 @@ static bool test_LookupSids2(struct dcerpc_binding_handle *b,
 	struct lsa_TransNameArray2 names;
 	struct lsa_RefDomainList *domains = NULL;
 	uint32_t count = sids->num_sids;
-	NTSTATUS status;
 
 	torture_comment(tctx, "\nTesting LookupSids2\n");
 
@@ -589,9 +600,11 @@ static bool test_LookupSids2(struct dcerpc_binding_handle *b,
 	r.out.names = &names;
 	r.out.domains = &domains;
 
-	status = dcerpc_lsa_LookupSids2_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "LookupSids2 failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids2_r(b, tctx, &r),
+		"LookupSids2 failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "LookupSids2 failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -616,7 +629,6 @@ static bool test_LookupSids3(struct dcerpc_binding_handle *b,
 	struct lsa_TransNameArray2 names;
 	struct lsa_RefDomainList *domains = NULL;
 	uint32_t count = sids->num_sids;
-	NTSTATUS status;
 
 	torture_comment(tctx, "\nTesting LookupSids3\n");
 
@@ -633,15 +645,17 @@ static bool test_LookupSids3(struct dcerpc_binding_handle *b,
 	r.out.count = &count;
 	r.out.names = &names;
 
-	status = dcerpc_lsa_LookupSids3_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
-		    NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
-			torture_comment(tctx, "not considering %s to be an error\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids3_r(b, tctx, &r),
+		"LookupSids3 failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
+		    NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
+			torture_comment(tctx, "not considering %s to be an error\n",
+					nt_errstr(r.out.result));
 			return true;
 		}
 		torture_comment(tctx, "LookupSids3 failed - %s - not considered an error\n",
-		       nt_errstr(status));
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -659,7 +673,6 @@ bool test_many_LookupSids(struct dcerpc_pipe *p,
 			  struct policy_handle *handle)
 {
 	uint32_t count;
-	NTSTATUS status;
 	struct lsa_SidArray sids;
 	int i;
 	struct dcerpc_binding_handle *b = p->binding_handle;
@@ -693,9 +706,11 @@ bool test_many_LookupSids(struct dcerpc_pipe *p,
 		r.out.names = &names;
 		r.out.domains = &domains;
 
-		status = dcerpc_lsa_LookupSids_r(b, tctx, &r);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "LookupSids failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids_r(b, tctx, &r),
+			"LookupSids failed");
+		if (!NT_STATUS_IS_OK(r.out.result)) {
+			torture_comment(tctx, "LookupSids failed - %s\n",
+					nt_errstr(r.out.result));
 			return false;
 		}
 
@@ -725,15 +740,17 @@ bool test_many_LookupSids(struct dcerpc_pipe *p,
 		r.out.names = &names;
 		r.out.domains = &domains;
 
-		status = dcerpc_lsa_LookupSids3_r(b, tctx, &r);
-		if (!NT_STATUS_IS_OK(status)) {
-			if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
-			    NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
-				torture_comment(tctx, "not considering %s to be an error\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupSids3_r(b, tctx, &r),
+			"LookupSids3 failed");
+		if (!NT_STATUS_IS_OK(r.out.result)) {
+			if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_ACCESS_DENIED) ||
+			    NT_STATUS_EQUAL(r.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
+				torture_comment(tctx, "not considering %s to be an error\n",
+						nt_errstr(r.out.result));
 				return true;
 			}
 			torture_comment(tctx, "LookupSids3 failed - %s\n",
-			       nt_errstr(status));
+					nt_errstr(r.out.result));
 			return false;
 		}
 		if (!test_LookupNames4(b, tctx, &names, false)) {
@@ -835,7 +852,6 @@ static bool test_LookupPrivValue(struct dcerpc_binding_handle *b,
 				 struct policy_handle *handle,
 				 struct lsa_String *name)
 {
-	NTSTATUS status;
 	struct lsa_LookupPrivValue r;
 	struct lsa_LUID luid;
 
@@ -843,9 +859,11 @@ static bool test_LookupPrivValue(struct dcerpc_binding_handle *b,
 	r.in.name = name;
 	r.out.luid = &luid;
 
-	status = dcerpc_lsa_LookupPrivValue_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "\nLookupPrivValue failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivValue_r(b, tctx, &r),
+		"LookupPrivValue failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "\nLookupPrivValue failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -857,7 +875,6 @@ static bool test_LookupPrivName(struct dcerpc_binding_handle *b,
 				struct policy_handle *handle,
 				struct lsa_LUID *luid)
 {
-	NTSTATUS status;
 	struct lsa_LookupPrivName r;
 	struct lsa_StringLarge *name = NULL;
 
@@ -865,9 +882,11 @@ static bool test_LookupPrivName(struct dcerpc_binding_handle *b,
 	r.in.luid = luid;
 	r.out.name = &name;
 
-	status = dcerpc_lsa_LookupPrivName_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "\nLookupPrivName failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivName_r(b, tctx, &r),
+		"LookupPrivName failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "\nLookupPrivName failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -880,7 +899,6 @@ static bool test_RemovePrivilegesFromAccount(struct dcerpc_binding_handle *b,
 					     struct policy_handle *acct_handle,
 					     struct lsa_LUID *luid)
 {
-	NTSTATUS status;
 	struct lsa_RemovePrivilegesFromAccount r;
 	struct lsa_PrivilegeSet privs;
 	bool ret = true;
@@ -897,8 +915,9 @@ static bool test_RemovePrivilegesFromAccount(struct dcerpc_binding_handle *b,
 	privs.set[0].luid = *luid;
 	privs.set[0].attribute = 0;
 
-	status = dcerpc_lsa_RemovePrivilegesFromAccount_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_RemovePrivilegesFromAccount_r(b, tctx, &r),
+		"RemovePrivilegesFromAccount failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
 
 		struct lsa_LookupPrivName r_name;
 		struct lsa_StringLarge *name = NULL;
@@ -907,9 +926,11 @@ static bool test_RemovePrivilegesFromAccount(struct dcerpc_binding_handle *b,
 		r_name.in.luid = luid;
 		r_name.out.name = &name;
 
-		status = dcerpc_lsa_LookupPrivName_r(b, tctx, &r_name);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "\nLookupPrivName failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivName_r(b, tctx, &r_name),
+			"LookupPrivName failed");
+		if (!NT_STATUS_IS_OK(r_name.out.result)) {
+			torture_comment(tctx, "\nLookupPrivName failed - %s\n",
+					nt_errstr(r_name.out.result));
 			return false;
 		}
 		/* Windows 2008 does not allow this to be removed */
@@ -919,7 +940,7 @@ static bool test_RemovePrivilegesFromAccount(struct dcerpc_binding_handle *b,
 
 		torture_comment(tctx, "RemovePrivilegesFromAccount failed to remove %s - %s\n",
 		       name->string,
-		       nt_errstr(status));
+		       nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -931,7 +952,6 @@ static bool test_AddPrivilegesToAccount(struct dcerpc_binding_handle *b,
 					struct policy_handle *acct_handle,
 					struct lsa_LUID *luid)
 {
-	NTSTATUS status;
 	struct lsa_AddPrivilegesToAccount r;
 	struct lsa_PrivilegeSet privs;
 	bool ret = true;
@@ -947,9 +967,11 @@ static bool test_AddPrivilegesToAccount(struct dcerpc_binding_handle *b,
 	privs.set[0].luid = *luid;
 	privs.set[0].attribute = 0;
 
-	status = dcerpc_lsa_AddPrivilegesToAccount_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "AddPrivilegesToAccount failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_AddPrivilegesToAccount_r(b, tctx, &r),
+		"AddPrivilegesToAccount failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "AddPrivilegesToAccount failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -961,7 +983,6 @@ static bool test_EnumPrivsAccount(struct dcerpc_binding_handle *b,
 				  struct policy_handle *handle,
 				  struct policy_handle *acct_handle)
 {
-	NTSTATUS status;
 	struct lsa_EnumPrivsAccount r;
 	struct lsa_PrivilegeSet *privs = NULL;
 	bool ret = true;
@@ -971,9 +992,11 @@ static bool test_EnumPrivsAccount(struct dcerpc_binding_handle *b,
 	r.in.handle = acct_handle;
 	r.out.privs = &privs;
 
-	status = dcerpc_lsa_EnumPrivsAccount_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "EnumPrivsAccount failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumPrivsAccount_r(b, tctx, &r),
+		"EnumPrivsAccount failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "EnumPrivsAccount failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -998,7 +1021,6 @@ static bool test_GetSystemAccessAccount(struct dcerpc_binding_handle *b,
 					struct policy_handle *handle,
 					struct policy_handle *acct_handle)
 {
-	NTSTATUS status;
 	uint32_t access_mask;
 	struct lsa_GetSystemAccessAccount r;
 
@@ -1007,9 +1029,11 @@ static bool test_GetSystemAccessAccount(struct dcerpc_binding_handle *b,
 	r.in.handle = acct_handle;
 	r.out.access_mask = &access_mask;
 
-	status = dcerpc_lsa_GetSystemAccessAccount_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "GetSystemAccessAccount failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetSystemAccessAccount_r(b, tctx, &r),
+		"GetSystemAccessAccount failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "GetSystemAccessAccount failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1051,15 +1075,15 @@ static bool test_Delete(struct dcerpc_binding_handle *b,
 			struct torture_context *tctx,
 			struct policy_handle *handle)
 {
-	NTSTATUS status;
 	struct lsa_Delete r;
 
 	torture_comment(tctx, "\nTesting Delete\n");
 
 	r.in.handle = handle;
-	status = dcerpc_lsa_Delete_r(b, tctx, &r);
-	if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
-		torture_comment(tctx, "Delete should have failed NT_STATUS_NOT_SUPPORTED - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Delete_r(b, tctx, &r),
+		"Delete failed");
+	if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_NOT_SUPPORTED)) {
+		torture_comment(tctx, "Delete should have failed NT_STATUS_NOT_SUPPORTED - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1070,16 +1094,17 @@ static bool test_DeleteObject(struct dcerpc_binding_handle *b,
 			      struct torture_context *tctx,
 			      struct policy_handle *handle)
 {
-	NTSTATUS status;
 	struct lsa_DeleteObject r;
 
 	torture_comment(tctx, "\nTesting DeleteObject\n");
 
 	r.in.handle = handle;
 	r.out.handle = handle;
-	status = dcerpc_lsa_DeleteObject_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "DeleteObject failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(b, tctx, &r),
+		"DeleteObject failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "DeleteObject failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1091,7 +1116,6 @@ static bool test_CreateAccount(struct dcerpc_binding_handle *b,
 			       struct torture_context *tctx,
 			       struct policy_handle *handle)
 {
-	NTSTATUS status;
 	struct lsa_CreateAccount r;
 	struct dom_sid2 *newsid;
 	struct policy_handle acct_handle;
@@ -1105,21 +1129,25 @@ static bool test_CreateAccount(struct dcerpc_binding_handle *b,
 	r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 	r.out.acct_handle = &acct_handle;
 
-	status = dcerpc_lsa_CreateAccount_r(b, tctx, &r);
-	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateAccount_r(b, tctx, &r),
+		"CreateAccount failed");
+	if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
 		struct lsa_OpenAccount r_o;
 		r_o.in.handle = handle;
 		r_o.in.sid = newsid;
 		r_o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 		r_o.out.acct_handle = &acct_handle;
 
-		status = dcerpc_lsa_OpenAccount_r(b, tctx, &r_o);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "OpenAccount failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(b, tctx, &r_o),
+			"OpenAccount failed");
+		if (!NT_STATUS_IS_OK(r_o.out.result)) {
+			torture_comment(tctx, "OpenAccount failed - %s\n",
+					nt_errstr(r_o.out.result));
 			return false;
 		}
-	} else if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "CreateAccount failed - %s\n", nt_errstr(status));
+	} else if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "CreateAccount failed - %s\n",
+				nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1139,7 +1167,6 @@ static bool test_DeleteTrustedDomain(struct dcerpc_binding_handle *b,
 				     struct policy_handle *handle,
 				     struct lsa_StringLarge name)
 {
-	NTSTATUS status;
 	struct lsa_OpenTrustedDomainByName r;
 	struct policy_handle trustdom_handle;
 
@@ -1148,9 +1175,10 @@ static bool test_DeleteTrustedDomain(struct dcerpc_binding_handle *b,
 	r.in.access_mask = SEC_STD_DELETE;
 	r.out.trustdom_handle = &trustdom_handle;
 
-	status = dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &r),
+		"OpenTrustedDomainByName failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1170,15 +1198,15 @@ static bool test_DeleteTrustedDomainBySid(struct dcerpc_binding_handle *b,
 					  struct policy_handle *handle,
 					  struct dom_sid *sid)
 {
-	NTSTATUS status;
 	struct lsa_DeleteTrustedDomain r;
 
 	r.in.handle = handle;
 	r.in.dom_sid = sid;
 
-	status = dcerpc_lsa_DeleteTrustedDomain_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "DeleteTrustedDomain failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteTrustedDomain_r(b, tctx, &r),
+		"DeleteTrustedDomain failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "DeleteTrustedDomain failed - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1233,9 +1261,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 		r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 		r.out.sec_handle = &sec_handle;
 
-		status = dcerpc_lsa_CreateSecret_r(b, tctx, &r);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "CreateSecret failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r),
+			"CreateSecret failed");
+		if (!NT_STATUS_IS_OK(r.out.result)) {
+			torture_comment(tctx, "CreateSecret failed - %s\n", nt_errstr(r.out.result));
 			return false;
 		}
 
@@ -1243,9 +1272,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 		r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 		r.out.sec_handle = &sec_handle3;
 
-		status = dcerpc_lsa_CreateSecret_r(b, tctx, &r);
-		if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
-			torture_comment(tctx, "CreateSecret should have failed OBJECT_NAME_COLLISION - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r),
+			"CreateSecret failed");
+		if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
+			torture_comment(tctx, "CreateSecret should have failed OBJECT_NAME_COLLISION - %s\n", nt_errstr(r.out.result));
 			return false;
 		}
 
@@ -1256,9 +1286,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 
 		torture_comment(tctx, "Testing OpenSecret\n");
 
-		status = dcerpc_lsa_OpenSecret_r(b, tctx, &r2);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "OpenSecret failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenSecret_r(b, tctx, &r2),
+			"OpenSecret failed");
+		if (!NT_STATUS_IS_OK(r2.out.result)) {
+			torture_comment(tctx, "OpenSecret failed - %s\n", nt_errstr(r2.out.result));
 			return false;
 		}
 
@@ -1279,9 +1310,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 
 		torture_comment(tctx, "Testing SetSecret\n");
 
-		status = dcerpc_lsa_SetSecret_r(b, tctx, &r3);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
+			"SetSecret failed");
+		if (!NT_STATUS_IS_OK(r3.out.result)) {
+			torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r3.out.result));
 			return false;
 		}
 
@@ -1297,9 +1329,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 
 		torture_comment(tctx, "Testing SetSecret with broken key\n");
 
-		status = dcerpc_lsa_SetSecret_r(b, tctx, &r3);
-		if (!NT_STATUS_EQUAL(status, NT_STATUS_UNKNOWN_REVISION)) {
-			torture_comment(tctx, "SetSecret should have failed UNKNOWN_REVISION - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3),
+			"SetSecret failed");
+		if (!NT_STATUS_EQUAL(r3.out.result, NT_STATUS_UNKNOWN_REVISION)) {
+			torture_comment(tctx, "SetSecret should have failed UNKNOWN_REVISION - %s\n", nt_errstr(r3.out.result));
 			ret = false;
 		}
 
@@ -1318,9 +1351,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 		bufp1.buf = NULL;
 
 		torture_comment(tctx, "Testing QuerySecret\n");
-		status = dcerpc_lsa_QuerySecret_r(b, tctx, &r4);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r4),
+			"QuerySecret failed");
+		if (!NT_STATUS_IS_OK(r4.out.result)) {
+			torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r4.out.result));
 			ret = false;
 		} else {
 			if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) {
@@ -1356,9 +1390,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 		msleep(200);
 		torture_comment(tctx, "Testing SetSecret (existing value should move to old)\n");
 
-		status = dcerpc_lsa_SetSecret_r(b, tctx, &r5);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r5),
+			"SetSecret failed");
+		if (!NT_STATUS_IS_OK(r5.out.result)) {
+			torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r5.out.result));
 			ret = false;
 		}
 
@@ -1377,9 +1412,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 		bufp1.buf = NULL;
 		bufp2.buf = NULL;
 
-		status = dcerpc_lsa_QuerySecret_r(b, tctx, &r6);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r6),
+			"QuerySecret failed");
+		if (!NT_STATUS_IS_OK(r6.out.result)) {
+			torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r6.out.result));
 			ret = false;
 			secret4 = NULL;
 		} else {
@@ -1438,9 +1474,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 
 		torture_comment(tctx, "Testing SetSecret of old Secret only\n");
 
-		status = dcerpc_lsa_SetSecret_r(b, tctx, &r7);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r7),
+			"SetSecret failed");
+		if (!NT_STATUS_IS_OK(r7.out.result)) {
+			torture_comment(tctx, "SetSecret failed - %s\n", nt_errstr(r7.out.result));
 			ret = false;
 		}
 
@@ -1456,9 +1493,10 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 		bufp1.buf = NULL;
 		bufp2.buf = NULL;
 
-		status = dcerpc_lsa_QuerySecret_r(b, tctx, &r8);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r8),
+			"QuerySecret failed");
+		if (!NT_STATUS_IS_OK(r8.out.result)) {
+			torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(r8.out.result));
 			ret = false;
 		} else {
 			if (!r8.out.new_val || !r8.out.old_val) {
@@ -1507,17 +1545,19 @@ static bool test_CreateSecret(struct dcerpc_pipe *p,
 
 		d_o.in.handle = &sec_handle2;
 		d_o.out.handle = &sec_handle2;
-		status = dcerpc_lsa_DeleteObject_r(b, tctx, &d_o);
-		if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
-			torture_comment(tctx, "Second delete expected INVALID_HANDLE - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_DeleteObject_r(b, tctx, &d_o),
+			"DeleteObject failed");
+		if (!NT_STATUS_EQUAL(d_o.out.result, NT_STATUS_INVALID_HANDLE)) {
+			torture_comment(tctx, "Second delete expected INVALID_HANDLE - %s\n", nt_errstr(d_o.out.result));
 			ret = false;
 		} else {
 
 			torture_comment(tctx, "Testing OpenSecret of just-deleted secret\n");
 
-			status = dcerpc_lsa_OpenSecret_r(b, tctx, &r2);
-			if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
-				torture_comment(tctx, "OpenSecret expected OBJECT_NAME_NOT_FOUND - %s\n", nt_errstr(status));
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenSecret_r(b, tctx, &r2),
+				"OpenSecret failed");
+			if (!NT_STATUS_EQUAL(r2.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+				torture_comment(tctx, "OpenSecret expected OBJECT_NAME_NOT_FOUND - %s\n", nt_errstr(r2.out.result));
 				ret = false;
 			}
 		}
@@ -1533,7 +1573,6 @@ static bool test_EnumAccountRights(struct dcerpc_binding_handle *b,
 				   struct policy_handle *acct_handle,
 				   struct dom_sid *sid)
 {
-	NTSTATUS status;
 	struct lsa_EnumAccountRights r;
 	struct lsa_RightSet rights;
 
@@ -1543,10 +1582,11 @@ static bool test_EnumAccountRights(struct dcerpc_binding_handle *b,
 	r.in.sid = sid;
 	r.out.rights = &rights;
 
-	status = dcerpc_lsa_EnumAccountRights_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountRights_r(b, tctx, &r),
+		"EnumAccountRights failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
 		torture_comment(tctx, "EnumAccountRights of %s failed - %s\n",
-		       dom_sid_string(tctx, sid), nt_errstr(status));
+		       dom_sid_string(tctx, sid), nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1559,7 +1599,6 @@ static bool test_QuerySecurity(struct dcerpc_binding_handle *b,
 			     struct policy_handle *handle,
 			     struct policy_handle *acct_handle)
 {
-	NTSTATUS status;
 	struct lsa_QuerySecurity r;
 	struct sec_desc_buf *sdbuf = NULL;
 
@@ -1576,9 +1615,10 @@ static bool test_QuerySecurity(struct dcerpc_binding_handle *b,
 			SECINFO_DACL;
 	r.out.sdbuf = &sdbuf;
 
-	status = dcerpc_lsa_QuerySecurity_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "QuerySecurity failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecurity_r(b, tctx, &r),
+		"QuerySecurity failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "QuerySecurity failed - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1590,7 +1630,6 @@ static bool test_OpenAccount(struct dcerpc_binding_handle *b,
 			     struct policy_handle *handle,
 			     struct dom_sid *sid)
 {
-	NTSTATUS status;
 	struct lsa_OpenAccount r;
 	struct policy_handle acct_handle;
 
@@ -1601,9 +1640,10 @@ static bool test_OpenAccount(struct dcerpc_binding_handle *b,
 	r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 	r.out.acct_handle = &acct_handle;
 
-	status = dcerpc_lsa_OpenAccount_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "OpenAccount failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenAccount_r(b, tctx, &r),
+		"OpenAccount failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "OpenAccount failed - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1626,7 +1666,6 @@ static bool test_EnumAccounts(struct dcerpc_binding_handle *b,
 			      struct torture_context *tctx,
 			      struct policy_handle *handle)
 {
-	NTSTATUS status;
 	struct lsa_EnumAccounts r;
 	struct lsa_SidArray sids1, sids2;
 	uint32_t resume_handle = 0;
@@ -1643,12 +1682,13 @@ static bool test_EnumAccounts(struct dcerpc_binding_handle *b,
 
 	resume_handle = 0;
 	while (true) {
-		status = dcerpc_lsa_EnumAccounts_r(b, tctx, &r);
-		if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(b, tctx, &r),
+			"EnumAccounts failed");
+		if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
 			break;
 		}
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(status));
+		if (!NT_STATUS_IS_OK(r.out.result)) {
+			torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(r.out.result));
 			return false;
 		}
 
@@ -1681,9 +1721,10 @@ static bool test_EnumAccounts(struct dcerpc_binding_handle *b,
 	r.in.num_entries = 1;
 	r.out.sids = &sids2;
 
-	status = dcerpc_lsa_EnumAccounts_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccounts_r(b, tctx, &r),
+		"EnumAccounts failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "EnumAccounts failed - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1701,7 +1742,6 @@ static bool test_LookupPrivDisplayName(struct dcerpc_binding_handle *b,
 				       struct lsa_String *priv_name)
 {
 	struct lsa_LookupPrivDisplayName r;
-	NTSTATUS status;
 	/* produce a reasonable range of language output without screwing up
 	   terminals */
 	uint16_t language_id = (random() % 4) + 0x409;
@@ -1717,9 +1757,10 @@ static bool test_LookupPrivDisplayName(struct dcerpc_binding_handle *b,
 	r.out.returned_language_id = &returned_language_id;
 	r.out.disp_name = &disp_name;
 
-	status = dcerpc_lsa_LookupPrivDisplayName_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "LookupPrivDisplayName failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_LookupPrivDisplayName_r(b, tctx, &r),
+		"LookupPrivDisplayName failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "LookupPrivDisplayName failed - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 	torture_comment(tctx, "%s -> \"%s\"  (language 0x%x/0x%x)\n",
@@ -1736,7 +1777,6 @@ static bool test_EnumAccountsWithUserRight(struct dcerpc_binding_handle *b,
 {
 	struct lsa_EnumAccountsWithUserRight r;
 	struct lsa_SidArray sids;
-	NTSTATUS status;
 
 	ZERO_STRUCT(sids);
 
@@ -1746,15 +1786,16 @@ static bool test_EnumAccountsWithUserRight(struct dcerpc_binding_handle *b,
 	r.in.name = priv_name;
 	r.out.sids = &sids;
 
-	status = dcerpc_lsa_EnumAccountsWithUserRight_r(b, tctx, &r);
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumAccountsWithUserRight_r(b, tctx, &r),
+		"EnumAccountsWithUserRight failed");
 
 	/* NT_STATUS_NO_MORE_ENTRIES means noone has this privilege */
-	if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
+	if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
 		return true;
 	}
 
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "EnumAccountsWithUserRight failed - %s\n", nt_errstr(status));
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "EnumAccountsWithUserRight failed - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1766,7 +1807,6 @@ static bool test_EnumPrivs(struct dcerpc_binding_handle *b,
 			   struct torture_context *tctx,
 			   struct policy_handle *handle)
 {
-	NTSTATUS status;
 	struct lsa_EnumPrivs r;
 	struct lsa_PrivArray privs1;
 	uint32_t resume_handle = 0;
@@ -1782,9 +1822,10 @@ static bool test_EnumPrivs(struct dcerpc_binding_handle *b,
 	r.out.privs = &privs1;
 
 	resume_handle = 0;
-	status = dcerpc_lsa_EnumPrivs_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "EnumPrivs failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumPrivs_r(b, tctx, &r),
+		"EnumPrivs failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "EnumPrivs failed - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -1806,7 +1847,6 @@ static bool test_QueryForestTrustInformation(struct dcerpc_binding_handle *b,
 {
 	bool ret = true;
 	struct lsa_lsaRQueryForestTrustInformation r;
-	NTSTATUS status;
 	struct lsa_String string;
 	struct lsa_ForestTrustInformation info, *info_ptr;
 
@@ -1830,10 +1870,11 @@ static bool test_QueryForestTrustInformation(struct dcerpc_binding_handle *b,
 	r.in.unknown = 0;
 	r.out.forest_trust_info = &info_ptr;
 
-	status = dcerpc_lsa_lsaRQueryForestTrustInformation_r(b, tctx, &r);
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_lsaRQueryForestTrustInformation_r(b, tctx, &r),
+		"lsaRQueryForestTrustInformation failed");
 
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "lsaRQueryForestTrustInformation of %s failed - %s\n", trusted_domain_name, nt_errstr(status));
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "lsaRQueryForestTrustInformation of %s failed - %s\n", trusted_domain_name, nt_errstr(r.out.result));
 		ret = false;
 	}
 
@@ -1864,7 +1905,6 @@ static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
 				     struct policy_handle *handle,
 				     struct lsa_DomainList *domains)
 {
-	NTSTATUS status;
 	int i,j;
 	bool ret = true;
 
@@ -1885,10 +1925,11 @@ static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
 			trust.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 			trust.out.trustdom_handle = &trustdom_handle;
 
-			status = dcerpc_lsa_OpenTrustedDomain_r(b, tctx, &trust);
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomain_r(b, tctx, &trust),
+				"OpenTrustedDomain failed");
 
-			if (!NT_STATUS_IS_OK(status)) {
-				torture_comment(tctx, "OpenTrustedDomain failed - %s\n", nt_errstr(status));
+			if (!NT_STATUS_IS_OK(trust.out.result)) {
+				torture_comment(tctx, "OpenTrustedDomain failed - %s\n", nt_errstr(trust.out.result));
 				return false;
 			}
 
@@ -1904,30 +1945,33 @@ static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
 				q.in.trustdom_handle = &trustdom_handle;
 				q.in.level = levels[j];
 				q.out.info = &info;
-				status = dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q);
-				if (!NT_STATUS_IS_OK(status) && ok[j]) {
+				torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
+					"QueryTrustedDomainInfo failed");
+				if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
 					torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n",
-					       levels[j], nt_errstr(status));
+					       levels[j], nt_errstr(q.out.result));
 					ret = false;
-				} else if (NT_STATUS_IS_OK(status) && !ok[j]) {
+				} else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
 					torture_comment(tctx, "QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
-					       levels[j], nt_errstr(status));
+					       levels[j], nt_errstr(q.out.result));
 					ret = false;
 				}
 			}
 
-			status = dcerpc_lsa_CloseTrustedDomainEx_r(b, tctx, &c_trust);
-			if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
-				torture_comment(tctx, "Expected CloseTrustedDomainEx to return NT_STATUS_NOT_IMPLEMENTED, instead - %s\n", nt_errstr(status));
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CloseTrustedDomainEx_r(b, tctx, &c_trust),
+				"CloseTrustedDomainEx failed");
+			if (!NT_STATUS_EQUAL(c_trust.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
+				torture_comment(tctx, "Expected CloseTrustedDomainEx to return NT_STATUS_NOT_IMPLEMENTED, instead - %s\n", nt_errstr(c_trust.out.result));
 				return false;
 			}
 
 			c.in.handle = &trustdom_handle;
 			c.out.handle = &handle2;
 
-			status = dcerpc_lsa_Close_r(b, tctx, &c);
-			if (!NT_STATUS_IS_OK(status)) {
-				torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(status));
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &c),
+				"Close failed");
+			if (!NT_STATUS_IS_OK(c.out.result)) {
+				torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(c.out.result));
 				return false;
 			}
 
@@ -1944,14 +1988,15 @@ static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
 				q.in.level   = levels[j];
 				q.out.info   = &info;
 
-				status = dcerpc_lsa_QueryTrustedDomainInfoBySid_r(b, tctx, &q);
-				if (!NT_STATUS_IS_OK(status) && ok[j]) {
+				torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfoBySid_r(b, tctx, &q),
+					"lsa_QueryTrustedDomainInfoBySid failed");
+				if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
 					torture_comment(tctx, "QueryTrustedDomainInfoBySid level %d failed - %s\n",
-					       levels[j], nt_errstr(status));
+					       levels[j], nt_errstr(q.out.result));
 					ret = false;
-				} else if (NT_STATUS_IS_OK(status) && !ok[j]) {
+				} else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
 					torture_comment(tctx, "QueryTrustedDomainInfoBySid level %d unexpectedly succeeded - %s\n",
-					       levels[j], nt_errstr(status));
+					       levels[j], nt_errstr(q.out.result));
 					ret = false;
 				}
 			}
@@ -1962,10 +2007,11 @@ static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
 		trust_by_name.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 		trust_by_name.out.trustdom_handle = &trustdom_handle;
 
-		status = dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &trust_by_name);
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_OpenTrustedDomainByName_r(b, tctx, &trust_by_name),
+			"OpenTrustedDomainByName failed");
 
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(status));
+		if (!NT_STATUS_IS_OK(trust_by_name.out.result)) {
+			torture_comment(tctx, "OpenTrustedDomainByName failed - %s\n", nt_errstr(trust_by_name.out.result));
 			return false;
 		}
 
@@ -1975,14 +2021,15 @@ static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
 			q.in.trustdom_handle = &trustdom_handle;
 			q.in.level = levels[j];
 			q.out.info = &info;
-			status = dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q);
-			if (!NT_STATUS_IS_OK(status) && ok[j]) {
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
+				"QueryTrustedDomainInfo failed");
+			if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
 				torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n",
-				       levels[j], nt_errstr(status));
+				       levels[j], nt_errstr(q.out.result));
 				ret = false;
-			} else if (NT_STATUS_IS_OK(status) && !ok[j]) {
+			} else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
 				torture_comment(tctx, "QueryTrustedDomainInfo level %d unexpectedly succeeded - %s\n",
-				       levels[j], nt_errstr(status));
+				       levels[j], nt_errstr(q.out.result));
 				ret = false;
 			}
 		}
@@ -1990,9 +2037,10 @@ static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
 		c.in.handle = &trustdom_handle;
 		c.out.handle = &handle2;
 
-		status = dcerpc_lsa_Close_r(b, tctx, &c);
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(status));
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &c),
+			"Close failed");
+		if (!NT_STATUS_IS_OK(c.out.result)) {
+			torture_comment(tctx, "Close of trusted domain failed - %s\n", nt_errstr(c.out.result));
 			return false;
 		}
 
@@ -2007,14 +2055,15 @@ static bool test_query_each_TrustDom(struct dcerpc_binding_handle *b,
 			q.in.trusted_domain = &name;
 			q.in.level          = levels[j];
 			q.out.info          = &info;
-			status = dcerpc_lsa_QueryTrustedDomainInfoByName_r(b, tctx, &q);
-			if (!NT_STATUS_IS_OK(status) && ok[j]) {
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfoByName_r(b, tctx, &q),
+				"QueryTrustedDomainInfoByName failed");
+			if (!NT_STATUS_IS_OK(q.out.result) && ok[j]) {
 				torture_comment(tctx, "QueryTrustedDomainInfoByName level %d failed - %s\n",
-				       levels[j], nt_errstr(status));
+				       levels[j], nt_errstr(q.out.result));
 				ret = false;
-			} else if (NT_STATUS_IS_OK(status) && !ok[j]) {
+			} else if (NT_STATUS_IS_OK(q.out.result) && !ok[j]) {
 				torture_comment(tctx, "QueryTrustedDomainInfoByName level %d unexpectedly succeeded - %s\n",
-				       levels[j], nt_errstr(status));
+				       levels[j], nt_errstr(q.out.result));
 				ret = false;
 			}
 		}
@@ -2027,7 +2076,6 @@ static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
 			      struct policy_handle *handle)
 {
 	struct lsa_EnumTrustDom r;
-	NTSTATUS enum_status;
 	uint32_t in_resume_handle = 0;
 	uint32_t out_resume_handle;
 	struct lsa_DomainList domains;
@@ -2041,7 +2089,8 @@ static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
 	r.out.domains = &domains;
 	r.out.resume_handle = &out_resume_handle;
 
-	enum_status = dcerpc_lsa_EnumTrustDom_r(b, tctx, &r);
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustDom_r(b, tctx, &r),
+		"lsa_EnumTrustDom failed");
 
 	/* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
 	 * always be larger than the previous input resume handle, in
@@ -2050,9 +2099,9 @@ static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
 	 * seen e.g.  with Windows XP SP3 when resume handle is 0 and
 	 * status is NT_STATUS_OK - gd */
 
-	if (NT_STATUS_IS_OK(enum_status) ||
-	    NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES) ||
-	    NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES))
+	if (NT_STATUS_IS_OK(r.out.result) ||
+	    NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES) ||
+	    NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES))
 	{
 		if (out_resume_handle <= in_resume_handle) {
 			torture_comment(tctx, "EnumTrustDom failed - should have returned output resume_handle (0x%08x) larger than input resume handle (0x%08x)\n",
@@ -2061,13 +2110,13 @@ static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
 		}
 	}
 
-	if (NT_STATUS_IS_OK(enum_status)) {
+	if (NT_STATUS_IS_OK(r.out.result)) {
 		if (domains.count == 0) {
 			torture_comment(tctx, "EnumTrustDom failed - should have returned 'NT_STATUS_NO_MORE_ENTRIES' for 0 trusted domains\n");
 			return false;
 		}
-	} else if (!(NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES))) {
-		torture_comment(tctx, "EnumTrustDom of zero size failed - %s\n", nt_errstr(enum_status));
+	} else if (!(NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES))) {
+		torture_comment(tctx, "EnumTrustDom of zero size failed - %s\n", nt_errstr(r.out.result));
 		return false;
 	}
 
@@ -2081,7 +2130,8 @@ static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
 		r.out.domains = &domains;
 		r.out.resume_handle = &out_resume_handle;
 
-		enum_status = dcerpc_lsa_EnumTrustDom_r(b, tctx, &r);
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustDom_r(b, tctx, &r),
+			"EnumTrustDom failed");
 
 		/* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
 		 * always be larger than the previous input resume handle, in
@@ -2090,9 +2140,9 @@ static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
 		 * seen e.g.  with Windows XP SP3 when resume handle is 0 and
 		 * status is NT_STATUS_OK - gd */
 
-		if (NT_STATUS_IS_OK(enum_status) ||
-		    NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES) ||
-		    NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES))
+		if (NT_STATUS_IS_OK(r.out.result) ||
+		    NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES) ||
+		    NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES))
 		{
 			if (out_resume_handle <= in_resume_handle) {
 				torture_comment(tctx, "EnumTrustDom failed - should have returned output resume_handle (0x%08x) larger than input resume handle (0x%08x)\n",
@@ -2102,13 +2152,13 @@ static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
 		}
 
 		/* NO_MORE_ENTRIES is allowed */
-		if (NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES)) {
+		if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
 			if (domains.count == 0) {
 				return true;
 			}
 			torture_comment(tctx, "EnumTrustDom failed - should have returned 0 trusted domains with 'NT_STATUS_NO_MORE_ENTRIES'\n");
 			return false;
-		} else if (NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)) {
+		} else if (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)) {
 			/* Windows 2003 gets this off by one on the first run */
 			if (r.out.domains->count < 3 || r.out.domains->count > 4) {
 				torture_comment(tctx, "EnumTrustDom didn't fill the buffer we "
@@ -2117,8 +2167,8 @@ static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
 				       LSA_ENUM_TRUST_DOMAIN_MULTIPLIER, r.in.max_size);
 				ret = false;
 			}
-		} else if (!NT_STATUS_IS_OK(enum_status)) {
-			torture_comment(tctx, "EnumTrustDom failed - %s\n", nt_errstr(enum_status));
+		} else if (!NT_STATUS_IS_OK(r.out.result)) {
+			torture_comment(tctx, "EnumTrustDom failed - %s\n", nt_errstr(r.out.result));
 			return false;
 		}
 
@@ -2131,7 +2181,7 @@ static bool test_EnumTrustDom(struct dcerpc_binding_handle *b,
 
 		in_resume_handle = out_resume_handle;
 
-	} while ((NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)));
+	} while ((NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)));
 
 	return ret;
 }
@@ -2141,7 +2191,6 @@ static bool test_EnumTrustDomEx(struct dcerpc_binding_handle *b,
 				struct policy_handle *handle)
 {
 	struct lsa_EnumTrustedDomainsEx r_ex;
-	NTSTATUS enum_status;
 	uint32_t resume_handle = 0;
 	struct lsa_DomainListEx domains_ex;
 	bool ret = true;
@@ -2154,10 +2203,11 @@ static bool test_EnumTrustDomEx(struct dcerpc_binding_handle *b,
 	r_ex.out.domains = &domains_ex;
 	r_ex.out.resume_handle = &resume_handle;
 
-	enum_status = dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex);
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex),
+		"EnumTrustedDomainsEx failed");
 
-	if (!(NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES))) {
-		torture_comment(tctx, "EnumTrustedDomainEx of zero size failed - %s\n", nt_errstr(enum_status));
+	if (!(NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES) || NT_STATUS_EQUAL(r_ex.out.result, NT_STATUS_NO_MORE_ENTRIES))) {
+		torture_comment(tctx, "EnumTrustedDomainEx of zero size failed - %s\n", nt_errstr(r_ex.out.result));
 		return false;
 	}
 
@@ -2169,16 +2219,17 @@ static bool test_EnumTrustDomEx(struct dcerpc_binding_handle *b,
 		r_ex.out.domains = &domains_ex;
 		r_ex.out.resume_handle = &resume_handle;
 
-		enum_status = dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex);
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_EnumTrustedDomainsEx_r(b, tctx, &r_ex),
+			"EnumTrustedDomainsEx failed");
 
 		/* NO_MORE_ENTRIES is allowed */
-		if (NT_STATUS_EQUAL(enum_status, NT_STATUS_NO_MORE_ENTRIES)) {
+		if (NT_STATUS_EQUAL(r_ex.out.result, NT_STATUS_NO_MORE_ENTRIES)) {
 			if (domains_ex.count == 0) {
 				return true;
 			}
 			torture_comment(tctx, "EnumTrustDomainsEx failed - should have returned 0 trusted domains with 'NT_STATUS_NO_MORE_ENTRIES'\n");
 			return false;
-		} else if (NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)) {
+		} else if (NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES)) {
 			/* Windows 2003 gets this off by one on the first run */
 			if (r_ex.out.domains->count < 3 || r_ex.out.domains->count > 4) {
 				torture_comment(tctx, "EnumTrustDom didn't fill the buffer we "
@@ -2188,8 +2239,8 @@ static bool test_EnumTrustDomEx(struct dcerpc_binding_handle *b,
 				       LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER,
 				       r_ex.in.max_size / LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER);
 			}
-		} else if (!NT_STATUS_IS_OK(enum_status)) {
-			torture_comment(tctx, "EnumTrustedDomainEx failed - %s\n", nt_errstr(enum_status));
+		} else if (!NT_STATUS_IS_OK(r_ex.out.result)) {
+			torture_comment(tctx, "EnumTrustedDomainEx failed - %s\n", nt_errstr(r_ex.out.result));
 			return false;
 		}
 
@@ -2200,7 +2251,7 @@ static bool test_EnumTrustDomEx(struct dcerpc_binding_handle *b,
 
 		ret &= test_query_each_TrustDomEx(b, tctx, handle, &domains_ex);
 
-	} while ((NT_STATUS_EQUAL(enum_status, STATUS_MORE_ENTRIES)));
+	} while ((NT_STATUS_EQUAL(r_ex.out.result, STATUS_MORE_ENTRIES)));
 
 	return ret;
 }
@@ -2211,7 +2262,6 @@ static bool test_CreateTrustedDomain(struct dcerpc_binding_handle *b,
 				     struct policy_handle *handle,
 				     uint32_t num_trusts)
 {
-	NTSTATUS status;
 	bool ret = true;
 	struct lsa_CreateTrustedDomain r;
 	struct lsa_DomainInfo trustinfo;
@@ -2248,22 +2298,25 @@ static bool test_CreateTrustedDomain(struct dcerpc_binding_handle *b,
 		r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 		r.out.trustdom_handle = &trustdom_handle[i];
 
-		status = dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r);
-		if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r),
+			"CreateTrustedDomain failed");
+		if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
 			test_DeleteTrustedDomain(b, tctx, handle, trustinfo.name);
-			status = dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r);
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomain_r(b, tctx, &r),
+				"CreateTrustedDomain failed");
 		}
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "CreateTrustedDomain failed - %s\n", nt_errstr(status));
+		if (!NT_STATUS_IS_OK(r.out.result)) {
+			torture_comment(tctx, "CreateTrustedDomain failed - %s\n", nt_errstr(r.out.result));
 			ret = false;
 		} else {
 
 			q.in.trustdom_handle = &trustdom_handle[i];
 			q.in.level = LSA_TRUSTED_DOMAIN_INFO_INFO_EX;
 			q.out.info = &info;
-			status = dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q);
-			if (!NT_STATUS_IS_OK(status)) {
-				torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n", q.in.level, nt_errstr(status));
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
+				"QueryTrustedDomainInfo failed");
+			if (!NT_STATUS_IS_OK(q.out.result)) {
+				torture_comment(tctx, "QueryTrustedDomainInfo level %d failed - %s\n", q.in.level, nt_errstr(q.out.result));
 				ret = false;
 			} else if (!q.out.info) {
 				ret = false;
@@ -2390,22 +2443,25 @@ static bool test_CreateTrustedDomainEx2(struct dcerpc_pipe *p,
 		r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 		r.out.trustdom_handle = &trustdom_handle[i];
 
-		status = dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r);
-		if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r),
+			"CreateTrustedDomainEx2 failed");
+		if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_COLLISION)) {
 			test_DeleteTrustedDomain(b, tctx, handle, trustinfo.netbios_name);
-			status = dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r);
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateTrustedDomainEx2_r(b, tctx, &r),
+				"CreateTrustedDomainEx2 failed");
 		}
-		if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "CreateTrustedDomainEx failed2 - %s\n", nt_errstr(status));
+		if (!NT_STATUS_IS_OK(r.out.result)) {
+			torture_comment(tctx, "CreateTrustedDomainEx failed2 - %s\n", nt_errstr(r.out.result));
 			ret = false;
 		} else {
 
 			q.in.trustdom_handle = &trustdom_handle[i];
 			q.in.level = LSA_TRUSTED_DOMAIN_INFO_INFO_EX;
 			q.out.info = &info;
-			status = dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q);
-			if (!NT_STATUS_IS_OK(status)) {
-				torture_comment(tctx, "QueryTrustedDomainInfo level 1 failed - %s\n", nt_errstr(status));
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryTrustedDomainInfo_r(b, tctx, &q),
+				"QueryTrustedDomainInfo failed");
+			if (!NT_STATUS_IS_OK(q.out.result)) {
+				torture_comment(tctx, "QueryTrustedDomainInfo level 1 failed - %s\n", nt_errstr(q.out.result));
 				ret = false;
 			} else if (!q.out.info) {
 				torture_comment(tctx, "QueryTrustedDomainInfo level 1 failed to return an info pointer\n");
@@ -2462,7 +2518,6 @@ static bool test_QueryDomainInfoPolicy(struct dcerpc_binding_handle *b,
 {
 	struct lsa_QueryDomainInformationPolicy r;
 	union lsa_DomainInformationPolicy *info = NULL;
-	NTSTATUS status;
 	int i;
 	bool ret = true;
 
@@ -2479,13 +2534,14 @@ static bool test_QueryDomainInfoPolicy(struct dcerpc_binding_handle *b,
 
 		torture_comment(tctx, "\nTrying QueryDomainInformationPolicy level %d\n", i);
 
-		status = dcerpc_lsa_QueryDomainInformationPolicy_r(b, tctx, &r);
+		torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryDomainInformationPolicy_r(b, tctx, &r),
+			"QueryDomainInformationPolicy failed");
 
 		/* If the server does not support EFS, then this is the correct return */
-		if (i == LSA_DOMAIN_INFO_POLICY_EFS && NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+		if (i == LSA_DOMAIN_INFO_POLICY_EFS && NT_STATUS_EQUAL(r.out.result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 			continue;
-		} else if (!NT_STATUS_IS_OK(status)) {
-			torture_comment(tctx, "QueryDomainInformationPolicy failed - %s\n", nt_errstr(status));
+		} else if (!NT_STATUS_IS_OK(r.out.result)) {
+			torture_comment(tctx, "QueryDomainInformationPolicy failed - %s\n", nt_errstr(r.out.result));
 			ret = false;
 			continue;
 		}
@@ -2502,7 +2558,6 @@ static bool test_QueryInfoPolicyCalls(	bool version2,
 {
 	struct lsa_QueryInfoPolicy r;
 	union lsa_PolicyInformation *info = NULL;
-	NTSTATUS status;
 	int i;
 	bool ret = true;
 	const char *call = talloc_asprintf(tctx, "QueryInfoPolicy%s", version2 ? "2":"");
@@ -2523,17 +2578,19 @@ static bool test_QueryInfoPolicyCalls(	bool version2,
 		if (version2)
 			/* We can perform the cast, because both types are
 			   structurally equal */
-			status = dcerpc_lsa_QueryInfoPolicy2_r(b, tctx,
-				 (struct lsa_QueryInfoPolicy2*) &r);
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryInfoPolicy2_r(b, tctx,
+				 (struct lsa_QueryInfoPolicy2*) &r),
+				 "QueryInfoPolicy2 failed");
 		else
-			status = dcerpc_lsa_QueryInfoPolicy_r(b, tctx, &r);
+			torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QueryInfoPolicy_r(b, tctx, &r),
+				"QueryInfoPolicy2 failed");
 
 		switch (i) {
 		case LSA_POLICY_INFO_MOD:
 		case LSA_POLICY_INFO_AUDIT_FULL_SET:
 		case LSA_POLICY_INFO_AUDIT_FULL_QUERY:
-			if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
-				torture_comment(tctx, "Server should have failed level %u: %s\n", i, nt_errstr(status));
+			if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_PARAMETER)) {
+				torture_comment(tctx, "Server should have failed level %u: %s\n", i, nt_errstr(r.out.result));
 				ret = false;
 			}
 			break;
@@ -2545,8 +2602,8 @@ static bool test_QueryInfoPolicyCalls(	bool version2,
 		case LSA_POLICY_INFO_AUDIT_LOG:
 		case LSA_POLICY_INFO_AUDIT_EVENTS:
 		case LSA_POLICY_INFO_PD:
-			if (!NT_STATUS_IS_OK(status)) {
-				torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(status));
+			if (!NT_STATUS_IS_OK(r.out.result)) {
+				torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
 				ret = false;
 			}
 			break;
@@ -2555,30 +2612,30 @@ static bool test_QueryInfoPolicyCalls(	bool version2,
 		case LSA_POLICY_INFO_DNS:
 			if (torture_setting_bool(tctx, "samba3", false)) {
 				/* Other levels not implemented yet */
-				if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
-					torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(status));
+				if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
+					torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
 					ret = false;
 				}
-			} else if (!NT_STATUS_IS_OK(status)) {
-				torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(status));
+			} else if (!NT_STATUS_IS_OK(r.out.result)) {
+				torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
 				ret = false;
 			}
 			break;
 		default:
 			if (torture_setting_bool(tctx, "samba4", false)) {
 				/* Other levels not implemented yet */
-				if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
-					torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(status));
+				if (!NT_STATUS_EQUAL(r.out.result, NT_STATUS_INVALID_INFO_CLASS)) {
+					torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
 					ret = false;
 				}
-			} else if (!NT_STATUS_IS_OK(status)) {
-				torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(status));
+			} else if (!NT_STATUS_IS_OK(r.out.result)) {
+				torture_comment(tctx, "%s failed - %s\n", call, nt_errstr(r.out.result));
 				ret = false;
 			}
 			break;
 		}
 
-		if (NT_STATUS_IS_OK(status) && (i == LSA_POLICY_INFO_DNS
+		if (NT_STATUS_IS_OK(r.out.result) && (i == LSA_POLICY_INFO_DNS
 			|| i == LSA_POLICY_INFO_DNS_INT)) {
 			/* Let's look up some of these names */
 
@@ -2639,7 +2696,6 @@ static bool test_GetUserName(struct dcerpc_binding_handle *b,
 			     struct torture_context *tctx)
 {
 	struct lsa_GetUserName r;
-	NTSTATUS status;
 	bool ret = true;
 	struct lsa_String *authority_name_p = NULL;
 	struct lsa_String *account_name_p = NULL;
@@ -2651,10 +2707,11 @@ static bool test_GetUserName(struct dcerpc_binding_handle *b,
 	r.in.authority_name	= NULL;
 	r.out.account_name	= &account_name_p;
 
-	status = dcerpc_lsa_GetUserName_r(b, tctx, &r);
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetUserName_r(b, tctx, &r),
+		"GetUserName failed");
 
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(status));
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(r.out.result));
 		ret = false;
 	}
 
@@ -2663,10 +2720,11 @@ static bool test_GetUserName(struct dcerpc_binding_handle *b,
 	r.in.authority_name	= &authority_name_p;
 	r.out.account_name	= &account_name_p;
 
-	status = dcerpc_lsa_GetUserName_r(b, tctx, &r);
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_GetUserName_r(b, tctx, &r),
+		"GetUserName failed");
 
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(status));
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "GetUserName failed - %s\n", nt_errstr(r.out.result));
 		ret = false;
 	}
 
@@ -2677,7 +2735,6 @@ bool test_lsa_Close(struct dcerpc_binding_handle *b,
 		    struct torture_context *tctx,
 		    struct policy_handle *handle)
 {
-	NTSTATUS status;
 	struct lsa_Close r;
 	struct policy_handle handle2;
 
@@ -2686,18 +2743,16 @@ bool test_lsa_Close(struct dcerpc_binding_handle *b,
 	r.in.handle = handle;
 	r.out.handle = &handle2;
 
-	status = dcerpc_lsa_Close_r(b, tctx, &r);
-	if (!NT_STATUS_IS_OK(status)) {
-		torture_comment(tctx, "Close failed - %s\n", nt_errstr(status));
+	torture_assert_ntstatus_ok(tctx, dcerpc_lsa_Close_r(b, tctx, &r),
+		"Close failed");
+	if (!NT_STATUS_IS_OK(r.out.result)) {
+		torture_comment(tctx, "Close failed - %s\n",
+		nt_errstr(r.out.result));
 		return false;
 	}
 
-	status = dcerpc_lsa_Close_r(b, tctx, &r);
-	/* its really a fault - we need a status code for rpc fault */
-	if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
-		torture_comment(tctx, "Close failed - %s\n", nt_errstr(status));
-		return false;
-	}
+	torture_assert_ntstatus_equal(tctx, dcerpc_lsa_Close_r(b, tctx, &r),
+		NT_STATUS_NET_WRITE_FAULT, "Close should failed");
 
 	torture_comment(tctx, "\n");