r25920: ndr: change NTSTAUS into enum ndr_err_code (samba4 callers)

lib/messaging/
lib/registry/
lib/ldb-samba/
librpc/rpc/
auth/auth_winbind.c
auth/gensec/
auth/kerberos/
dsdb/repl/
dsdb/samdb/
dsdb/schema/
torture/
cluster/ctdb/
kdc/
ntvfs/ipc/
torture/rap/
ntvfs/
utils/getntacl.c
ntptr/
smb_server/
libcli/wrepl/
wrepl_server/
libcli/cldap/
libcli/dgram/
libcli/ldap/
libcli/raw/
libcli/nbt/
libnet/
winbind/
rpc_server/

metze
(This used to be commit 6223c7fddc972687eb577e04fc1c8e0604c35435)

64 files changed, 1054 insertions, 735 deletions

diff --git a/source4/auth/auth_winbind.c b/source4/auth/auth_winbind.c
index 2ec0dc7a56..c002428581 100644
--- a/source4/auth/auth_winbind.c
+++ b/source4/auth/auth_winbind.c
@@ -32,15 +32,18 @@ static NTSTATUS get_info3_from_ndr(TALLOC_CTX *mem_ctx, struct winbindd_response
 {
 	size_t len = response->length - sizeof(struct winbindd_response);
 	if (len > 4) {
-		NTSTATUS status;
+		enum ndr_err_code ndr_err;
 		DATA_BLOB blob;
 		blob.length = len - 4;
 		blob.data = (uint8_t *)(((char *)response->extra_data.data) + 4);
 
-		status = ndr_pull_struct_blob(&blob, mem_ctx, info3,
+		ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, info3,
 					      (ndr_pull_flags_fn_t)ndr_pull_netr_SamInfo3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			return ndr_map_error2ntstatus(ndr_err);
+		}
 
-		return status;
+		return NT_STATUS_OK;
 	} else {
 		DEBUG(2, ("get_info3_from_ndr: No info3 struct found!\n"));
 		return NT_STATUS_UNSUCCESSFUL;
diff --git a/source4/auth/gensec/schannel.c b/source4/auth/gensec/schannel.c
index 4d2c9cfee3..98d000be22 100644
--- a/source4/auth/gensec/schannel.c
+++ b/source4/auth/gensec/schannel.c
@@ -46,6 +46,7 @@ static NTSTATUS schannel_update(struct gensec_security *gensec_security, TALLOC_
 {
 	struct schannel_state *state = (struct schannel_state *)gensec_security->private_data;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct schannel_bind bind_schannel;
 	struct schannel_bind_ack bind_schannel_ack;
 	struct creds_CredentialState *creds;
@@ -80,9 +81,10 @@ static NTSTATUS schannel_update(struct gensec_security *gensec_security, TALLOC_
 		bind_schannel.u.info3.workstation = cli_credentials_get_workstation(gensec_security->credentials);
 #endif
 		
-		status = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel,
-					      (ndr_push_flags_fn_t)ndr_push_schannel_bind);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel,
+					       (ndr_push_flags_fn_t)ndr_push_schannel_bind);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			status = ndr_map_error2ntstatus(ndr_err);
 			DEBUG(3, ("Could not create schannel bind: %s\n",
 				  nt_errstr(status)));
 			return status;
@@ -99,9 +101,10 @@ static NTSTATUS schannel_update(struct gensec_security *gensec_security, TALLOC_
 		}
 		
 		/* parse the schannel startup blob */
-		status = ndr_pull_struct_blob(&in, out_mem_ctx, &bind_schannel, 
-					      (ndr_pull_flags_fn_t)ndr_pull_schannel_bind);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob(&in, out_mem_ctx, &bind_schannel,
+					       (ndr_pull_flags_fn_t)ndr_pull_schannel_bind);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			status = ndr_map_error2ntstatus(ndr_err);
 			DEBUG(3, ("Could not parse incoming schannel bind: %s\n",
 				  nt_errstr(status)));
 			return status;
@@ -133,9 +136,10 @@ static NTSTATUS schannel_update(struct gensec_security *gensec_security, TALLOC_
 		bind_schannel_ack.unknown2 = 0;
 		bind_schannel_ack.unknown3 = 0x6c0000;
 		
-		status = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel_ack, 
-					      (ndr_push_flags_fn_t)ndr_push_schannel_bind_ack);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_push_struct_blob(out, out_mem_ctx, &bind_schannel_ack,
+					       (ndr_push_flags_fn_t)ndr_push_schannel_bind_ack);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			status = ndr_map_error2ntstatus(ndr_err);
 			DEBUG(3, ("Could not return schannel bind ack for client %s: %s\n",
 				  workstation, nt_errstr(status)));
 			return status;
diff --git a/source4/auth/kerberos/kerberos_pac.c b/source4/auth/kerberos/kerberos_pac.c
index 0c20ca0744..5fefd24cd1 100644
--- a/source4/auth/kerberos/kerberos_pac.c
+++ b/source4/auth/kerberos/kerberos_pac.c
@@ -76,6 +76,7 @@ static krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
 {
 	krb5_error_code ret;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct PAC_SIGNATURE_DATA *srv_sig_ptr = NULL;
 	struct PAC_SIGNATURE_DATA *kdc_sig_ptr = NULL;
 	struct PAC_SIGNATURE_DATA *srv_sig_wipe = NULL;
@@ -110,10 +111,12 @@ static krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	status = ndr_pull_struct_blob(&blob, pac_data, pac_data,
-				      (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("can't parse the PAC\n"));
+	ndr_err = ndr_pull_struct_blob(&blob, pac_data, pac_data,
+				       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("can't parse the PAC: %s\n",
+			nt_errstr(status)));
 		return status;
 	}
 
@@ -123,10 +126,12 @@ static krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
-	status = ndr_pull_struct_blob(&blob, pac_data_raw, pac_data_raw,
-				      (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA_RAW);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("can't parse the PAC\n"));
+	ndr_err = ndr_pull_struct_blob(&blob, pac_data_raw, pac_data_raw,
+				       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA_RAW);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("can't parse the PAC: %s\n",
+			nt_errstr(status)));
 		return status;
 	}
 
@@ -201,43 +206,53 @@ static krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
 	/* Find and zero out the signatures, as required by the signing algorithm */
 
 	/* We find the data blobs above, now we parse them to get at the exact portion we should zero */
-	status = ndr_pull_struct_blob(kdc_sig_blob, kdc_sig_wipe, kdc_sig_wipe,
-				      (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("can't parse the KDC signature\n"));
+	ndr_err = ndr_pull_struct_blob(kdc_sig_blob, kdc_sig_wipe, kdc_sig_wipe,
+				       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("can't parse the KDC signature: %s\n",
+			nt_errstr(status)));
 		return status;
 	}
 	
-	status = ndr_pull_struct_blob(srv_sig_blob, srv_sig_wipe, srv_sig_wipe,
-				      (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("can't parse the SRV signature\n"));
+	ndr_err = ndr_pull_struct_blob(srv_sig_blob, srv_sig_wipe, srv_sig_wipe,
+				       (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("can't parse the SRV signature: %s\n",
+			nt_errstr(status)));
 		return status;
 	}
-	
+
 	/* Now zero the decoded structure */
 	memset(kdc_sig_wipe->signature.data, '\0', kdc_sig_wipe->signature.length);
 	memset(srv_sig_wipe->signature.data, '\0', srv_sig_wipe->signature.length);
 	
 	/* and reencode, back into the same place it came from */
-	status = ndr_push_struct_blob(kdc_sig_blob, pac_data_raw, kdc_sig_wipe,
-				      (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("can't repack the KDC signature\n"));
+	ndr_err = ndr_push_struct_blob(kdc_sig_blob, pac_data_raw, kdc_sig_wipe,
+				       (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("can't repack the KDC signature: %s\n",
+			nt_errstr(status)));
 		return status;
-	}	
-	status = ndr_push_struct_blob(srv_sig_blob, pac_data_raw, srv_sig_wipe,
-				      (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("can't repack the SRV signature\n"));
+	}
+	ndr_err = ndr_push_struct_blob(srv_sig_blob, pac_data_raw, srv_sig_wipe,
+				       (ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("can't repack the SRV signature: %s\n",
+			nt_errstr(status)));
 		return status;
 	}
 
 	/* push out the whole structure, but now with zero'ed signatures */
-	status = ndr_push_struct_blob(&modified_pac_blob, pac_data_raw, pac_data_raw,
-					 (ndr_push_flags_fn_t)ndr_push_PAC_DATA_RAW);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("can't repack the RAW PAC\n"));
+	ndr_err = ndr_push_struct_blob(&modified_pac_blob, pac_data_raw, pac_data_raw,
+				       (ndr_push_flags_fn_t)ndr_push_PAC_DATA_RAW);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("can't repack the RAW PAC: %s\n",
+			nt_errstr(status)));
 		return status;
 	}
 
@@ -309,7 +324,7 @@ static krb5_error_code check_pac_checksum(TALLOC_CTX *mem_ctx,
 		 logon_info->info3.base.full_name.string));
 	*pac_data_out = pac_data;
 
-	return status;
+	return NT_STATUS_OK;
 }
 
 _PUBLIC_  NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
@@ -404,6 +419,7 @@ static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
 {
 	NTSTATUS nt_status;
 	krb5_error_code ret;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB zero_blob = data_blob(NULL, 0);
 	DATA_BLOB tmp_blob = data_blob(NULL, 0);
 	struct PAC_SIGNATURE_DATA *kdc_checksum = NULL;
@@ -456,9 +472,10 @@ static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
 	memset(kdc_checksum->signature.data, '\0', kdc_checksum->signature.length);
 	memset(srv_checksum->signature.data, '\0', srv_checksum->signature.length);
 
-	nt_status = ndr_push_struct_blob(&tmp_blob, mem_ctx, pac_data,
-					 (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_push_struct_blob(&tmp_blob, mem_ctx, pac_data,
+				       (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		nt_status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(1, ("PAC (presig) push failed: %s\n", nt_errstr(nt_status)));
 		talloc_free(pac_data);
 		return EINVAL;
@@ -478,9 +495,10 @@ static krb5_error_code make_pac_checksum(TALLOC_CTX *mem_ctx,
 	}
 
 	/* And push it out again, this time to the world.  This relies on determanistic pointer values */
-	nt_status = ndr_push_struct_blob(&tmp_blob, mem_ctx, pac_data,
-					 (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_push_struct_blob(&tmp_blob, mem_ctx, pac_data,
+				       (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		nt_status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(1, ("PAC (final) push failed: %s\n", nt_errstr(nt_status)));
 		talloc_free(pac_data);
 		return EINVAL;
diff --git a/source4/cluster/ctdb/opendb_ctdb.c b/source4/cluster/ctdb/opendb_ctdb.c
index 7753992df8..53febecb69 100644
--- a/source4/cluster/ctdb/opendb_ctdb.c
+++ b/source4/cluster/ctdb/opendb_ctdb.c
@@ -193,7 +193,7 @@ static NTSTATUS odb_pull_record(struct odb_lock *lck, struct opendb_file *file)
 {
 	TDB_DATA dbuf;
 	DATA_BLOB blob;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	dbuf = lck->data;
 
@@ -205,9 +205,12 @@ static NTSTATUS odb_pull_record(struct odb_lock *lck, struct opendb_file *file)
 	blob.data = dbuf.dptr;
 	blob.length = dbuf.dsize;
 
-	status = ndr_pull_struct_blob(&blob, lck, file, (ndr_pull_flags_fn_t)ndr_pull_opendb_file);
+	ndr_err = ndr_pull_struct_blob(&blob, lck, file, (ndr_pull_flags_fn_t)ndr_pull_opendb_file);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
-	return status;
+	return NT_STATUS_OK;
 }
 
 /*
@@ -217,7 +220,7 @@ static NTSTATUS odb_push_record(struct odb_lock *lck, struct opendb_file *file)
 {
 	TDB_DATA dbuf;
 	DATA_BLOB blob;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	int ret;
 
 	if (!file->num_entries) {
@@ -228,8 +231,10 @@ static NTSTATUS odb_push_record(struct odb_lock *lck, struct opendb_file *file)
 		return NT_STATUS_OK;
 	}
 
-	status = ndr_push_struct_blob(&blob, lck, file, (ndr_push_flags_fn_t)ndr_push_opendb_file);
-	NT_STATUS_NOT_OK_RETURN(status);
+	ndr_err = ndr_push_struct_blob(&blob, lck, file, (ndr_push_flags_fn_t)ndr_push_opendb_file);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
 	dbuf.dptr = blob.data;
 	dbuf.dsize = blob.length;
diff --git a/source4/dsdb/repl/drepl_partitions.c b/source4/dsdb/repl/drepl_partitions.c
index 8b57320bb1..8c0d8e5897 100644
--- a/source4/dsdb/repl/drepl_partitions.c
+++ b/source4/dsdb/repl/drepl_partitions.c
@@ -149,15 +149,16 @@ static WERROR dreplsrv_partition_add_source_dsa(struct dreplsrv_service *s,
 						const struct ldb_val *val)
 {
 	WERROR status;
-	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	struct dreplsrv_partition_source_dsa *source;
 
 	source = talloc_zero(p, struct dreplsrv_partition_source_dsa);
 	W_ERROR_HAVE_NO_MEMORY(source);
 
-	nt_status = ndr_pull_struct_blob(val, source, &source->_repsFromBlob,
-					 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_pull_struct_blob(val, source, &source->_repsFromBlob,
+				       (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 		return ntstatus_to_werror(nt_status);
 	}
 	/* NDR_PRINT_DEBUG(repsFromToBlob, &source->_repsFromBlob); */
@@ -180,7 +181,6 @@ static WERROR dreplsrv_refresh_partition(struct dreplsrv_service *s,
 					 TALLOC_CTX *mem_ctx)
 {
 	WERROR status;
-	NTSTATUS nt_status;
 	const struct ldb_val *ouv_value;
 	struct replUpToDateVectorBlob ouv;
 	struct dom_sid *nc_sid;
@@ -220,9 +220,11 @@ static WERROR dreplsrv_refresh_partition(struct dreplsrv_service *s,
 
 	ouv_value = ldb_msg_find_ldb_val(r->msgs[0], "replUpToDateVector");
 	if (ouv_value) {
-		nt_status = ndr_pull_struct_blob(ouv_value, mem_ctx, &ouv,
-						 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
-		if (!NT_STATUS_IS_OK(nt_status)) {
+		enum ndr_err_code ndr_err;
+		ndr_err = ndr_pull_struct_blob(ouv_value, mem_ctx, &ouv,
+					       (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 			return ntstatus_to_werror(nt_status);
 		}
 		/* NDR_PRINT_DEBUG(replUpToDateVectorBlob, &ouv); */
diff --git a/source4/dsdb/repl/replicated_objects.c b/source4/dsdb/repl/replicated_objects.c
index 6f34ac8556..c47108559d 100644
--- a/source4/dsdb/repl/replicated_objects.c
+++ b/source4/dsdb/repl/replicated_objects.c
@@ -195,6 +195,7 @@ static WERROR dsdb_convert_object(struct ldb_context *ldb,
 				  struct dsdb_extended_replicated_object *out)
 {
 	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	WERROR status;
 	uint32_t i;
 	struct ldb_message *msg;
@@ -321,9 +322,10 @@ static WERROR dsdb_convert_object(struct ldb_context *ldb,
 	whenChanged_s = ldb_timestring(msg, whenChanged_t);
 	W_ERROR_HAVE_NO_MEMORY(whenChanged_s);
 
-	nt_status = ndr_push_struct_blob(&guid_value, msg, &in->object.identifier->guid,
+	ndr_err = ndr_push_struct_blob(&guid_value, msg, &in->object.identifier->guid,
 					 (ndr_push_flags_fn_t)ndr_push_GUID);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		nt_status = ndr_map_error2ntstatus(ndr_err);
 		return ntstatus_to_werror(nt_status);
 	}
 
diff --git a/source4/dsdb/samdb/ldb_modules/entryUUID.c b/source4/dsdb/samdb/ldb_modules/entryUUID.c
index 1a16cb8321..f4231d20d3 100644
--- a/source4/dsdb/samdb/ldb_modules/entryUUID.c
+++ b/source4/dsdb/samdb/ldb_modules/entryUUID.c
@@ -43,14 +43,15 @@ static struct ldb_val encode_guid(struct ldb_module *module, TALLOC_CTX *ctx, co
 {
 	struct GUID guid;
 	NTSTATUS status = GUID_from_string((char *)val->data, &guid);
+	enum ndr_err_code ndr_err;
 	struct ldb_val out = data_blob(NULL, 0);
 
 	if (!NT_STATUS_IS_OK(status)) {
 		return out;
 	}
-	status = ndr_push_struct_blob(&out, ctx, &guid, 
-				      (ndr_push_flags_fn_t)ndr_push_GUID);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&out, ctx, &guid,
+				       (ndr_push_flags_fn_t)ndr_push_GUID);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return out;
 	}
 
@@ -60,18 +61,19 @@ static struct ldb_val encode_guid(struct ldb_module *module, TALLOC_CTX *ctx, co
 static struct ldb_val guid_always_string(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
 {
 	struct GUID *guid;
-	NTSTATUS status;
 	struct ldb_val out = data_blob(NULL, 0);
 	if (val->length >= 32 && val->data[val->length] == '\0') {
 		ldb_handler_copy(module->ldb, ctx, val, &out);
 	} else {
+		enum ndr_err_code ndr_err;
+
 		guid = talloc(ctx, struct GUID);
 		if (guid == NULL) {
 			return out;
 		}
-		status = ndr_pull_struct_blob(val, guid, guid, 
-					      (ndr_pull_flags_fn_t)ndr_pull_GUID);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob(val, guid, guid,
+					       (ndr_pull_flags_fn_t)ndr_pull_GUID);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			talloc_free(guid);
 			return out;
 		}
@@ -85,14 +87,15 @@ static struct ldb_val encode_ns_guid(struct ldb_module *module, TALLOC_CTX *ctx,
 {
 	struct GUID guid;
 	NTSTATUS status = NS_GUID_from_string((char *)val->data, &guid);
+	enum ndr_err_code ndr_err;
 	struct ldb_val out = data_blob(NULL, 0);
 
 	if (!NT_STATUS_IS_OK(status)) {
 		return out;
 	}
-	status = ndr_push_struct_blob(&out, ctx, &guid, 
-				      (ndr_push_flags_fn_t)ndr_push_GUID);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&out, ctx, &guid,
+				       (ndr_push_flags_fn_t)ndr_push_GUID);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return out;
 	}
 
@@ -101,21 +104,21 @@ static struct ldb_val encode_ns_guid(struct ldb_module *module, TALLOC_CTX *ctx,
 
 static struct ldb_val guid_ns_string(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
 {
-	NTSTATUS status;
 	struct ldb_val out = data_blob(NULL, 0);
 	if (val->length >= 32 && val->data[val->length] == '\0') {
 		struct GUID guid;
 		GUID_from_string((char *)val->data, &guid);
 		out = data_blob_string_const(NS_GUID_string(ctx, &guid));
 	} else {
+		enum ndr_err_code ndr_err;
 		struct GUID *guid_p;
 		guid_p = talloc(ctx, struct GUID);
 		if (guid_p == NULL) {
 			return out;
 		}
-		status = ndr_pull_struct_blob(val, guid_p, guid_p, 
-					      (ndr_pull_flags_fn_t)ndr_pull_GUID);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob(val, guid_p, guid_p,
+					       (ndr_pull_flags_fn_t)ndr_pull_GUID);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			talloc_free(guid_p);
 			return out;
 		}
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
index 0cd00e3834..50ea2ec4e2 100644
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -250,7 +250,7 @@ static int objectclass_sort(struct ldb_module *module,
 static DATA_BLOB *get_sd(struct ldb_module *module, TALLOC_CTX *mem_ctx, 
 			 const struct dsdb_class *objectclass) 
 {
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB *linear_sd;
 	struct auth_session_info *session_info
 		= ldb_get_opaque(module->ldb, "sessionInfo");
@@ -271,10 +271,9 @@ static DATA_BLOB *get_sd(struct ldb_module *module, TALLOC_CTX *mem_ctx,
 		return NULL;
 	}
 
-	status = ndr_push_struct_blob(linear_sd, mem_ctx, sd, 
-				      (ndr_push_flags_fn_t)ndr_push_security_descriptor);
-
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(linear_sd, mem_ctx, sd,
+				       (ndr_push_flags_fn_t)ndr_push_security_descriptor);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return NULL;
 	}
 	
diff --git a/source4/dsdb/samdb/ldb_modules/objectguid.c b/source4/dsdb/samdb/ldb_modules/objectguid.c
index d7e74cf38d..e9d699d59c 100644
--- a/source4/dsdb/samdb/ldb_modules/objectguid.c
+++ b/source4/dsdb/samdb/ldb_modules/objectguid.c
@@ -111,7 +111,7 @@ static int objectguid_add(struct ldb_module *module, struct ldb_request *req)
 	struct ldb_val v;
 	struct GUID guid;
 	uint64_t seq_num;
-	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	int ret;
 	time_t t = time(NULL);
 
@@ -143,9 +143,9 @@ static int objectguid_add(struct ldb_module *module, struct ldb_request *req)
 	/* a new GUID */
 	guid = GUID_random();
 
-	nt_status = ndr_push_struct_blob(&v, msg, &guid, 
-					 (ndr_push_flags_fn_t)ndr_push_GUID);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_push_struct_blob(&v, msg, &guid,
+				       (ndr_push_flags_fn_t)ndr_push_GUID);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(down_req);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
index 090cce2719..d0afae5395 100644
--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
@@ -229,7 +229,7 @@ static int setup_primary_kerberos(struct setup_password_fields_io *io,
 	struct package_PrimaryKerberosBlob _old_pkb;
 	struct package_PrimaryKerberosCtr3 *old_pkb3 = NULL;
 	uint32_t i;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	/* Many, many thanks to lukeh@padl.com for this
 	 * algorithm, described in his Nov 10 2004 mail to
@@ -472,9 +472,10 @@ static int setup_primary_kerberos(struct setup_password_fields_io *io,
 		talloc_steal(io->ac, blob.data);
 
 		/* TODO: use ndr_pull_struct_blob_all(), when the ndr layer handles it correct with relative pointers */
-		status = ndr_pull_struct_blob(&blob, io->ac, &_old_pkb,
-					      (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob(&blob, io->ac, &_old_pkb,
+					       (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 			ldb_asprintf_errstring(io->ac->module->ldb,
 					       "setup_primary_kerberos: "
 					       "failed to pull old package_PrimaryKerberosBlob: %s",
@@ -863,7 +864,7 @@ static int setup_supplemental_field(struct setup_password_fields_io *io)
 	DATA_BLOB pcb_blob;
 	char *pcb_hexstr;
 	int ret;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	uint8_t zero16[16];
 
 	ZERO_STRUCT(zero16);
@@ -878,9 +879,10 @@ static int setup_supplemental_field(struct setup_password_fields_io *io)
 
 	/* if there's an old supplementaCredentials blob then parse it */
 	if (io->o.supplemental) {
-		status = ndr_pull_struct_blob_all(io->o.supplemental, io->ac, &_old_scb,
-						  (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob_all(io->o.supplemental, io->ac, &_old_scb,
+						   (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 			ldb_asprintf_errstring(io->ac->module->ldb,
 					       "setup_supplemental_field: "
 					       "failed to pull old supplementalCredentialsBlob: %s",
@@ -910,9 +912,10 @@ static int setup_supplemental_field(struct setup_password_fields_io *io)
 		return ret;
 	}
 
-	status = ndr_push_struct_blob(&pkb_blob, io->ac, &pkb,
-				      (ndr_push_flags_fn_t)ndr_push_package_PrimaryKerberosBlob);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&pkb_blob, io->ac, &pkb,
+				       (ndr_push_flags_fn_t)ndr_push_package_PrimaryKerberosBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 		ldb_asprintf_errstring(io->ac->module->ldb,
 				       "setup_supplemental_field: "
 				       "failed to push package_PrimaryKerberosBlob: %s",
@@ -948,9 +951,10 @@ static int setup_supplemental_field(struct setup_password_fields_io *io)
 		return ret;
 	}
 
-	status = ndr_push_struct_blob(&pdb_blob, io->ac, &pdb,
-				      (ndr_push_flags_fn_t)ndr_push_package_PrimaryWDigestBlob);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&pdb_blob, io->ac, &pdb,
+				       (ndr_push_flags_fn_t)ndr_push_package_PrimaryWDigestBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 		ldb_asprintf_errstring(io->ac->module->ldb,
 				       "setup_supplemental_field: "
 				       "failed to push package_PrimaryWDigestBlob: %s",
@@ -974,9 +978,10 @@ static int setup_supplemental_field(struct setup_password_fields_io *io)
 
 		pcb.cleartext	= io->n.cleartext;
 
-		status = ndr_push_struct_blob(&pcb_blob, io->ac, &pcb,
-					      (ndr_push_flags_fn_t)ndr_push_package_PrimaryCLEARTEXTBlob);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_push_struct_blob(&pcb_blob, io->ac, &pcb,
+					       (ndr_push_flags_fn_t)ndr_push_package_PrimaryCLEARTEXTBlob);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 			ldb_asprintf_errstring(io->ac->module->ldb,
 					       "setup_supplemental_field: "
 					       "failed to push package_PrimaryCLEARTEXTBlob: %s",
@@ -996,9 +1001,10 @@ static int setup_supplemental_field(struct setup_password_fields_io *io)
 	/*
 	 * setup 'Packages' element
 	 */
-	status = ndr_push_struct_blob(&pb_blob, io->ac, &pb,
-				      (ndr_push_flags_fn_t)ndr_push_package_PackagesBlob);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&pb_blob, io->ac, &pb,
+				       (ndr_push_flags_fn_t)ndr_push_package_PackagesBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 		ldb_asprintf_errstring(io->ac->module->ldb,
 				       "setup_supplemental_field: "
 				       "failed to push package_PackagesBlob: %s",
@@ -1020,9 +1026,10 @@ static int setup_supplemental_field(struct setup_password_fields_io *io)
 	scb.sub.num_packages	= num_packages;
 	scb.sub.packages	= packages;
 
-	status = ndr_push_struct_blob(&io->g.supplemental, io->ac, &scb,
-				      (ndr_push_flags_fn_t)ndr_push_supplementalCredentialsBlob);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&io->g.supplemental, io->ac, &scb,
+				       (ndr_push_flags_fn_t)ndr_push_supplementalCredentialsBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 		ldb_asprintf_errstring(io->ac->module->ldb,
 				       "setup_supplemental_field: "
 				       "failed to push supplementalCredentialsBlob: %s",
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 42c91d03cc..497ee373de 100644
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -291,7 +291,7 @@ static int replmd_add_originating(struct ldb_module *module,
 				  const struct dsdb_schema *schema,
 				  const struct dsdb_control_current_partition *partition)
 {
-	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	struct ldb_request *down_req;
 	struct ldb_message *msg;
 	uint32_t instance_type;
@@ -518,16 +518,15 @@ static int replmd_add_originating(struct ldb_module *module,
 	replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, &rdn_attr->attributeID_id);
 
 	/* generated NDR encoded values */
-	nt_status = ndr_push_struct_blob(&guid_value, msg, &guid, 
-					 (ndr_push_flags_fn_t)ndr_push_GUID);
-	if (!NT_STATUS_IS_OK(nt_status)) {
-		talloc_free(down_req);
+	ndr_err = ndr_push_struct_blob(&guid_value, msg, &guid,
+				       (ndr_push_flags_fn_t)ndr_push_GUID);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
-	nt_status = ndr_push_struct_blob(&nmd_value, msg, &nmd,
-					 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
+				       (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(down_req);
 		ldb_oom(module->ldb);
 		return LDB_ERR_OPERATIONS_ERROR;
@@ -723,7 +722,7 @@ static int replmd_replicated_apply_add_callback(struct ldb_context *ldb,
 
 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
 {
-	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	struct ldb_message *msg;
 	struct replPropertyMetaDataBlob *md;
 	struct ldb_val md_value;
@@ -774,9 +773,10 @@ static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
 	for (i=0; i < md->ctr.ctr1.count; i++) {
 		md->ctr.ctr1.array[i].local_usn = seq_num;
 	}
-	nt_status = ndr_push_struct_blob(&md_value, msg, md,
-					 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_push_struct_blob(&md_value, msg, md,
+				       (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 		return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
 	}
 	ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
@@ -865,7 +865,7 @@ static int replmd_replicated_apply_merge_callback(struct ldb_context *ldb,
 
 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
 {
-	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	struct ldb_message *msg;
 	struct replPropertyMetaDataBlob *rmd;
 	struct replPropertyMetaDataBlob omd;
@@ -902,9 +902,10 @@ static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
 	/* find existing meta data */
 	omd_value = ldb_msg_find_ldb_val(ar->sub.search_msg, "replPropertyMetaData");
 	if (omd_value) {
-		nt_status = ndr_pull_struct_blob(omd_value, ar->sub.mem_ctx, &omd,
-						 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
-		if (!NT_STATUS_IS_OK(nt_status)) {
+		ndr_err = ndr_pull_struct_blob(omd_value, ar->sub.mem_ctx, &omd,
+					       (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 			return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
 		}
 
@@ -984,9 +985,10 @@ static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
 	}
 
 	/* create the meta data value */
-	nt_status = ndr_push_struct_blob(&nmd_value, msg, &nmd,
-					 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
+				       (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 		return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
 	}
 
@@ -1180,7 +1182,7 @@ static int replmd_drsuapi_DsReplicaCursor2_compare(const struct drsuapi_DsReplic
 
 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
 {
-	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	struct ldb_message *msg;
 	struct replUpToDateVectorBlob ouv;
 	const struct ldb_val *ouv_value;
@@ -1223,9 +1225,10 @@ static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *a
 	 */
 	ouv_value = ldb_msg_find_ldb_val(ar->sub.search_msg, "replUpToDateVector");
 	if (ouv_value) {
-		nt_status = ndr_pull_struct_blob(ouv_value, ar->sub.mem_ctx, &ouv,
-						 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
-		if (!NT_STATUS_IS_OK(nt_status)) {
+		ndr_err = ndr_pull_struct_blob(ouv_value, ar->sub.mem_ctx, &ouv,
+					       (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 			return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
 		}
 
@@ -1347,9 +1350,10 @@ static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *a
 	if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
 	msg->dn = ar->sub.search_msg->dn;
 
-	nt_status = ndr_push_struct_blob(&nuv_value, msg, &nuv,
-					 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
+				       (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 		return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
 	}
 	ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
@@ -1383,9 +1387,10 @@ static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *a
 			trf = talloc(ar->sub.mem_ctx, struct repsFromToBlob);
 			if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
 
-			nt_status = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
-							 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
-			if (!NT_STATUS_IS_OK(nt_status)) {
+			ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
+						       (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
+			if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+				NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 				return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
 			}
 
@@ -1432,9 +1437,10 @@ static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *a
 	}
 
 	/* we now fill the value which is already attached to ldb_message */
-	nt_status = ndr_push_struct_blob(nrf_value, msg, &nrf,
-					 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_push_struct_blob(nrf_value, msg, &nrf,
+				       (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 		return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
 	}
 
diff --git a/source4/dsdb/samdb/ldb_modules/samba3sam.c b/source4/dsdb/samdb/ldb_modules/samba3sam.c
index d5a1045f93..0d4fead2b5 100644
--- a/source4/dsdb/samdb/ldb_modules/samba3sam.c
+++ b/source4/dsdb/samdb/ldb_modules/samba3sam.c
@@ -84,7 +84,7 @@ static void generate_sambaPrimaryGroupSID(struct ldb_module *module, const char
 	const struct ldb_val *sidval;
 	char *sidstring;
 	struct dom_sid *sid;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	/* We need the domain, so we get it from the objectSid that we hope is here... */
 	sidval = ldb_msg_find_ldb_val(local, "objectSid");
@@ -96,8 +96,9 @@ static void generate_sambaPrimaryGroupSID(struct ldb_module *module, const char
 	if (sid == NULL) {
 		return;
 	}
-	status = ndr_pull_struct_blob(sidval, sid, sid, (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
-	if (!NT_STATUS_IS_OK(status)) {
+
+	ndr_err = ndr_pull_struct_blob(sidval, sid, sid, (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(sid);
 		return;
 	}
@@ -179,17 +180,17 @@ static struct ldb_val encode_sid(struct ldb_module *module, TALLOC_CTX *ctx, con
 {
 	struct ldb_val out = data_blob(NULL, 0);
 	struct dom_sid *sid;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	sid = dom_sid_parse_talloc(ctx, (char *)val->data);
 	if (sid == NULL) {
 		return out;
 	}
 
-	status = ndr_push_struct_blob(&out, ctx, sid,
-				      (ndr_push_flags_fn_t)ndr_push_dom_sid);
+	ndr_err = ndr_push_struct_blob(&out, ctx, sid,
+				       (ndr_push_flags_fn_t)ndr_push_dom_sid);
 	talloc_free(sid);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return out;
 	}
 
@@ -201,16 +202,16 @@ static struct ldb_val decode_sid(struct ldb_module *module, TALLOC_CTX *ctx, con
 {
 	struct ldb_val out = data_blob(NULL, 0);
 	struct dom_sid *sid;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	sid = talloc(ctx, struct dom_sid);
 	if (sid == NULL) {
 		return out;
 	}
 
-	status = ndr_pull_struct_blob(val, sid, sid,
-				      (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_struct_blob(val, sid, sid,
+				       (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		goto done;
 	}
 
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index c054feadce..128ec13242 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -47,10 +47,11 @@ int samldb_notice_sid(struct ldb_module *module,
 static bool samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
 {
 	struct ldb_val v;
-	NTSTATUS status;
-	status = ndr_push_struct_blob(&v, msg, sid, 
-				      (ndr_push_flags_fn_t)ndr_push_dom_sid);
-	if (!NT_STATUS_IS_OK(status)) {
+	enum ndr_err_code ndr_err;
+
+	ndr_err = ndr_push_struct_blob(&v, msg, sid,
+				       (ndr_push_flags_fn_t)ndr_push_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return false;
 	}
 	return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c
index 7de873d77d..36e12e859e 100644
--- a/source4/dsdb/samdb/samdb.c
+++ b/source4/dsdb/samdb/samdb.c
@@ -388,7 +388,7 @@ struct dom_sid *samdb_result_dom_sid(TALLOC_CTX *mem_ctx, const struct ldb_messa
 {
 	const struct ldb_val *v;
 	struct dom_sid *sid;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	v = ldb_msg_find_ldb_val(msg, attr);
 	if (v == NULL) {
 		return NULL;
@@ -397,9 +397,9 @@ struct dom_sid *samdb_result_dom_sid(TALLOC_CTX *mem_ctx, const struct ldb_messa
 	if (sid == NULL) {
 		return NULL;
 	}
-	status = ndr_pull_struct_blob(v, sid, sid, 
-				      (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_struct_blob(v, sid, sid,
+				       (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(sid);
 		return NULL;
 	}
@@ -412,7 +412,7 @@ struct dom_sid *samdb_result_dom_sid(TALLOC_CTX *mem_ctx, const struct ldb_messa
 struct GUID samdb_result_guid(const struct ldb_message *msg, const char *attr)
 {
 	const struct ldb_val *v;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct GUID guid;
 	TALLOC_CTX *mem_ctx;
 
@@ -423,10 +423,10 @@ struct GUID samdb_result_guid(const struct ldb_message *msg, const char *attr)
 
 	mem_ctx = talloc_named_const(NULL, 0, "samdb_result_guid");
 	if (!mem_ctx) return guid;
-	status = ndr_pull_struct_blob(v, mem_ctx, &guid, 
-				      (ndr_pull_flags_fn_t)ndr_pull_GUID);
+	ndr_err = ndr_pull_struct_blob(v, mem_ctx, &guid,
+				       (ndr_pull_flags_fn_t)ndr_pull_GUID);
 	talloc_free(mem_ctx);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return guid;
 	}
 
@@ -758,10 +758,11 @@ int samdb_msg_add_dom_sid(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, stru
 			 const char *attr_name, struct dom_sid *sid)
 {
 	struct ldb_val v;
-	NTSTATUS status;
-	status = ndr_push_struct_blob(&v, mem_ctx, sid, 
-				      (ndr_push_flags_fn_t)ndr_push_dom_sid);
-	if (!NT_STATUS_IS_OK(status)) {
+	enum ndr_err_code ndr_err;
+
+	ndr_err = ndr_push_struct_blob(&v, mem_ctx, sid,
+				       (ndr_push_flags_fn_t)ndr_push_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return -1;
 	}
 	return ldb_msg_add_value(msg, attr_name, &v, NULL);
diff --git a/source4/dsdb/schema/schema_init.c b/source4/dsdb/schema/schema_init.c
index ff853018a2..c592bf8de0 100644
--- a/source4/dsdb/schema/schema_init.c
+++ b/source4/dsdb/schema/schema_init.c
@@ -79,13 +79,14 @@ WERROR dsdb_load_oid_mappings_ldb(struct dsdb_schema *schema,
 				  const struct ldb_val *schemaInfo)
 {
 	WERROR status;
-	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	struct prefixMapBlob pfm;
 	char *schema_info;
 
-	nt_status = ndr_pull_struct_blob(prefixMap, schema, &pfm,
-					 (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_pull_struct_blob(prefixMap, schema, &pfm,
+				       (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 		return ntstatus_to_werror(nt_status);
 	}
 
@@ -160,7 +161,7 @@ WERROR dsdb_get_oid_mappings_ldb(const struct dsdb_schema *schema,
 				 struct ldb_val *schemaInfo)
 {
 	WERROR status;
-	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
 	struct prefixMapBlob pfm;
 
@@ -171,10 +172,11 @@ WERROR dsdb_get_oid_mappings_ldb(const struct dsdb_schema *schema,
 	pfm.reserved	= 0;
 	pfm.ctr.dsdb	= *ctr;
 
-	nt_status = ndr_push_struct_blob(prefixMap, mem_ctx, &pfm,
-					 (ndr_push_flags_fn_t)ndr_push_prefixMapBlob);
+	ndr_err = ndr_push_struct_blob(prefixMap, mem_ctx, &pfm,
+				       (ndr_push_flags_fn_t)ndr_push_prefixMapBlob);
 	talloc_free(ctr);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
 		return ntstatus_to_werror(nt_status);
 	}
 
@@ -652,11 +654,12 @@ static struct drsuapi_DsReplicaAttribute *dsdb_find_object_attr_name(struct dsdb
 	if (_a && _a->value_ctr.num_values >= 1 \
 	    && _a->value_ctr.values[0].blob) { \
 		struct drsuapi_DsReplicaObjectIdentifier3 _id3; \
-		NTSTATUS _nt_status; \
-		_nt_status = ndr_pull_struct_blob_all(_a->value_ctr.values[0].blob, \
+		enum ndr_err_code _ndr_err; \
+		_ndr_err = ndr_pull_struct_blob_all(_a->value_ctr.values[0].blob, \
 						      mem_ctx, &_id3,\
 						      (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);\
-		if (!NT_STATUS_IS_OK(_nt_status)) { \
+		if (!NDR_ERR_CODE_IS_SUCCESS(_ndr_err)) { \
+			NTSTATUS _nt_status = ndr_map_error2ntstatus(_ndr_err); \
 			return ntstatus_to_werror(_nt_status); \
 		} \
 		(p)->elem = _id3.dn; \
@@ -713,11 +716,12 @@ static struct drsuapi_DsReplicaAttribute *dsdb_find_object_attr_name(struct dsdb
 	if (_a && _a->value_ctr.num_values >= 1 \
 	    && _a->value_ctr.values[0].blob \
 	    && _a->value_ctr.values[0].blob->length == 16) { \
-	    	NTSTATUS _nt_status; \
-		_nt_status = ndr_pull_struct_blob_all(_a->value_ctr.values[0].blob, \
+		enum ndr_err_code _ndr_err; \
+		_ndr_err = ndr_pull_struct_blob_all(_a->value_ctr.values[0].blob, \
 						      mem_ctx, &(p)->elem, \
 						      (ndr_pull_flags_fn_t)ndr_pull_GUID); \
-		if (!NT_STATUS_IS_OK(_nt_status)) { \
+		if (!NDR_ERR_CODE_IS_SUCCESS(_ndr_err)) { \
+			NTSTATUS _nt_status = ndr_map_error2ntstatus(_ndr_err); \
 			return ntstatus_to_werror(_nt_status); \
 		} \
 	} else { \
diff --git a/source4/dsdb/schema/schema_syntax.c b/source4/dsdb/schema/schema_syntax.c
index 760417b676..dd2da4f0f7 100644
--- a/source4/dsdb/schema/schema_syntax.c
+++ b/source4/dsdb/schema/schema_syntax.c
@@ -839,7 +839,7 @@ static WERROR dsdb_syntax_DN_drsuapi_to_ldb(const struct dsdb_schema *schema,
 
 	for (i=0; i < out->num_values; i++) {
 		struct drsuapi_DsReplicaObjectIdentifier3 id3;
-		NTSTATUS status;
+		enum ndr_err_code ndr_err;
 
 		if (in->value_ctr.values[i].blob == NULL) {
 			return WERR_FOOBAR;
@@ -849,10 +849,11 @@ static WERROR dsdb_syntax_DN_drsuapi_to_ldb(const struct dsdb_schema *schema,
 			return WERR_FOOBAR;
 		}
 
-		status = ndr_pull_struct_blob_all(in->value_ctr.values[i].blob,
-						  out->values, &id3,
-						  (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob_all(in->value_ctr.values[i].blob,
+						   out->values, &id3,
+						   (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 			return ntstatus_to_werror(status);
 		}
 
@@ -887,8 +888,8 @@ static WERROR dsdb_syntax_DN_ldb_to_drsuapi(const struct dsdb_schema *schema,
 	W_ERROR_HAVE_NO_MEMORY(blobs);
 
 	for (i=0; i < in->num_values; i++) {
-		NTSTATUS status;
 		struct drsuapi_DsReplicaObjectIdentifier3 id3;
+		enum ndr_err_code ndr_err;
 
 		out->value_ctr.values[i].blob	= &blobs[i];
 
@@ -896,9 +897,10 @@ static WERROR dsdb_syntax_DN_ldb_to_drsuapi(const struct dsdb_schema *schema,
 		ZERO_STRUCT(id3);
 		id3.dn = (const char *)in->values[i].data;
 
-		status = ndr_push_struct_blob(&blobs[i], blobs, &id3,
-					      (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_push_struct_blob(&blobs[i], blobs, &id3,
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 			return ntstatus_to_werror(status);
 		}
 	}
@@ -926,7 +928,7 @@ static WERROR dsdb_syntax_DN_BINARY_drsuapi_to_ldb(const struct dsdb_schema *sch
 		struct drsuapi_DsReplicaObjectIdentifier3Binary id3b;
 		char *binary;
 		char *str;
-		NTSTATUS status;
+		enum ndr_err_code ndr_err;
 
 		if (in->value_ctr.values[i].blob == NULL) {
 			return WERR_FOOBAR;
@@ -936,10 +938,11 @@ static WERROR dsdb_syntax_DN_BINARY_drsuapi_to_ldb(const struct dsdb_schema *sch
 			return WERR_FOOBAR;
 		}
 
-		status = ndr_pull_struct_blob_all(in->value_ctr.values[i].blob,
-						  out->values, &id3b,
-						  (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3Binary);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob_all(in->value_ctr.values[i].blob,
+						   out->values, &id3b,
+						   (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3Binary);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 			return ntstatus_to_werror(status);
 		}
 
@@ -984,8 +987,8 @@ static WERROR dsdb_syntax_DN_BINARY_ldb_to_drsuapi(const struct dsdb_schema *sch
 	W_ERROR_HAVE_NO_MEMORY(blobs);
 
 	for (i=0; i < in->num_values; i++) {
-		NTSTATUS status;
 		struct drsuapi_DsReplicaObjectIdentifier3Binary id3b;
+		enum ndr_err_code ndr_err;
 
 		out->value_ctr.values[i].blob	= &blobs[i];
 
@@ -994,9 +997,10 @@ static WERROR dsdb_syntax_DN_BINARY_ldb_to_drsuapi(const struct dsdb_schema *sch
 		id3b.dn		= (const char *)in->values[i].data;
 		id3b.binary	= data_blob(NULL, 0);
 
-		status = ndr_push_struct_blob(&blobs[i], blobs, &id3b,
-					      (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3Binary);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_push_struct_blob(&blobs[i], blobs, &id3b,
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3Binary);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 			return ntstatus_to_werror(status);
 		}
 	}
diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c
index 3ef5f9510a..52f7da25bf 100644
--- a/source4/kdc/hdb-ldb.c
+++ b/source4/kdc/hdb-ldb.c
@@ -186,7 +186,7 @@ static krb5_error_code LDB_message2entry_keys(krb5_context context,
 					      hdb_entry_ex *entry_ex)
 {
 	krb5_error_code ret = 0;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct samr_Password *hash;
 	const struct ldb_val *sc_val;
 	struct supplementalCredentialsBlob scb;
@@ -213,9 +213,9 @@ static krb5_error_code LDB_message2entry_keys(krb5_context context,
 
 	/* supplementalCredentials if present */
 	if (sc_val) {
-		status = ndr_pull_struct_blob_all(sc_val, mem_ctx, &scb,
-						  (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob_all(sc_val, mem_ctx, &scb,
+						   (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			dump_data(0, sc_val->data, sc_val->length);
 			ret = EINVAL;
 			goto out;
@@ -250,9 +250,9 @@ static krb5_error_code LDB_message2entry_keys(krb5_context context,
 		talloc_steal(mem_ctx, blob.data);
 
 		/* TODO: use ndr_pull_struct_blob_all(), when the ndr layer handles it correct with relative pointers */
-		status = ndr_pull_struct_blob(&blob, mem_ctx, &_pkb,
-					      (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, &_pkb,
+					       (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			krb5_set_error_string(context, "LDB_message2entry_keys: could not parse package_PrimaryKerberosBlob");
 			krb5_warnx(context, "LDB_message2entry_keys: could not parse package_PrimaryKerberosBlob");
 			ret = EINVAL;
diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index 9b2ea15513..d82718dda2 100644
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -52,6 +52,7 @@ static krb5_error_code make_pac(krb5_context context,
 	struct netr_SamInfo3 *info3;
 	krb5_data pac_data;
 	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB pac_out;
 	krb5_error_code ret;
 
@@ -70,9 +71,10 @@ static krb5_error_code make_pac(krb5_context context,
 
 	logon_info.info->info3 = *info3;
 
-	nt_status = ndr_push_struct_blob(&pac_out, mem_ctx, &logon_info,
-					 (ndr_push_flags_fn_t)ndr_push_PAC_LOGON_INFO_CTR);
-	if (!NT_STATUS_IS_OK(nt_status)) {
+	ndr_err = ndr_push_struct_blob(&pac_out, mem_ctx, &logon_info,
+				       (ndr_push_flags_fn_t)ndr_push_PAC_LOGON_INFO_CTR);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		nt_status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(1, ("PAC (presig) push failed: %s\n", nt_errstr(nt_status)));
 		return EINVAL;
 	}
@@ -147,6 +149,7 @@ krb5_error_code samba_kdc_reget_pac(void *priv, krb5_context context,
 				struct hdb_entry_ex *server, krb5_pac *pac)
 {
 	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	krb5_error_code ret;
 
 	unsigned int userAccountControl;
@@ -184,9 +187,10 @@ krb5_error_code samba_kdc_reget_pac(void *priv, krb5_context context,
 		return ENOMEM;
 	}
 		
-	nt_status = ndr_pull_struct_blob(&pac_in, mem_ctx, &logon_info, 
-				      (ndr_pull_flags_fn_t)ndr_pull_PAC_LOGON_INFO_CTR);
-	if (!NT_STATUS_IS_OK(nt_status) || !logon_info.info) {
+	ndr_err = ndr_pull_struct_blob(&pac_in, mem_ctx, &logon_info,
+				       (ndr_pull_flags_fn_t)ndr_pull_PAC_LOGON_INFO_CTR);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err) || !logon_info.info) {
+		nt_status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(0,("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status)));
 		talloc_free(mem_ctx);
 		return EINVAL;
diff --git a/source4/lib/ldb-samba/ldif_handlers.c b/source4/lib/ldb-samba/ldif_handlers.c
index 928a06ab43..13f9c19fb4 100644
--- a/source4/lib/ldb-samba/ldif_handlers.c
+++ b/source4/lib/ldb-samba/ldif_handlers.c
@@ -36,16 +36,16 @@
 static int ldif_read_objectSid(struct ldb_context *ldb, void *mem_ctx,
 			       const struct ldb_val *in, struct ldb_val *out)
 {
+	enum ndr_err_code ndr_err;
 	struct dom_sid *sid;
-	NTSTATUS status;
 	sid = dom_sid_parse_talloc(mem_ctx, (const char *)in->data);
 	if (sid == NULL) {
 		return -1;
 	}
-	status = ndr_push_struct_blob(out, mem_ctx, sid, 
-				      (ndr_push_flags_fn_t)ndr_push_dom_sid);
+	ndr_err = ndr_push_struct_blob(out, mem_ctx, sid,
+				       (ndr_push_flags_fn_t)ndr_push_dom_sid);
 	talloc_free(sid);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return -1;
 	}
 	return 0;
@@ -58,14 +58,15 @@ static int ldif_write_objectSid(struct ldb_context *ldb, void *mem_ctx,
 				const struct ldb_val *in, struct ldb_val *out)
 {
 	struct dom_sid *sid;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
+
 	sid = talloc(mem_ctx, struct dom_sid);
 	if (sid == NULL) {
 		return -1;
 	}
-	status = ndr_pull_struct_blob(in, sid, sid, 
-				      (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_struct_blob(in, sid, sid,
+				       (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(sid);
 		return -1;
 	}
@@ -141,15 +142,16 @@ static int ldif_read_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 {
 	struct GUID guid;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	status = GUID_from_string((const char *)in->data, &guid);
 	if (!NT_STATUS_IS_OK(status)) {
 		return -1;
 	}
 
-	status = ndr_push_struct_blob(out, mem_ctx, &guid,
-				      (ndr_push_flags_fn_t)ndr_push_GUID);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(out, mem_ctx, &guid,
+				       (ndr_push_flags_fn_t)ndr_push_GUID);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return -1;
 	}
 	return 0;
@@ -162,10 +164,10 @@ static int ldif_write_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 				 const struct ldb_val *in, struct ldb_val *out)
 {
 	struct GUID guid;
-	NTSTATUS status;
-	status = ndr_pull_struct_blob(in, mem_ctx, &guid,
-				      (ndr_pull_flags_fn_t)ndr_pull_GUID);
-	if (!NT_STATUS_IS_OK(status)) {
+	enum ndr_err_code ndr_err;
+	ndr_err = ndr_pull_struct_blob(in, mem_ctx, &guid,
+				       (ndr_pull_flags_fn_t)ndr_pull_GUID);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return -1;
 	}
 	out->data = (uint8_t *)GUID_string(mem_ctx, &guid);
@@ -246,16 +248,16 @@ static int ldif_read_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx
 					  const struct ldb_val *in, struct ldb_val *out)
 {
 	struct security_descriptor *sd;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	sd = sddl_decode(mem_ctx, (const char *)in->data, NULL);
 	if (sd == NULL) {
 		return -1;
 	}
-	status = ndr_push_struct_blob(out, mem_ctx, sd, 
-				      (ndr_push_flags_fn_t)ndr_push_security_descriptor);
+	ndr_err = ndr_push_struct_blob(out, mem_ctx, sd,
+				       (ndr_push_flags_fn_t)ndr_push_security_descriptor);
 	talloc_free(sd);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return -1;
 	}
 	return 0;
@@ -268,15 +270,15 @@ static int ldif_write_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ct
 					   const struct ldb_val *in, struct ldb_val *out)
 {
 	struct security_descriptor *sd;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	sd = talloc(mem_ctx, struct security_descriptor);
 	if (sd == NULL) {
 		return -1;
 	}
-	status = ndr_pull_struct_blob(in, sd, sd, 
-				      (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_struct_blob(in, sd, sd,
+				       (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(sd);
 		return -1;
 	}
diff --git a/source4/lib/messaging/messaging.c b/source4/lib/messaging/messaging.c
index 36cf9aa609..963dfe4f0c 100644
--- a/source4/lib/messaging/messaging.c
+++ b/source4/lib/messaging/messaging.c
@@ -666,16 +666,18 @@ NTSTATUS irpc_register(struct messaging_context *msg_ctx,
 static void irpc_handler_reply(struct messaging_context *msg_ctx, struct irpc_message *m)
 {
 	struct irpc_request *irpc;
+	enum ndr_err_code ndr_err;
 
 	irpc = (struct irpc_request *)idr_find(msg_ctx->idr, m->header.callid);
 	if (irpc == NULL) return;
 
 	/* parse the reply data */
-	irpc->status = irpc->table->calls[irpc->callnum].ndr_pull(m->ndr, NDR_OUT, irpc->r);
-	if (NT_STATUS_IS_OK(irpc->status)) {
+	ndr_err = irpc->table->calls[irpc->callnum].ndr_pull(m->ndr, NDR_OUT, irpc->r);
+	if (NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		irpc->status = m->header.status;
 		talloc_steal(irpc->mem_ctx, m);
 	} else {
+		irpc->status = ndr_map_error2ntstatus(ndr_err);
 		talloc_steal(irpc, m);
 	}
 	irpc->done = true;
@@ -691,6 +693,7 @@ NTSTATUS irpc_send_reply(struct irpc_message *m, NTSTATUS status)
 {
 	struct ndr_push *push;
 	DATA_BLOB packet;
+	enum ndr_err_code ndr_err;
 
 	m->header.status = status;
 
@@ -704,11 +707,17 @@ NTSTATUS irpc_send_reply(struct irpc_message *m, NTSTATUS status)
 	m->header.flags |= IRPC_FLAG_REPLY;
 
 	/* construct the packet */
-	status = ndr_push_irpc_header(push, NDR_SCALARS|NDR_BUFFERS, &m->header);
-	if (!NT_STATUS_IS_OK(status)) goto failed;
+	ndr_err = ndr_push_irpc_header(push, NDR_SCALARS|NDR_BUFFERS, &m->header);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		goto failed;
+	}
 
-	status = m->irpc->table->calls[m->irpc->callnum].ndr_push(push, NDR_OUT, m->data);
-	if (!NT_STATUS_IS_OK(status)) goto failed;
+	ndr_err = m->irpc->table->calls[m->irpc->callnum].ndr_push(push, NDR_OUT, m->data);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		goto failed;
+	}
 
 	/* send the reply message */
 	packet = ndr_push_blob(push);
@@ -728,7 +737,7 @@ static void irpc_handler_request(struct messaging_context *msg_ctx,
 {
 	struct irpc_list *i;
 	void *r;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	for (i=msg_ctx->irpc; i; i=i->next) {
 		if (GUID_equal(&i->uuid, &m->header.uuid) &&
@@ -749,8 +758,8 @@ static void irpc_handler_request(struct messaging_context *msg_ctx,
 	if (r == NULL) goto failed;
 
 	/* parse the request data */
-	status = i->table->calls[i->callnum].ndr_pull(m->ndr, NDR_IN, r);
-	if (!NT_STATUS_IS_OK(status)) goto failed;
+	ndr_err = i->table->calls[i->callnum].ndr_pull(m->ndr, NDR_IN, r);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) goto failed;
 
 	/* make the call */
 	m->private     = i->private;
@@ -782,7 +791,7 @@ static void irpc_handler(struct messaging_context *msg_ctx, void *private,
 			 uint32_t msg_type, struct server_id src, DATA_BLOB *packet)
 {
 	struct irpc_message *m;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	m = talloc(msg_ctx, struct irpc_message);
 	if (m == NULL) goto failed;
@@ -794,8 +803,8 @@ static void irpc_handler(struct messaging_context *msg_ctx, void *private,
 
 	m->ndr->flags |= LIBNDR_FLAG_REF_ALLOC;
 
-	status = ndr_pull_irpc_header(m->ndr, NDR_BUFFERS|NDR_SCALARS, &m->header);
-	if (!NT_STATUS_IS_OK(status)) goto failed;
+	ndr_err = ndr_pull_irpc_header(m->ndr, NDR_BUFFERS|NDR_SCALARS, &m->header);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) goto failed;
 
 	if (m->header.flags & IRPC_FLAG_REPLY) {
 		irpc_handler_reply(msg_ctx, m);
@@ -853,6 +862,7 @@ struct irpc_request *irpc_call_send(struct messaging_context *msg_ctx,
 	NTSTATUS status;
 	DATA_BLOB packet;
 	struct irpc_request *irpc;
+	enum ndr_err_code ndr_err;
 
 	irpc = talloc(msg_ctx, struct irpc_request);
 	if (irpc == NULL) goto failed;
@@ -883,11 +893,11 @@ struct irpc_request *irpc_call_send(struct messaging_context *msg_ctx,
 	ndr = ndr_push_init_ctx(irpc);
 	if (ndr == NULL) goto failed;
 
-	status = ndr_push_irpc_header(ndr, NDR_SCALARS|NDR_BUFFERS, &header);
-	if (!NT_STATUS_IS_OK(status)) goto failed;
+	ndr_err = ndr_push_irpc_header(ndr, NDR_SCALARS|NDR_BUFFERS, &header);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) goto failed;
 
-	status = table->calls[callnum].ndr_push(ndr, NDR_IN, r);
-	if (!NT_STATUS_IS_OK(status)) goto failed;
+	ndr_err = table->calls[callnum].ndr_push(ndr, NDR_IN, r);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) goto failed;
 
 	/* and send it */
 	packet = ndr_push_blob(ndr);
diff --git a/source4/lib/registry/regf.c b/source4/lib/registry/regf.c
index 2dd27ca33d..3ae299b3ef 100644
--- a/source4/lib/registry/regf.c
+++ b/source4/lib/registry/regf.c
@@ -1021,7 +1021,7 @@ static WERROR regf_set_sec_desc(struct hive_key *key,
 		     (tdr_pull_fn_t) tdr_pull_nk_block, &root);
 
 	/* Push the security descriptor to a blob */
-	if (NT_STATUS_IS_ERR(ndr_push_struct_blob(&data, regf, sec_desc,
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_push_struct_blob(&data, regf, sec_desc,
 			     (ndr_push_flags_fn_t)ndr_push_security_descriptor))) {
 		DEBUG(0, ("Unable to push security descriptor\n"));
 		return WERR_GENERAL_FAILURE;
@@ -1174,7 +1174,7 @@ static WERROR regf_get_sec_desc(TALLOC_CTX *ctx, const struct hive_key *key,
 
 	data.data = sk.sec_desc;
 	data.length = sk.rec_size;
-	if (NT_STATUS_IS_ERR(ndr_pull_struct_blob(&data, ctx, *sd,
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_pull_struct_blob(&data, ctx, *sd,
 						  (ndr_pull_flags_fn_t)ndr_pull_security_descriptor))) {
 		DEBUG(0, ("Error parsing security descriptor\n"));
 		return WERR_GENERAL_FAILURE;
diff --git a/source4/libcli/cldap/cldap.c b/source4/libcli/cldap/cldap.c
index 54b5995377..9903595dfb 100644
--- a/source4/libcli/cldap/cldap.c
+++ b/source4/libcli/cldap/cldap.c
@@ -595,6 +595,7 @@ NTSTATUS cldap_netlogon_recv(struct cldap_request *req,
 			     struct cldap_netlogon *io)
 {
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct cldap_search search;
 	DATA_BLOB *data;
 
@@ -614,13 +615,14 @@ NTSTATUS cldap_netlogon_recv(struct cldap_request *req,
 	}
 	data = search.out.response->attributes[0].values;
 
-	status = ndr_pull_union_blob_all(data, mem_ctx, &io->out.netlogon, 
-					 io->in.version & 0xF,
-					 (ndr_pull_flags_fn_t)ndr_pull_nbt_cldap_netlogon);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_union_blob_all(data, mem_ctx, &io->out.netlogon,
+					  io->in.version & 0xF,
+					  (ndr_pull_flags_fn_t)ndr_pull_nbt_cldap_netlogon);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		DEBUG(2,("cldap failed to parse netlogon response of type 0x%02x\n",
 			 SVAL(data->data, 0)));
 		dump_data(10, data->data, data->length);
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	return NT_STATUS_OK;
@@ -700,17 +702,18 @@ NTSTATUS cldap_netlogon_reply(struct cldap_socket *cldap,
 			      union nbt_cldap_netlogon *netlogon)
 {
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct cldap_reply reply;
 	struct ldap_SearchResEntry response;
 	struct ldap_Result result;
 	TALLOC_CTX *tmp_ctx = talloc_new(cldap);
 	DATA_BLOB blob;
 
-	status = ndr_push_union_blob(&blob, tmp_ctx, netlogon, version & 0xF, 
+	ndr_err = ndr_push_union_blob(&blob, tmp_ctx, netlogon, version & 0xF,
 				     (ndr_push_flags_fn_t)ndr_push_nbt_cldap_netlogon);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	reply.messageid    = message_id;
diff --git a/source4/libcli/dgram/browse.c b/source4/libcli/dgram/browse.c
index 3e78378732..3b5f67118f 100644
--- a/source4/libcli/dgram/browse.c
+++ b/source4/libcli/dgram/browse.c
@@ -34,14 +34,15 @@ NTSTATUS dgram_mailslot_browse_send(struct nbt_dgram_socket *dgmsock,
 				    struct nbt_browse_packet *request)
 {
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB blob;
 	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
 
-	status = ndr_push_struct_blob(&blob, tmp_ctx, request, 
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, request,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_browse_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	status = dgram_mailslot_send(dgmsock, DGRAM_DIRECT_UNIQUE, 
@@ -58,16 +59,17 @@ NTSTATUS dgram_mailslot_browse_reply(struct nbt_dgram_socket *dgmsock,
 				     struct nbt_browse_packet *reply)
 {
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB blob;
 	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
 	struct nbt_name myname;
 	struct socket_address *dest;
 
-	status = ndr_push_struct_blob(&blob, tmp_ctx, reply, 
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, reply,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_browse_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	make_nbt_name_client(&myname, lp_netbios_name(global_loadparm));
@@ -94,13 +96,14 @@ NTSTATUS dgram_mailslot_browse_parse(struct dgram_mailslot_handler *dgmslot,
 				     struct nbt_browse_packet *pkt)
 {
 	DATA_BLOB data = dgram_mailslot_data(dgram);
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
-	status = ndr_pull_struct_blob(&data, mem_ctx, pkt, 
+	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, pkt,
 				      (ndr_pull_flags_fn_t)ndr_pull_nbt_browse_packet);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("Failed to parse browse packet of length %d\n", 
-			 (int)data.length));
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("Failed to parse browse packet of length %d: %s\n",
+			 (int)data.length, nt_errstr(status)));
 		if (DEBUGLVL(10)) {
 			file_save("browse.dat", data.data, data.length);
 		}
diff --git a/source4/libcli/dgram/dgramsocket.c b/source4/libcli/dgram/dgramsocket.c
index 1097c30f99..1af252c0bf 100644
--- a/source4/libcli/dgram/dgramsocket.c
+++ b/source4/libcli/dgram/dgramsocket.c
@@ -39,6 +39,7 @@ static void dgm_socket_recv(struct nbt_dgram_socket *dgmsock)
 	size_t nread, dsize;
 	struct nbt_dgram_packet *packet;
 	const char *mailslot_name;
+	enum ndr_err_code ndr_err;
 
 	status = socket_pending(dgmsock->sock, &dsize);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -70,9 +71,10 @@ static void dgm_socket_recv(struct nbt_dgram_socket *dgmsock)
 	}
 
 	/* parse the request */
-	status = ndr_pull_struct_blob(&blob, packet, packet, 
+	ndr_err = ndr_pull_struct_blob(&blob, packet, packet,
 				      (ndr_pull_flags_fn_t)ndr_pull_nbt_dgram_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(2,("Failed to parse incoming NBT DGRAM packet - %s\n",
 			 nt_errstr(status)));
 		talloc_free(tmp_ctx);
@@ -218,6 +220,7 @@ NTSTATUS nbt_dgram_send(struct nbt_dgram_socket *dgmsock,
 {
 	struct nbt_dgram_request *req;
 	NTSTATUS status = NT_STATUS_NO_MEMORY;
+	enum ndr_err_code ndr_err;
 
 	req = talloc(dgmsock, struct nbt_dgram_request);
 	if (req == NULL) goto failed;
@@ -225,9 +228,12 @@ NTSTATUS nbt_dgram_send(struct nbt_dgram_socket *dgmsock,
 	req->dest = dest;
 	if (talloc_reference(req, dest) == NULL) goto failed;
 
-	status = ndr_push_struct_blob(&req->encoded, req, packet, 
+	ndr_err = ndr_push_struct_blob(&req->encoded, req, packet,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_dgram_packet);
-	if (!NT_STATUS_IS_OK(status)) goto failed;
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
+		goto failed;
+	}
 
 	DLIST_ADD_END(dgmsock->send_queue, req, struct nbt_dgram_request *);
 
diff --git a/source4/libcli/dgram/netlogon.c b/source4/libcli/dgram/netlogon.c
index 3a5510b408..f89c2c5644 100644
--- a/source4/libcli/dgram/netlogon.c
+++ b/source4/libcli/dgram/netlogon.c
@@ -36,14 +36,15 @@ NTSTATUS dgram_mailslot_netlogon_send(struct nbt_dgram_socket *dgmsock,
 				      struct nbt_netlogon_packet *request)
 {
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB blob;
 	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
 
-	status = ndr_push_struct_blob(&blob, tmp_ctx, request, 
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, request,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_netlogon_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 
@@ -65,16 +66,17 @@ NTSTATUS dgram_mailslot_netlogon_reply(struct nbt_dgram_socket *dgmsock,
 				       struct nbt_netlogon_packet *reply)
 {
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB blob;
 	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
 	struct nbt_name myname;
 	struct socket_address *dest;
 
-	status = ndr_push_struct_blob(&blob, tmp_ctx, reply, 
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, reply,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_netlogon_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	make_nbt_name_client(&myname, lp_netbios_name(global_loadparm));
@@ -105,13 +107,14 @@ NTSTATUS dgram_mailslot_netlogon_parse(struct dgram_mailslot_handler *dgmslot,
 				       struct nbt_netlogon_packet *netlogon)
 {
 	DATA_BLOB data = dgram_mailslot_data(dgram);
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
-	status = ndr_pull_struct_blob(&data, mem_ctx, netlogon, 
+	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, netlogon,
 				      (ndr_pull_flags_fn_t)ndr_pull_nbt_netlogon_packet);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("Failed to parse netlogon packet of length %d\n", 
-			 (int)data.length));
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("Failed to parse netlogon packet of length %d: %s\n",
+			 (int)data.length, nt_errstr(status)));
 		if (DEBUGLVL(10)) {
 			file_save("netlogon.dat", data.data, data.length);
 		}
diff --git a/source4/libcli/dgram/ntlogon.c b/source4/libcli/dgram/ntlogon.c
index a49f011bda..b4b548fb27 100644
--- a/source4/libcli/dgram/ntlogon.c
+++ b/source4/libcli/dgram/ntlogon.c
@@ -37,14 +37,15 @@ NTSTATUS dgram_mailslot_ntlogon_send(struct nbt_dgram_socket *dgmsock,
 				     struct nbt_ntlogon_packet *request)
 {
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB blob;
 	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
 
-	status = ndr_push_struct_blob(&blob, tmp_ctx, request, 
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, request,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_ntlogon_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 
@@ -66,16 +67,17 @@ NTSTATUS dgram_mailslot_ntlogon_reply(struct nbt_dgram_socket *dgmsock,
 				      struct nbt_ntlogon_packet *reply)
 {
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB blob;
 	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
 	struct nbt_name myname;
 	struct socket_address *dest;
 
-	status = ndr_push_struct_blob(&blob, tmp_ctx, reply, 
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, reply,
 				      (ndr_push_flags_fn_t)ndr_push_nbt_ntlogon_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	make_nbt_name_client(&myname, lp_netbios_name(global_loadparm));
@@ -107,13 +109,14 @@ NTSTATUS dgram_mailslot_ntlogon_parse(struct dgram_mailslot_handler *dgmslot,
 				      struct nbt_ntlogon_packet *ntlogon)
 {
 	DATA_BLOB data = dgram_mailslot_data(dgram);
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
-	status = ndr_pull_struct_blob(&data, mem_ctx, ntlogon, 
+	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, ntlogon,
 				      (ndr_pull_flags_fn_t)ndr_pull_nbt_ntlogon_packet);
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0,("Failed to parse ntlogon packet of length %d\n", 
-			 (int)data.length));
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
+		DEBUG(0,("Failed to parse ntlogon packet of length %d: %s\n",
+			 (int)data.length, nt_errstr(status)));
 		if (DEBUGLVL(10)) {
 			file_save("ntlogon.dat", data.data, data.length);
 		}
diff --git a/source4/libcli/ldap/ldap_ndr.c b/source4/libcli/ldap/ldap_ndr.c
index a5f90cf82b..468c366c85 100644
--- a/source4/libcli/ldap/ldap_ndr.c
+++ b/source4/libcli/ldap/ldap_ndr.c
@@ -44,11 +44,11 @@ char *ldap_encode_ndr_uint32(TALLOC_CTX *mem_ctx, uint32_t value)
 char *ldap_encode_ndr_dom_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
 {
 	DATA_BLOB blob;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	char *ret;
-	status = ndr_push_struct_blob(&blob, mem_ctx, sid, 
-				      (ndr_push_flags_fn_t)ndr_push_dom_sid);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, sid,
+				       (ndr_push_flags_fn_t)ndr_push_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return NULL;
 	}
 	ret = ldb_binary_encode(mem_ctx, blob);
@@ -63,11 +63,11 @@ char *ldap_encode_ndr_dom_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
 char *ldap_encode_ndr_GUID(TALLOC_CTX *mem_ctx, struct GUID *guid)
 {
 	DATA_BLOB blob;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	char *ret;
-	status = ndr_push_struct_blob(&blob, mem_ctx, guid, 
-				      (ndr_push_flags_fn_t)ndr_push_GUID);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, guid,
+				       (ndr_push_flags_fn_t)ndr_push_GUID);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return NULL;
 	}
 	ret = ldb_binary_encode(mem_ctx, blob);
@@ -81,12 +81,15 @@ char *ldap_encode_ndr_GUID(TALLOC_CTX *mem_ctx, struct GUID *guid)
 NTSTATUS ldap_decode_ndr_GUID(TALLOC_CTX *mem_ctx, struct ldb_val val, struct GUID *guid)
 {
 	DATA_BLOB blob;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	blob.data = val.data;
 	blob.length = val.length;
-	status = ndr_pull_struct_blob(&blob, mem_ctx, guid, 
-				      (ndr_pull_flags_fn_t)ndr_pull_GUID);
+	ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, guid,
+				       (ndr_pull_flags_fn_t)ndr_pull_GUID);
 	talloc_free(val.data);
-	return status;
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+	return NT_STATUS_OK;
 }
diff --git a/source4/libcli/nbt/nbtname.c b/source4/libcli/nbt/nbtname.c
index 1ee421b1f7..bdcd012556 100644
--- a/source4/libcli/nbt/nbtname.c
+++ b/source4/libcli/nbt/nbtname.c
@@ -42,8 +42,10 @@ _PUBLIC_ void ndr_print_nbt_string(struct ndr_print *ndr, const char *name, cons
 /*
   pull one component of a nbt_string
 */
-static NTSTATUS ndr_pull_component(struct ndr_pull *ndr, uint8_t **component,
-				   uint32_t *offset, uint32_t *max_offset)
+static enum ndr_err_code ndr_pull_component(struct ndr_pull *ndr,
+					    uint8_t **component,
+					    uint32_t *offset,
+					    uint32_t *max_offset)
 {
 	uint8_t len;
 	uint_t loops = 0;
@@ -57,7 +59,7 @@ static NTSTATUS ndr_pull_component(struct ndr_pull *ndr, uint8_t **component,
 			*offset += 1;
 			*max_offset = MAX(*max_offset, *offset);
 			*component = NULL;
-			return NT_STATUS_OK;
+			return NDR_ERR_SUCCESS;
 		}
 		if ((len & 0xC0) == 0xC0) {
 			/* its a label pointer */
@@ -81,10 +83,10 @@ static NTSTATUS ndr_pull_component(struct ndr_pull *ndr, uint8_t **component,
 					      "BAD NBT NAME component");
 		}
 		*component = (uint8_t*)talloc_strndup(ndr, (const char *)&ndr->data[1 + *offset], len);
-		NT_STATUS_HAVE_NO_MEMORY(*component);
+		NDR_ERR_HAVE_NO_MEMORY(*component);
 		*offset += len + 1;
 		*max_offset = MAX(*max_offset, *offset);
-		return NT_STATUS_OK;
+		return NDR_ERR_SUCCESS;
 	}
 
 	/* too many pointers */
@@ -94,7 +96,7 @@ static NTSTATUS ndr_pull_component(struct ndr_pull *ndr, uint8_t **component,
 /**
   pull a nbt_string from the wire
 */
-_PUBLIC_ NTSTATUS ndr_pull_nbt_string(struct ndr_pull *ndr, int ndr_flags, const char **s)
+_PUBLIC_ enum ndr_err_code ndr_pull_nbt_string(struct ndr_pull *ndr, int ndr_flags, const char **s)
 {
 	uint32_t offset = ndr->offset;
 	uint32_t max_offset = offset;
@@ -102,7 +104,7 @@ _PUBLIC_ NTSTATUS ndr_pull_nbt_string(struct ndr_pull *ndr, int ndr_flags, const
 	char *name;
 
 	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+		return NDR_ERR_SUCCESS;
 	}
 
 	name = NULL;
@@ -114,7 +116,7 @@ _PUBLIC_ NTSTATUS ndr_pull_nbt_string(struct ndr_pull *ndr, int ndr_flags, const
 		if (component == NULL) break;
 		if (name) {
 			name = talloc_asprintf_append_buffer(name, ".%s", component);
-			NT_STATUS_HAVE_NO_MEMORY(name);
+			NDR_ERR_HAVE_NO_MEMORY(name);
 		} else {
 			name = (char *)component;
 		}
@@ -125,26 +127,26 @@ _PUBLIC_ NTSTATUS ndr_pull_nbt_string(struct ndr_pull *ndr, int ndr_flags, const
 	}
 	if (num_components == 0) {
 		name = talloc_strdup(ndr, "");
-		NT_STATUS_HAVE_NO_MEMORY(name);
+		NDR_ERR_HAVE_NO_MEMORY(name);
 	}
 
 	(*s) = name;
 	ndr->offset = max_offset;
 
-	return NT_STATUS_OK;
+	return NDR_ERR_SUCCESS;
 }
 
 /**
   push a nbt string to the wire
 */
-_PUBLIC_ NTSTATUS ndr_push_nbt_string(struct ndr_push *ndr, int ndr_flags, const char *s)
+_PUBLIC_ enum ndr_err_code ndr_push_nbt_string(struct ndr_push *ndr, int ndr_flags, const char *s)
 {
 	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+		return NDR_ERR_SUCCESS;
 	}
 
 	while (s && *s) {
-		NTSTATUS status;
+		enum ndr_err_code ndr_err;
 		char *compname;
 		size_t complen;
 		uint32_t offset;
@@ -152,8 +154,8 @@ _PUBLIC_ NTSTATUS ndr_push_nbt_string(struct ndr_push *ndr, int ndr_flags, const
 		/* see if we have pushed the remaing string allready,
 		 * if so we use a label pointer to this string
 		 */
-		status = ndr_token_retrieve_cmp_fn(&ndr->nbt_string_list, s, &offset, (comparison_fn_t)strcmp, false);
-		if (NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_token_retrieve_cmp_fn(&ndr->nbt_string_list, s, &offset, (comparison_fn_t)strcmp, false);
+		if (NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			uint8_t b[2];
 			
 			if (offset > 0x3FFF) {
@@ -181,7 +183,7 @@ _PUBLIC_ NTSTATUS ndr_push_nbt_string(struct ndr_push *ndr, int ndr_flags, const
 						(unsigned char)complen,
 						(unsigned char)complen,
 						(unsigned char)complen, s);
-		NT_STATUS_HAVE_NO_MEMORY(compname);
+		NDR_ERR_HAVE_NO_MEMORY(compname);
 
 		/* remember the current componemt + the rest of the string
 		 * so it can be reused later
@@ -279,7 +281,7 @@ static uint8_t *compress_name(TALLOC_CTX *mem_ctx,
 /**
   pull a nbt name from the wire
 */
-_PUBLIC_ NTSTATUS ndr_pull_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct nbt_name *r)
+_PUBLIC_ enum ndr_err_code ndr_pull_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct nbt_name *r)
 {
 	uint8_t *scope;
 	char *cname;
@@ -287,7 +289,7 @@ _PUBLIC_ NTSTATUS ndr_pull_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct
 	bool ok;
 
 	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+		return NDR_ERR_SUCCESS;
 	}
 
 	NDR_CHECK(ndr_pull_nbt_string(ndr, ndr_flags, &s));
@@ -296,7 +298,7 @@ _PUBLIC_ NTSTATUS ndr_pull_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct
 	if (scope) {
 		*scope = 0;
 		r->scope = talloc_strdup(ndr->current_mem_ctx, (const char *)&scope[1]);
-		NT_STATUS_HAVE_NO_MEMORY(r->scope);
+		NDR_ERR_HAVE_NO_MEMORY(r->scope);
 	} else {
 		r->scope = NULL;
 	}
@@ -318,23 +320,23 @@ _PUBLIC_ NTSTATUS ndr_pull_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct
 	}
 
 	r->name = talloc_strdup(ndr->current_mem_ctx, cname);
-	NT_STATUS_HAVE_NO_MEMORY(r->name);
+	NDR_ERR_HAVE_NO_MEMORY(r->name);
 
 	talloc_free(cname);
 
-	return NT_STATUS_OK;
+	return NDR_ERR_SUCCESS;
 }
 
 /**
   push a nbt name to the wire
 */
-_PUBLIC_ NTSTATUS ndr_push_nbt_name(struct ndr_push *ndr, int ndr_flags, const struct nbt_name *r)
+_PUBLIC_ enum ndr_err_code ndr_push_nbt_name(struct ndr_push *ndr, int ndr_flags, const struct nbt_name *r)
 {
 	uint8_t *cname, *fullname;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+		return NDR_ERR_SUCCESS;
 	}
 
 	if (strlen(r->name) > 15) {
@@ -344,19 +346,19 @@ _PUBLIC_ NTSTATUS ndr_push_nbt_name(struct ndr_push *ndr, int ndr_flags, const s
 	}
 
 	cname = compress_name(ndr, (const uint8_t *)r->name, r->type);
-	NT_STATUS_HAVE_NO_MEMORY(cname);
+	NDR_ERR_HAVE_NO_MEMORY(cname);
 
 	if (r->scope) {
 		fullname = (uint8_t *)talloc_asprintf(ndr, "%s.%s", cname, r->scope);
-		NT_STATUS_HAVE_NO_MEMORY(fullname);
+		NDR_ERR_HAVE_NO_MEMORY(fullname);
 		talloc_free(cname);
 	} else {
 		fullname = cname;
 	}
 	
-	status = ndr_push_nbt_string(ndr, ndr_flags, (const char *)fullname);
+	ndr_err = ndr_push_nbt_string(ndr, ndr_flags, (const char *)fullname);
 
-	return status;
+	return ndr_err;
 }
 
 
@@ -380,18 +382,31 @@ _PUBLIC_ NTSTATUS nbt_name_dup(TALLOC_CTX *mem_ctx, struct nbt_name *name, struc
 */
 _PUBLIC_ NTSTATUS nbt_name_to_blob(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, struct nbt_name *name)
 {
-	return ndr_push_struct_blob(blob, mem_ctx, name, 
-				    (ndr_push_flags_fn_t)ndr_push_nbt_name);
-}
+	enum ndr_err_code ndr_err;
 
+	ndr_err = ndr_push_struct_blob(blob, mem_ctx, name,
+				       (ndr_push_flags_fn_t)ndr_push_nbt_name);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	return NT_STATUS_OK;
+}
 
 /**
   pull a nbt name from a blob
 */
 _PUBLIC_ NTSTATUS nbt_name_from_blob(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, struct nbt_name *name)
 {
-	return ndr_pull_struct_blob(blob, mem_ctx, name, 
-				    (ndr_pull_flags_fn_t)ndr_pull_nbt_name);
+	enum ndr_err_code ndr_err;
+
+	ndr_err = ndr_pull_struct_blob(blob, mem_ctx, name,
+				       (ndr_pull_flags_fn_t)ndr_pull_nbt_name);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	return NT_STATUS_OK;
 }
 
 
@@ -485,14 +500,14 @@ _PUBLIC_ char *nbt_name_string(TALLOC_CTX *mem_ctx, const struct nbt_name *name)
 /**
   pull a nbt name, WINS Replication uses another on wire format for nbt name
 */
-_PUBLIC_ NTSTATUS ndr_pull_wrepl_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct nbt_name **_r)
+_PUBLIC_ enum ndr_err_code ndr_pull_wrepl_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct nbt_name **_r)
 {
 	struct nbt_name *r;
 	uint8_t *namebuf;
 	uint32_t namebuf_len;
 
 	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+		return NDR_ERR_SUCCESS;
 	}
 
 	NDR_CHECK(ndr_pull_align(ndr, 4));
@@ -521,7 +536,7 @@ _PUBLIC_ NTSTATUS ndr_pull_wrepl_nbt_name(struct ndr_pull *ndr, int ndr_flags, s
 
 		talloc_free(namebuf);
 		*_r = r;
-		return NT_STATUS_OK;
+		return NDR_ERR_SUCCESS;
 	}
 
 	r->type = namebuf[15];
@@ -540,13 +555,13 @@ _PUBLIC_ NTSTATUS ndr_pull_wrepl_nbt_name(struct ndr_pull *ndr, int ndr_flags, s
 
 	talloc_free(namebuf);
 	*_r = r;
-	return NT_STATUS_OK;
+	return NDR_ERR_SUCCESS;
 }
 
 /**
   push a nbt name, WINS Replication uses another on wire format for nbt name
 */
-_PUBLIC_ NTSTATUS ndr_push_wrepl_nbt_name(struct ndr_push *ndr, int ndr_flags, const struct nbt_name *r)
+_PUBLIC_ enum ndr_err_code ndr_push_wrepl_nbt_name(struct ndr_push *ndr, int ndr_flags, const struct nbt_name *r)
 {
 	uint8_t *namebuf;
 	uint32_t namebuf_len;
@@ -559,7 +574,7 @@ _PUBLIC_ NTSTATUS ndr_push_wrepl_nbt_name(struct ndr_push *ndr, int ndr_flags, c
 	}
 
 	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+		return NDR_ERR_SUCCESS;
 	}
 
 	name_len = strlen(r->name);
@@ -602,7 +617,7 @@ _PUBLIC_ NTSTATUS ndr_push_wrepl_nbt_name(struct ndr_push *ndr, int ndr_flags, c
 	NDR_CHECK(ndr_push_array_uint8(ndr, NDR_SCALARS, namebuf, namebuf_len));
 
 	talloc_free(namebuf);
-	return NT_STATUS_OK;
+	return NDR_ERR_SUCCESS;
 }
 
 _PUBLIC_ void ndr_print_wrepl_nbt_name(struct ndr_print *ndr, const char *name, const struct nbt_name *r)
diff --git a/source4/libcli/nbt/nbtsocket.c b/source4/libcli/nbt/nbtsocket.c
index 7d88c83044..1f34b4583b 100644
--- a/source4/libcli/nbt/nbtsocket.c
+++ b/source4/libcli/nbt/nbtsocket.c
@@ -157,6 +157,7 @@ static void nbt_name_socket_recv(struct nbt_name_socket *nbtsock)
 {
 	TALLOC_CTX *tmp_ctx = talloc_new(nbtsock);
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct socket_address *src;
 	DATA_BLOB blob;
 	size_t nread, dsize;
@@ -189,9 +190,10 @@ static void nbt_name_socket_recv(struct nbt_name_socket *nbtsock)
 	}
 
 	/* parse the request */
-	status = ndr_pull_struct_blob(&blob, packet, packet, 
-				      (ndr_pull_flags_fn_t)ndr_pull_nbt_name_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_struct_blob(&blob, packet, packet,
+				       (ndr_pull_flags_fn_t)ndr_pull_nbt_name_packet);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(2,("Failed to parse incoming NBT name packet - %s\n",
 			 nt_errstr(status)));
 		talloc_free(tmp_ctx);
@@ -359,7 +361,7 @@ struct nbt_name_request *nbt_name_request_send(struct nbt_name_socket *nbtsock,
 {
 	struct nbt_name_request *req;
 	int id;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	req = talloc_zero(nbtsock, struct nbt_name_request);
 	if (req == NULL) goto failed;
@@ -392,9 +394,9 @@ struct nbt_name_request *nbt_name_request_send(struct nbt_name_socket *nbtsock,
 	
 	talloc_set_destructor(req, nbt_name_request_destructor);	
 
-	status = ndr_push_struct_blob(&req->encoded, req, request, 
-				      (ndr_push_flags_fn_t)ndr_push_nbt_name_packet);
-	if (!NT_STATUS_IS_OK(status)) goto failed;
+	ndr_err = ndr_push_struct_blob(&req->encoded, req, request,
+				       (ndr_push_flags_fn_t)ndr_push_nbt_name_packet);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) goto failed;
 
 	DLIST_ADD_END(nbtsock->send_queue, req, struct nbt_name_request *);
 
@@ -422,7 +424,7 @@ NTSTATUS nbt_name_reply_send(struct nbt_name_socket *nbtsock,
 			     struct nbt_name_packet *request)
 {
 	struct nbt_name_request *req;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	req = talloc_zero(nbtsock, struct nbt_name_request);
 	NT_STATUS_HAVE_NO_MEMORY(req);
@@ -439,11 +441,11 @@ NTSTATUS nbt_name_reply_send(struct nbt_name_socket *nbtsock,
 		NDR_PRINT_DEBUG(nbt_name_packet, request);		
 	}
 
-	status = ndr_push_struct_blob(&req->encoded, req, request, 
-				      (ndr_push_flags_fn_t)ndr_push_nbt_name_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&req->encoded, req, request,
+				       (ndr_push_flags_fn_t)ndr_push_nbt_name_packet);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(req);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	DLIST_ADD_END(nbtsock->send_queue, req, struct nbt_name_request *);
diff --git a/source4/libcli/raw/rawacl.c b/source4/libcli/raw/rawacl.c
index 168f9c0309..0f2fdb60af 100644
--- a/source4/libcli/raw/rawacl.c
+++ b/source4/libcli/raw/rawacl.c
@@ -61,6 +61,7 @@ NTSTATUS smb_raw_query_secdesc_recv(struct smbcli_request *req,
 	NTSTATUS status;
 	struct smb_nttrans nt;
 	struct ndr_pull *ndr;
+	enum ndr_err_code ndr_err;
 
 	status = smb_raw_nttrans_recv(req, mem_ctx, &nt);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -84,10 +85,13 @@ NTSTATUS smb_raw_query_secdesc_recv(struct smbcli_request *req,
 	if (!io->query_secdesc.out.sd) {
 		return NT_STATUS_NO_MEMORY;
 	}
-	status = ndr_pull_security_descriptor(ndr, NDR_SCALARS|NDR_BUFFERS, 
-					      io->query_secdesc.out.sd);
+	ndr_err = ndr_pull_security_descriptor(ndr, NDR_SCALARS|NDR_BUFFERS,
+					       io->query_secdesc.out.sd);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
-	return status;
+	return NT_STATUS_OK;
 }
 
 
@@ -114,7 +118,7 @@ struct smbcli_request *smb_raw_set_secdesc_send(struct smbcli_tree *tree,
 	uint8_t params[8];
 	struct ndr_push *ndr;
 	struct smbcli_request *req;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	nt.in.max_setup = 0;
 	nt.in.max_param = 0;
@@ -133,8 +137,8 @@ struct smbcli_request *smb_raw_set_secdesc_send(struct smbcli_tree *tree,
 	ndr = ndr_push_init_ctx(NULL);
 	if (!ndr) return NULL;
 
-	status = ndr_push_security_descriptor(ndr, NDR_SCALARS|NDR_BUFFERS, io->set_secdesc.in.sd);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_security_descriptor(ndr, NDR_SCALARS|NDR_BUFFERS, io->set_secdesc.in.sd);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(ndr);
 		return NULL;
 	}
diff --git a/source4/libcli/raw/rawfile.c b/source4/libcli/raw/rawfile.c
index 83303cf470..c34cb9c52f 100644
--- a/source4/libcli/raw/rawfile.c
+++ b/source4/libcli/raw/rawfile.c
@@ -263,7 +263,6 @@ static struct smbcli_request *smb_raw_nttrans_create_send(struct smbcli_tree *tr
 	uint16_t fname_len;
 	DATA_BLOB sd_blob, ea_blob;
 	struct smbcli_request *req;
-	NTSTATUS status;
 
 	nt.in.max_setup = 0;
 	nt.in.max_param = 101;
@@ -276,10 +275,11 @@ static struct smbcli_request *smb_raw_nttrans_create_send(struct smbcli_tree *tr
 	ea_blob = data_blob(NULL, 0);
 
 	if (parms->ntcreatex.in.sec_desc) {
-		status = ndr_push_struct_blob(&sd_blob, mem_ctx, 
-					      parms->ntcreatex.in.sec_desc, 
-					      (ndr_push_flags_fn_t)ndr_push_security_descriptor);
-		if (!NT_STATUS_IS_OK(status)) {
+		enum ndr_err_code ndr_err;
+		ndr_err = ndr_push_struct_blob(&sd_blob, mem_ctx,
+					       parms->ntcreatex.in.sec_desc,
+					       (ndr_push_flags_fn_t)ndr_push_security_descriptor);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			talloc_free(mem_ctx);
 			return NULL;
 		}
diff --git a/source4/libcli/raw/rawfileinfo.c b/source4/libcli/raw/rawfileinfo.c
index 8481995c1a..17e1792fe3 100644
--- a/source4/libcli/raw/rawfileinfo.c
+++ b/source4/libcli/raw/rawfileinfo.c
@@ -245,15 +245,17 @@ NTSTATUS smb_raw_fileinfo_passthru_parse(const DATA_BLOB *blob, TALLOC_CTX *mem_
 		return NT_STATUS_OK;
 
 	case RAW_FILEINFO_SEC_DESC: {
-		NTSTATUS status;
+		enum ndr_err_code ndr_err;
 
 		parms->query_secdesc.out.sd = talloc(mem_ctx, struct security_descriptor);
 		NT_STATUS_HAVE_NO_MEMORY(parms->query_secdesc.out.sd);
 
-		status = ndr_pull_struct_blob(blob, mem_ctx,
-					      parms->query_secdesc.out.sd,
-					      (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
-		NT_STATUS_NOT_OK_RETURN(status);
+		ndr_err = ndr_pull_struct_blob(blob, mem_ctx,
+					       parms->query_secdesc.out.sd,
+					       (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			return ndr_map_error2ntstatus(ndr_err);
+		}
 
 		return NT_STATUS_OK;
 	}
diff --git a/source4/libcli/raw/rawfsinfo.c b/source4/libcli/raw/rawfsinfo.c
index ced977333d..73f1192df0 100644
--- a/source4/libcli/raw/rawfsinfo.c
+++ b/source4/libcli/raw/rawfsinfo.c
@@ -158,6 +158,7 @@ NTSTATUS smb_raw_fsinfo_passthru_parse(DATA_BLOB blob, TALLOC_CTX *mem_ctx,
 				       union smb_fsinfo *fsinfo)
 {
 	NTSTATUS status = NT_STATUS_OK;
+	enum ndr_err_code ndr_err;
 	int i;
 
 	/* parse the results */
@@ -215,8 +216,11 @@ NTSTATUS smb_raw_fsinfo_passthru_parse(DATA_BLOB blob, TALLOC_CTX *mem_ctx,
 
 	case RAW_QFS_OBJECTID_INFORMATION:
 		QFS_CHECK_SIZE(64);
-		status = ndr_pull_struct_blob(&blob, mem_ctx, &fsinfo->objectid_information.out.guid,
-					      (ndr_pull_flags_fn_t)ndr_pull_GUID);
+		ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, &fsinfo->objectid_information.out.guid,
+					       (ndr_pull_flags_fn_t)ndr_pull_GUID);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			status = ndr_map_error2ntstatus(ndr_err);
+		}
 		for (i=0;i<6;i++) {
 			fsinfo->objectid_information.out.unknown[i] = BVAL(blob.data, 16 + i*8);
 		}
diff --git a/source4/libcli/raw/rawsetfileinfo.c b/source4/libcli/raw/rawsetfileinfo.c
index 5fa0c1f2da..3ae2a2dd20 100644
--- a/source4/libcli/raw/rawsetfileinfo.c
+++ b/source4/libcli/raw/rawsetfileinfo.c
@@ -86,12 +86,14 @@ bool smb_raw_setfileinfo_passthru(TALLOC_CTX *mem_ctx,
 		return true;
 
 	case RAW_FILEINFO_SEC_DESC: {
-		NTSTATUS status;
-
-		status = ndr_push_struct_blob(blob, mem_ctx,
-					      parms->set_secdesc.in.sd,
-					      (ndr_push_flags_fn_t)ndr_push_security_descriptor);
-		if (!NT_STATUS_IS_OK(status)) return false;
+		enum ndr_err_code ndr_err;
+
+		ndr_err = ndr_push_struct_blob(blob, mem_ctx,
+					       parms->set_secdesc.in.sd,
+					       (ndr_push_flags_fn_t)ndr_push_security_descriptor);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			return false;
+		}
 
 		return true;
 	}
diff --git a/source4/libcli/wrepl/winsrepl.c b/source4/libcli/wrepl/winsrepl.c
index 29cc1f37fd..1f7ca796b6 100644
--- a/source4/libcli/wrepl/winsrepl.c
+++ b/source4/libcli/wrepl/winsrepl.c
@@ -85,7 +85,7 @@ static NTSTATUS wrepl_finish_recv(void *private, DATA_BLOB packet_blob_in)
 	struct wrepl_socket *wrepl_socket = talloc_get_type(private, struct wrepl_socket);
 	struct wrepl_request *req = wrepl_socket->recv_queue;
 	DATA_BLOB blob;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	if (!req) {
 		DEBUG(1,("Received unexpected WINS packet of length %u!\n", 
@@ -100,10 +100,11 @@ static NTSTATUS wrepl_finish_recv(void *private, DATA_BLOB packet_blob_in)
 	blob.length = packet_blob_in.length - 4;
 	
 	/* we have a full request - parse it */
-	status = ndr_pull_struct_blob(&blob,
-				      req->packet, req->packet,
-				      (ndr_pull_flags_fn_t)ndr_pull_wrepl_packet);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_struct_blob(&blob,
+				       req->packet, req->packet,
+				       (ndr_pull_flags_fn_t)ndr_pull_wrepl_packet);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 		wrepl_request_finished(req, status);
 		return NT_STATUS_OK;
 	}
@@ -470,6 +471,7 @@ struct wrepl_request *wrepl_request_send(struct wrepl_socket *wrepl_socket,
 	struct wrepl_wrap wrap;
 	DATA_BLOB blob;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	req = talloc_zero(wrepl_socket, struct wrepl_request);
 	if (!req) return NULL;
@@ -485,9 +487,10 @@ struct wrepl_request *wrepl_request_send(struct wrepl_socket *wrepl_socket,
 	}
 
 	wrap.packet = *packet;
-	status = ndr_push_struct_blob(&blob, req, &wrap,
-				      (ndr_push_flags_fn_t)ndr_push_wrepl_wrap);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&blob, req, &wrap,
+				       (ndr_push_flags_fn_t)ndr_push_wrepl_wrap);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
 		return wrepl_request_finished(req, status);
 	}
 
diff --git a/source4/libnet/libnet_become_dc.c b/source4/libnet/libnet_become_dc.c
index ade2d340b8..7cf2eca1db 100644
--- a/source4/libnet/libnet_become_dc.c
+++ b/source4/libnet/libnet_become_dc.c
@@ -1684,6 +1684,7 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 	struct drsuapi_DsReplicaObjectIdentifier *identifier;
 	uint32_t num_attrs, i = 0;
 	struct drsuapi_DsReplicaAttribute *attrs;
+	enum ndr_err_code ndr_err;
 	bool w2k3;
 
 	/* choose a random invocationId */
@@ -1781,8 +1782,11 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 					       NULL);
 		if (composite_nomem(v, c)) return;
 
-		c->status = ndr_push_struct_blob(&vd[0], vd, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
 		vs[0].blob		= &vd[0];
 
@@ -1837,9 +1841,12 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 							  s->forest.schema_dn_str);
 		if (composite_nomem(v[0].dn, c)) return;
 
-		c->status = ndr_push_struct_blob(&vd[0], vd, &v[0],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
 		vs[0].blob		= &vd[0];
 
@@ -1864,8 +1871,11 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 
 		v = &s->dest_dsa.invocation_id;
 
-		c->status = ndr_push_struct_blob(&vd[0], vd, v, (ndr_push_flags_fn_t)ndr_push_GUID);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, v, (ndr_push_flags_fn_t)ndr_push_GUID);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
 		vs[0].blob		= &vd[0];
 
@@ -1900,17 +1910,26 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[2].sid		= s->zero_sid;
 		v[2].dn			= s->forest.schema_dn_str;
 
-		c->status = ndr_push_struct_blob(&vd[0], vd, &v[0],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
-		c->status = ndr_push_struct_blob(&vd[1], vd, &v[1],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[1], vd, &v[1],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
-		c->status = ndr_push_struct_blob(&vd[2], vd, &v[2],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[2], vd, &v[2],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
 		vs[0].blob		= &vd[0];
 		vs[1].blob		= &vd[1];
@@ -1947,17 +1966,26 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[2].sid		= s->zero_sid;
 		v[2].dn			= s->forest.schema_dn_str;
 
-		c->status = ndr_push_struct_blob(&vd[0], vd, &v[0],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
-		c->status = ndr_push_struct_blob(&vd[1], vd, &v[1],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[1], vd, &v[1],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
-		c->status = ndr_push_struct_blob(&vd[2], vd, &v[2],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[2], vd, &v[2],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
 		vs[0].blob		= &vd[0];
 		vs[1].blob		= &vd[1];
@@ -1986,9 +2014,12 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[0].sid		= s->zero_sid;
 		v[0].dn			= s->forest.schema_dn_str;
 
-		c->status = ndr_push_struct_blob(&vd[0], vd, &v[0],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
 		vs[0].blob		= &vd[0];
 
@@ -2015,9 +2046,12 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[0].sid		= s->zero_sid;
 		v[0].dn			= s->domain.dn_str;
 
-		c->status = ndr_push_struct_blob(&vd[0], vd, &v[0],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
 		vs[0].blob		= &vd[0];
 
@@ -2094,9 +2128,12 @@ static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
 		v[0].sid		= s->zero_sid;
 		v[0].dn			= s->dest_dsa.computer_dn_str;
 
-		c->status = ndr_push_struct_blob(&vd[0], vd, &v[0],
-						 (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
-		if (!composite_is_ok(c)) return;
+		ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0],
+					       (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 
 		vs[0].blob		= &vd[0];
 
diff --git a/source4/libnet/libnet_samsync_ldb.c b/source4/libnet/libnet_samsync_ldb.c
index bdc3341aa6..72b6a39239 100644
--- a/source4/libnet/libnet_samsync_ldb.c
+++ b/source4/libnet/libnet_samsync_ldb.c
@@ -165,13 +165,13 @@ static NTSTATUS samsync_ldb_handle_domain(TALLOC_CTX *mem_ctx,
 		}
 
 		if (state->samsync_state->domain_guid) {
-			NTSTATUS nt_status;
+			enum ndr_err_code ndr_err;
 			struct ldb_val v;
-			nt_status = ndr_push_struct_blob(&v, msg, state->samsync_state->domain_guid,
+			ndr_err = ndr_push_struct_blob(&v, msg, state->samsync_state->domain_guid,
 							 (ndr_push_flags_fn_t)ndr_push_GUID);
-			if (!NT_STATUS_IS_OK(nt_status)) {
+			if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 				*error_string = talloc_asprintf(mem_ctx, "ndr_push of domain GUID failed!");
-				return nt_status;
+				return ndr_map_error2ntstatus(ndr_err);
 			}
 			
 			ldb_msg_add_value(msg, "objectGUID", &v, NULL);
diff --git a/source4/libnet/libnet_vampire.c b/source4/libnet/libnet_vampire.c
index 09163f6507..40693e6362 100644
--- a/source4/libnet/libnet_vampire.c
+++ b/source4/libnet/libnet_vampire.c
@@ -49,7 +49,6 @@ static NTSTATUS fix_user(TALLOC_CTX *mem_ctx,
 	struct samr_Password lm_hash;
 	struct samr_Password nt_hash;
 	const char *username = user->account_name.string;
-	NTSTATUS nt_status;
 
 	if (rid_crypt) {
 		if (user->lm_password_present) {
@@ -66,17 +65,18 @@ static NTSTATUS fix_user(TALLOC_CTX *mem_ctx,
 	if (user->user_private_info.SensitiveData) {
 		DATA_BLOB data;
 		struct netr_USER_KEYS keys;
+		enum ndr_err_code ndr_err;
 		data.data = user->user_private_info.SensitiveData;
 		data.length = user->user_private_info.DataLength;
 		creds_arcfour_crypt(creds, data.data, data.length);
 		user->user_private_info.SensitiveData = data.data;
 		user->user_private_info.DataLength = data.length;
 
-		nt_status = ndr_pull_struct_blob(&data, mem_ctx, &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
-		if (!NT_STATUS_IS_OK(nt_status)) {
+		ndr_err = ndr_pull_struct_blob(&data, mem_ctx, &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			*error_string = talloc_asprintf(mem_ctx, "Failed to parse Sensitive Data for %s:", username);
 			dump_data(10, data.data, data.length);
-			return nt_status;
+			return ndr_map_error2ntstatus(ndr_err);
 		}
 
 		if (keys.keys.keys2.lmpassword.length == 16) {
diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 9d58fafcb8..ef63cb381b 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -192,6 +192,7 @@ static NTSTATUS ncacn_pull(struct dcerpc_connection *c, DATA_BLOB *blob, TALLOC_
 			    struct ncacn_packet *pkt)
 {
 	struct ndr_pull *ndr;
+	enum ndr_err_code ndr_err;
 
 	ndr = ndr_pull_init_flags(c, blob, mem_ctx);
 	if (!ndr) {
@@ -202,7 +203,12 @@ static NTSTATUS ncacn_pull(struct dcerpc_connection *c, DATA_BLOB *blob, TALLOC_
 		ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
 	}
 
-	return ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
+	ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	return NT_STATUS_OK;
 }
 
 /*
@@ -242,6 +248,7 @@ static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX
 	NTSTATUS status;
 	struct dcerpc_auth auth;
 	DATA_BLOB auth_blob;
+	enum ndr_err_code ndr_err;
 
 	if (pkt->auth_length == 0 &&
 	    c->security_state.auth_info->auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
@@ -270,11 +277,12 @@ static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX
 		ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
 	}
 
-	status = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
+	ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
 	}
-	
+	status = NT_STATUS_OK;
+
 	/* check signature or unseal the packet */
 	switch (c->security_state.auth_info->auth_level) {
 	case DCERPC_AUTH_LEVEL_PRIVACY:
@@ -333,6 +341,7 @@ static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c,
 	struct ndr_push *ndr;
 	DATA_BLOB creds2;
 	size_t payload_length;
+	enum ndr_err_code ndr_err;
 
 	/* non-signed packets are simpler */
 	if (!c->security_state.auth_info || 
@@ -353,10 +362,11 @@ static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c,
 		ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
 	}
 
-	status = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
+	ndr_err = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
 	}
+	status = NT_STATUS_OK;
 
 	/* pad to 16 byte multiple in the payload portion of the
 	   packet. This matches what w2k3 does */
@@ -398,10 +408,11 @@ static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c,
 	}	
 
 	/* add the auth verifier */
-	status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, c->security_state.auth_info);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
+	ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, c->security_state.auth_info);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
 	}
+	status = NT_STATUS_OK;
 
 	/* extract the whole packet as a blob */
 	*blob = ndr_push_blob(ndr);
@@ -651,11 +662,15 @@ static void dcerpc_bind_recv_handler(struct rpc_request *req,
 	/* the bind_ack might contain a reply set of credentials */
 	if (conn->security_state.auth_info &&
 	    pkt->u.bind_ack.auth_info.length) {
-		c->status = ndr_pull_struct_blob(
+		enum ndr_err_code ndr_err;
+		ndr_err = ndr_pull_struct_blob(
 			&pkt->u.bind_ack.auth_info, conn,
 			conn->security_state.auth_info,
 			(ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-		if (!composite_is_ok(c)) return;
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 	}
 
 	req->p->assoc_group_id = pkt->u.bind_ack.assoc_group_id;
@@ -1155,8 +1170,8 @@ static NTSTATUS dcerpc_ndr_validate_in(struct dcerpc_connection *c,
 	void *st;
 	struct ndr_pull *pull;
 	struct ndr_push *push;
-	NTSTATUS status;
 	DATA_BLOB blob2;
+	enum ndr_err_code ndr_err;
 
 	st = talloc_size(mem_ctx, struct_size);
 	if (!st) {
@@ -1169,11 +1184,13 @@ static NTSTATUS dcerpc_ndr_validate_in(struct dcerpc_connection *c,
 	}
 	pull->flags |= LIBNDR_FLAG_REF_ALLOC;
 
-	status = ndr_pull(pull, NDR_IN, st);
-	if (!NT_STATUS_IS_OK(status)) {
-		return ndr_pull_error(pull, NDR_ERR_VALIDATE, 
-				      "failed input validation pull - %s",
-				      nt_errstr(status));
+	ndr_err = ndr_pull(pull, NDR_IN, st);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
+		ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
+					 "failed input validation pull - %s",
+					 nt_errstr(status));
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	push = ndr_push_init_ctx(mem_ctx);
@@ -1181,11 +1198,13 @@ static NTSTATUS dcerpc_ndr_validate_in(struct dcerpc_connection *c,
 		return NT_STATUS_NO_MEMORY;
 	}	
 
-	status = ndr_push(push, NDR_IN, st);
-	if (!NT_STATUS_IS_OK(status)) {
-		return ndr_push_error(push, NDR_ERR_VALIDATE, 
-				      "failed input validation push - %s",
-				      nt_errstr(status));
+	ndr_err = ndr_push(push, NDR_IN, st);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
+		ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
+					 "failed input validation push - %s",
+					 nt_errstr(status));
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	blob2 = ndr_push_blob(push);
@@ -1195,9 +1214,9 @@ static NTSTATUS dcerpc_ndr_validate_in(struct dcerpc_connection *c,
 		dump_data(3, blob.data, blob.length);
 		DEBUG(3,("secondary:\n"));
 		dump_data(3, blob2.data, blob2.length);
-		return ndr_push_error(push, NDR_ERR_VALIDATE, 
-				      "failed input validation data - %s",
-				      nt_errstr(status));
+		ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
+					 "failed input validation blobs doesn't match");
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	return NT_STATUS_OK;
@@ -1221,10 +1240,10 @@ static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
 	void *st;
 	struct ndr_pull *pull;
 	struct ndr_push *push;
-	NTSTATUS status;
 	DATA_BLOB blob, blob2;
 	TALLOC_CTX *mem_ctx = pull_in;
 	char *s1, *s2;
+	enum ndr_err_code ndr_err;
 
 	st = talloc_size(mem_ctx, struct_size);
 	if (!st) {
@@ -1237,11 +1256,13 @@ static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
 		return NT_STATUS_NO_MEMORY;
 	}	
 
-	status = ndr_push(push, NDR_OUT, struct_ptr);
-	if (!NT_STATUS_IS_OK(status)) {
-		return ndr_push_error(push, NDR_ERR_VALIDATE, 
-				      "failed output validation push - %s",
-				      nt_errstr(status));
+	ndr_err = ndr_push(push, NDR_OUT, struct_ptr);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
+		ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
+					 "failed output validation push - %s",
+					 nt_errstr(status));
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	blob = ndr_push_blob(push);
@@ -1252,11 +1273,13 @@ static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
 	}
 
 	pull->flags |= LIBNDR_FLAG_REF_ALLOC;
-	status = ndr_pull(pull, NDR_OUT, st);
-	if (!NT_STATUS_IS_OK(status)) {
-		return ndr_pull_error(pull, NDR_ERR_VALIDATE, 
-				      "failed output validation pull - %s",
-				      nt_errstr(status));
+	ndr_err = ndr_pull(pull, NDR_OUT, st);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
+		ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
+					 "failed output validation pull - %s",
+					 nt_errstr(status));
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	push = ndr_push_init_ctx(mem_ctx);
@@ -1264,11 +1287,13 @@ static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
 		return NT_STATUS_NO_MEMORY;
 	}	
 
-	status = ndr_push(push, NDR_OUT, st);
-	if (!NT_STATUS_IS_OK(status)) {
-		return ndr_push_error(push, NDR_ERR_VALIDATE, 
-				      "failed output validation push2 - %s",
-				      nt_errstr(status));
+	ndr_err = ndr_push(push, NDR_OUT, st);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
+		ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
+					 "failed output validation push2 - %s",
+					 nt_errstr(status));
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	blob2 = ndr_push_blob(push);
@@ -1278,9 +1303,9 @@ static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
 		dump_data(3, blob.data, blob.length);
 		DEBUG(3,("secondary:\n"));
 		dump_data(3, blob2.data, blob2.length);
-		return ndr_push_error(push, NDR_ERR_VALIDATE, 
-				      "failed output validation data - %s",
-				      nt_errstr(status));
+		ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
+					 "failed output validation blobs doesn't match");
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	/* this checks the printed forms of the two structures, which effectively
@@ -1299,8 +1324,9 @@ static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
 		file_save("gen.dat", s2, strlen(s2));
 		system("diff -u wire.dat gen.dat");
 #endif
-		return ndr_push_error(push, NDR_ERR_VALIDATE,
-				      "failed output validation strings doesn't match");
+		ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
+					 "failed output validation strings doesn't match");
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	return NT_STATUS_OK;
@@ -1322,6 +1348,7 @@ struct rpc_request *dcerpc_ndr_request_send(struct dcerpc_pipe *p,
 	NTSTATUS status;
 	DATA_BLOB request;
 	struct rpc_request *req;
+	enum ndr_err_code ndr_err;
 
 	call = &table->calls[opnum];
 
@@ -1336,8 +1363,9 @@ struct rpc_request *dcerpc_ndr_request_send(struct dcerpc_pipe *p,
 	}
 
 	/* push the structure into a blob */
-	status = call->ndr_push(push, NDR_IN, r);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = call->ndr_push(push, NDR_IN, r);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
 		DEBUG(2,("Unable to ndr_push structure in dcerpc_ndr_request_send - %s\n",
 			 nt_errstr(status)));
 		talloc_free(push);
@@ -1392,6 +1420,7 @@ _PUBLIC_ NTSTATUS dcerpc_ndr_request_recv(struct rpc_request *req)
 	uint32_t opnum = req->ndr.opnum;
 	const struct ndr_interface_table *table = req->ndr.table;
 	const struct ndr_interface_call *call = &table->calls[opnum];
+	enum ndr_err_code ndr_err;
 
 	/* make sure the recv code doesn't free the request, as we
 	   need to grab the flags element before it is freed */
@@ -1427,8 +1456,9 @@ _PUBLIC_ NTSTATUS dcerpc_ndr_request_recv(struct rpc_request *req)
 	dump_data(10, pull->data, pull->data_size);
 
 	/* pull the structure from the blob */
-	status = call->ndr_pull(pull, NDR_OUT, r);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = call->ndr_pull(pull, NDR_OUT, r);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		status = ndr_map_error2ntstatus(ndr_err);
 		dcerpc_log_packet(table, opnum, NDR_OUT, 
 				  &response);
 		return status;
@@ -1547,11 +1577,15 @@ static void dcerpc_alter_recv_handler(struct rpc_request *req,
 	/* the alter_resp might contain a reply set of credentials */
 	if (recv_pipe->conn->security_state.auth_info &&
 	    pkt->u.alter_resp.auth_info.length) {
-		c->status = ndr_pull_struct_blob(
+		enum ndr_err_code ndr_err;
+		ndr_err = ndr_pull_struct_blob(
 			&pkt->u.alter_resp.auth_info, recv_pipe,
 			recv_pipe->conn->security_state.auth_info,
 			(ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-		if (!composite_is_ok(c)) return;
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			c->status = ndr_map_error2ntstatus(ndr_err);
+			if (!composite_is_ok(c)) return;
+		}
 	}
 
 	composite_done(c);
diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c
index aa65861c3f..6c23ec20a0 100644
--- a/source4/librpc/rpc/dcerpc_util.c
+++ b/source4/librpc/rpc/dcerpc_util.c
@@ -53,8 +53,8 @@ NTSTATUS ncacn_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
 			  struct ncacn_packet *pkt,
 			  struct dcerpc_auth *auth_info)
 {
-	NTSTATUS status;
 	struct ndr_push *ndr;
+	enum ndr_err_code ndr_err;
 
 	ndr = ndr_push_init_ctx(mem_ctx);
 	if (!ndr) {
@@ -75,15 +75,15 @@ NTSTATUS ncacn_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
 		pkt->auth_length = 0;
 	}
 
-	status = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
+	ndr_err = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	if (auth_info) {
-		status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth_info);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
+		ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth_info);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			return ndr_map_error2ntstatus(ndr_err);
 		}
 	}
 
@@ -440,22 +440,23 @@ NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *epm_floor, struct ndr_synta
 {
 	TALLOC_CTX *mem_ctx = talloc_init("floor_get_lhs_data");
 	struct ndr_pull *ndr = ndr_pull_init_blob(&epm_floor->lhs.lhs_data, mem_ctx);
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	uint16_t if_version=0;
 
 	ndr->flags |= LIBNDR_FLAG_NOALIGN;
 
-	status = ndr_pull_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(mem_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
-	status = ndr_pull_uint16(ndr, NDR_SCALARS, &if_version);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_uint16(ndr, NDR_SCALARS, &if_version);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(mem_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
+
 	syntax->if_version = if_version;
 
 	talloc_free(mem_ctx);
diff --git a/source4/ntptr/simple_ldb/ntptr_simple_ldb.c b/source4/ntptr/simple_ldb/ntptr_simple_ldb.c
index 4046c1bdbd..2544e9eb97 100644
--- a/source4/ntptr/simple_ldb/ntptr_simple_ldb.c
+++ b/source4/ntptr/simple_ldb/ntptr_simple_ldb.c
@@ -166,7 +166,7 @@ static WERROR sptr_GetPrintServerData(struct ntptr_GenericHandle *server, TALLOC
 		return WERR_OK;
 	} else if (strcmp("OSVersion", r->in.value_name) == 0) {
 		DATA_BLOB blob;
-		NTSTATUS status;
+		enum ndr_err_code ndr_err;
 		struct spoolss_OSVersion os;
 
 		os.major		= dcesrv_common_get_version_major(mem_ctx, NULL);
@@ -174,8 +174,8 @@ static WERROR sptr_GetPrintServerData(struct ntptr_GenericHandle *server, TALLOC
 		os.build		= dcesrv_common_get_version_build(mem_ctx, NULL);
 		os.extra_string		= "";
 
-		status = ndr_push_struct_blob(&blob, mem_ctx, &os, (ndr_push_flags_fn_t)ndr_push_spoolss_OSVersion);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_push_struct_blob(&blob, mem_ctx, &os, (ndr_push_flags_fn_t)ndr_push_spoolss_OSVersion);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			return WERR_GENERAL_FAILURE;
 		}
 
@@ -184,7 +184,7 @@ static WERROR sptr_GetPrintServerData(struct ntptr_GenericHandle *server, TALLOC
 		return WERR_OK;
 	} else if (strcmp("OSVersionEx", r->in.value_name) == 0) {
 		DATA_BLOB blob;
-		NTSTATUS status;
+		enum ndr_err_code ndr_err;
 		struct spoolss_OSVersionEx os_ex;
 
 		os_ex.major		= dcesrv_common_get_version_major(mem_ctx, NULL);
@@ -194,8 +194,8 @@ static WERROR sptr_GetPrintServerData(struct ntptr_GenericHandle *server, TALLOC
 		os_ex.unknown2		= 0;
 		os_ex.unknown3		= 0;
 
-		status = ndr_push_struct_blob(&blob, mem_ctx, &os_ex, (ndr_push_flags_fn_t)ndr_push_spoolss_OSVersionEx);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_push_struct_blob(&blob, mem_ctx, &os_ex, (ndr_push_flags_fn_t)ndr_push_spoolss_OSVersionEx);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			return WERR_GENERAL_FAILURE;
 		}
 
diff --git a/source4/ntvfs/common/notify.c b/source4/ntvfs/common/notify.c
index 0214c39b2d..4578dfbf10 100644
--- a/source4/ntvfs/common/notify.c
+++ b/source4/ntvfs/common/notify.c
@@ -146,7 +146,7 @@ static NTSTATUS notify_load(struct notify_context *notify)
 {
 	TDB_DATA dbuf;
 	DATA_BLOB blob;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	int seqnum;
 
 	seqnum = tdb_get_seqnum(notify->w->tdb);
@@ -169,11 +169,14 @@ static NTSTATUS notify_load(struct notify_context *notify)
 	blob.data = dbuf.dptr;
 	blob.length = dbuf.dsize;
 
-	status = ndr_pull_struct_blob(&blob, notify->array, notify->array, 
-				      (ndr_pull_flags_fn_t)ndr_pull_notify_array);
+	ndr_err = ndr_pull_struct_blob(&blob, notify->array, notify->array,
+				       (ndr_pull_flags_fn_t)ndr_pull_notify_array);
 	free(dbuf.dptr);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
-	return status;
+	return NT_STATUS_OK;
 }
 
 /*
@@ -192,7 +195,7 @@ static NTSTATUS notify_save(struct notify_context *notify)
 {
 	TDB_DATA dbuf;
 	DATA_BLOB blob;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	int ret;
 	TALLOC_CTX *tmp_ctx;
 
@@ -214,11 +217,11 @@ static NTSTATUS notify_save(struct notify_context *notify)
 	tmp_ctx = talloc_new(notify);
 	NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 
-	status = ndr_push_struct_blob(&blob, tmp_ctx, notify->array, 
-				      (ndr_push_flags_fn_t)ndr_push_notify_array);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, notify->array,
+				       (ndr_push_flags_fn_t)ndr_push_notify_array);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	dbuf.dptr = blob.data;
@@ -241,7 +244,7 @@ static void notify_handler(struct messaging_context *msg_ctx, void *private_data
 			   uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
 {
 	struct notify_context *notify = talloc_get_type(private_data, struct notify_context);
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct notify_event ev;
 	TALLOC_CTX *tmp_ctx = talloc_new(notify);
 	struct notify_list *listel;
@@ -250,9 +253,9 @@ static void notify_handler(struct messaging_context *msg_ctx, void *private_data
 		return;
 	}
 
-	status = ndr_pull_struct_blob(data, tmp_ctx, &ev, 
+	ndr_err = ndr_pull_struct_blob(data, tmp_ctx, &ev,
 				      (ndr_pull_flags_fn_t)ndr_pull_notify_event);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
 		return;
 	}
@@ -540,6 +543,7 @@ static void notify_send(struct notify_context *notify, struct notify_entry *e,
 	struct notify_event ev;
 	DATA_BLOB data;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	TALLOC_CTX *tmp_ctx;
 
 	ev.action = action;
@@ -548,9 +552,9 @@ static void notify_send(struct notify_context *notify, struct notify_entry *e,
 
 	tmp_ctx = talloc_new(notify);
 
-	status = ndr_push_struct_blob(&data, tmp_ctx, &ev, 
+	ndr_err = ndr_push_struct_blob(&data, tmp_ctx, &ev,
 				      (ndr_push_flags_fn_t)ndr_push_notify_event);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(tmp_ctx);
 		return;
 	}
diff --git a/source4/ntvfs/common/opendb_tdb.c b/source4/ntvfs/common/opendb_tdb.c
index a037e7e47e..07eef829e1 100644
--- a/source4/ntvfs/common/opendb_tdb.c
+++ b/source4/ntvfs/common/opendb_tdb.c
@@ -195,8 +195,8 @@ static NTSTATUS odb_pull_record(struct odb_lock *lck, struct opendb_file *file)
 	struct odb_context *odb = lck->odb;
 	TDB_DATA dbuf;
 	DATA_BLOB blob;
-	NTSTATUS status;
-		
+	enum ndr_err_code ndr_err;
+
 	dbuf = tdb_fetch(odb->w->tdb, lck->key);
 	if (dbuf.dptr == NULL) {
 		return NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -205,11 +205,13 @@ static NTSTATUS odb_pull_record(struct odb_lock *lck, struct opendb_file *file)
 	blob.data = dbuf.dptr;
 	blob.length = dbuf.dsize;
 
-	status = ndr_pull_struct_blob(&blob, lck, file, (ndr_pull_flags_fn_t)ndr_pull_opendb_file);
-
+	ndr_err = ndr_pull_struct_blob(&blob, lck, file, (ndr_pull_flags_fn_t)ndr_pull_opendb_file);
 	free(dbuf.dptr);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
-	return status;
+	return NT_STATUS_OK;
 }
 
 /*
@@ -220,7 +222,7 @@ static NTSTATUS odb_push_record(struct odb_lock *lck, struct opendb_file *file)
 	struct odb_context *odb = lck->odb;
 	TDB_DATA dbuf;
 	DATA_BLOB blob;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	int ret;
 
 	if (file->num_entries == 0) {
@@ -231,8 +233,10 @@ static NTSTATUS odb_push_record(struct odb_lock *lck, struct opendb_file *file)
 		return NT_STATUS_OK;
 	}
 
-	status = ndr_push_struct_blob(&blob, lck, file, (ndr_push_flags_fn_t)ndr_push_opendb_file);
-	NT_STATUS_NOT_OK_RETURN(status);
+	ndr_err = ndr_push_struct_blob(&blob, lck, file, (ndr_push_flags_fn_t)ndr_push_opendb_file);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
 	dbuf.dptr = blob.data;
 	dbuf.dsize = blob.length;
diff --git a/source4/ntvfs/ipc/ipc_rap.c b/source4/ntvfs/ipc/ipc_rap.c
index 605a172a70..2a9d66cae8 100644
--- a/source4/ntvfs/ipc/ipc_rap.c
+++ b/source4/ntvfs/ipc/ipc_rap.c
@@ -24,6 +24,33 @@
 #include "ntvfs/ipc/proto.h"
 #include "librpc/ndr/libndr.h"
 
+#define NDR_RETURN(call) do { \
+	enum ndr_err_code _ndr_err; \
+	_ndr_err = call; \
+	if (!NDR_ERR_CODE_IS_SUCCESS(_ndr_err)) { \
+		return ndr_map_error2ntstatus(_ndr_err); \
+	} \
+} while (0)
+
+#define RAP_GOTO(call) do { \
+	result = call; \
+	if (NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL)) {\
+		goto buffer_overflow; \
+	} \
+	if (!NT_STATUS_IS_OK(result)) { \
+		goto done; \
+	} \
+} while (0)
+
+#define NDR_GOTO(call) do { \
+	enum ndr_err_code _ndr_err; \
+	_ndr_err = call; \
+	if (!NDR_ERR_CODE_IS_SUCCESS(_ndr_err)) { \
+		RAP_GOTO(ndr_map_error2ntstatus(_ndr_err)); \
+	} \
+} while (0)
+
+
 #define NERR_Success 0
 #define NERR_badpass 86
 #define NERR_notsupported 50
@@ -108,22 +135,37 @@ static struct rap_call *new_rap_srv_call(TALLOC_CTX *mem_ctx,
 
 static NTSTATUS rap_srv_pull_word(struct rap_call *call, uint16_t *result)
 {
+	enum ndr_err_code ndr_err;
+
 	if (*call->paramdesc++ != 'W')
 		return NT_STATUS_INVALID_PARAMETER;
 
-	return ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, result);
+	ndr_err = ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, result);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	return NT_STATUS_OK;
 }
 
 static NTSTATUS rap_srv_pull_dword(struct rap_call *call, uint32_t *result)
 {
+	enum ndr_err_code ndr_err;
+
 	if (*call->paramdesc++ != 'D')
 		return NT_STATUS_INVALID_PARAMETER;
 
-	return ndr_pull_uint32(call->ndr_pull_param, NDR_SCALARS, result);
+	ndr_err = ndr_pull_uint32(call->ndr_pull_param, NDR_SCALARS, result);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	return NT_STATUS_OK;
 }
 
 static NTSTATUS rap_srv_pull_string(struct rap_call *call, const char **result)
 {
+	enum ndr_err_code ndr_err;
 	char paramdesc = *call->paramdesc++;
 
 	if (paramdesc == 'O') {
@@ -134,20 +176,25 @@ static NTSTATUS rap_srv_pull_string(struct rap_call *call, const char **result)
 	if (paramdesc != 'z')
 		return NT_STATUS_INVALID_PARAMETER;
 
-	return ndr_pull_string(call->ndr_pull_param, NDR_SCALARS, result);
+	ndr_err = ndr_pull_string(call->ndr_pull_param, NDR_SCALARS, result);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	return NT_STATUS_OK;
 }
 
 static NTSTATUS rap_srv_pull_bufsize(struct rap_call *call, uint16_t *bufsize)
 {
-	NTSTATUS result;
+	enum ndr_err_code ndr_err;
 
 	if ( (*call->paramdesc++ != 'r') || (*call->paramdesc++ != 'L') )
 		return NT_STATUS_INVALID_PARAMETER;
 
-	result = ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, bufsize);
-
-	if (!NT_STATUS_IS_OK(result))
-		return result;
+	ndr_err = ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, bufsize);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
 	call->heap->offset = *bufsize;
 
@@ -178,8 +225,8 @@ static NTSTATUS rap_push_string(struct ndr_push *data_push,
 
 	heap->offset -= space;
 
-	NDR_CHECK(ndr_push_uint16(data_push, NDR_SCALARS, heap->offset));
-	NDR_CHECK(ndr_push_uint16(data_push, NDR_SCALARS, 0));
+	NDR_RETURN(ndr_push_uint16(data_push, NDR_SCALARS, heap->offset));
+	NDR_RETURN(ndr_push_uint16(data_push, NDR_SCALARS, 0));
 
 	heap->strings = talloc_realloc(heap->mem_ctx,
 					 heap->strings,
@@ -195,21 +242,14 @@ static NTSTATUS rap_push_string(struct ndr_push *data_push,
 	return NT_STATUS_OK;
 }
 
-#define NDR_OK(call) do { result = call; \
-			     if (NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL)) \
-				goto buffer_overflow; \
-                             if (!NT_STATUS_IS_OK(result)) \
-				goto done; \
-                        } while (0)
-
 static NTSTATUS _rap_netshareenum(struct rap_call *call)
 {
 	struct rap_NetShareEnum r;
 	NTSTATUS result;
 
-	NDR_OK(rap_srv_pull_word(call, &r.in.level));
-	NDR_OK(rap_srv_pull_bufsize(call, &r.in.bufsize));
-	NDR_OK(rap_srv_pull_expect_multiple(call));
+	RAP_GOTO(rap_srv_pull_word(call, &r.in.level));
+	RAP_GOTO(rap_srv_pull_bufsize(call, &r.in.bufsize));
+	RAP_GOTO(rap_srv_pull_expect_multiple(call));
 
 	switch(r.in.level) {
 	case 0:
@@ -241,20 +281,20 @@ static NTSTATUS _rap_netshareenum(struct rap_call *call)
 
 		switch(r.in.level) {
 		case 0:
-			NDR_OK(ndr_push_bytes(call->ndr_push_data,
+			NDR_GOTO(ndr_push_bytes(call->ndr_push_data,
 					      (const uint8_t *)r.out.info[i].info0.name,
 					      sizeof(r.out.info[i].info0.name)));
 			break;
 		case 1:
-			NDR_OK(ndr_push_bytes(call->ndr_push_data,
+			NDR_GOTO(ndr_push_bytes(call->ndr_push_data,
 					      (const uint8_t *)r.out.info[i].info1.name,
 					      sizeof(r.out.info[i].info1.name)));
-			NDR_OK(ndr_push_uint8(call->ndr_push_data,
+			NDR_GOTO(ndr_push_uint8(call->ndr_push_data,
 					      NDR_SCALARS, r.out.info[i].info1.pad));
-			NDR_OK(ndr_push_uint16(call->ndr_push_data,
+			NDR_GOTO(ndr_push_uint16(call->ndr_push_data,
 					       NDR_SCALARS, r.out.info[i].info1.type));
 
-			NDR_OK(rap_push_string(call->ndr_push_data,
+			RAP_GOTO(rap_push_string(call->ndr_push_data,
 					       call->heap,
 					       r.out.info[i].info1.comment));
 
@@ -273,8 +313,8 @@ static NTSTATUS _rap_netshareenum(struct rap_call *call)
 
 	call->status = r.out.status;
 
-	NDR_CHECK(ndr_push_uint16(call->ndr_push_param, NDR_SCALARS, r.out.count));
-	NDR_CHECK(ndr_push_uint16(call->ndr_push_param, NDR_SCALARS, r.out.available));
+	NDR_RETURN(ndr_push_uint16(call->ndr_push_param, NDR_SCALARS, r.out.count));
+	NDR_RETURN(ndr_push_uint16(call->ndr_push_param, NDR_SCALARS, r.out.available));
 
 	result = NT_STATUS_OK;
 
@@ -287,11 +327,11 @@ static NTSTATUS _rap_netserverenum2(struct rap_call *call)
 	struct rap_NetServerEnum2 r;
 	NTSTATUS result;
 
-	NDR_OK(rap_srv_pull_word(call, &r.in.level));
-	NDR_OK(rap_srv_pull_bufsize(call, &r.in.bufsize));
-	NDR_OK(rap_srv_pull_expect_multiple(call));
-	NDR_OK(rap_srv_pull_dword(call, &r.in.servertype));
-	NDR_OK(rap_srv_pull_string(call, &r.in.domain));
+	RAP_GOTO(rap_srv_pull_word(call, &r.in.level));
+	RAP_GOTO(rap_srv_pull_bufsize(call, &r.in.bufsize));
+	RAP_GOTO(rap_srv_pull_expect_multiple(call));
+	RAP_GOTO(rap_srv_pull_dword(call, &r.in.servertype));
+	RAP_GOTO(rap_srv_pull_string(call, &r.in.domain));
 
 	switch(r.in.level) {
 	case 0:
@@ -323,22 +363,22 @@ static NTSTATUS _rap_netserverenum2(struct rap_call *call)
 
 		switch(r.in.level) {
 		case 0:
-			NDR_OK(ndr_push_bytes(call->ndr_push_data,
+			NDR_GOTO(ndr_push_bytes(call->ndr_push_data,
 					      (const uint8_t *)r.out.info[i].info0.name,
 					      sizeof(r.out.info[i].info0.name)));
 			break;
 		case 1:
-			NDR_OK(ndr_push_bytes(call->ndr_push_data,
+			NDR_GOTO(ndr_push_bytes(call->ndr_push_data,
 					      (const uint8_t *)r.out.info[i].info1.name,
 					      sizeof(r.out.info[i].info1.name)));
-			NDR_OK(ndr_push_uint8(call->ndr_push_data,
+			NDR_GOTO(ndr_push_uint8(call->ndr_push_data,
 					      NDR_SCALARS, r.out.info[i].info1.version_major));
-			NDR_OK(ndr_push_uint8(call->ndr_push_data,
+			NDR_GOTO(ndr_push_uint8(call->ndr_push_data,
 					      NDR_SCALARS, r.out.info[i].info1.version_minor));
-			NDR_OK(ndr_push_uint32(call->ndr_push_data,
+			NDR_GOTO(ndr_push_uint32(call->ndr_push_data,
 					       NDR_SCALARS, r.out.info[i].info1.servertype));
 
-			NDR_OK(rap_push_string(call->ndr_push_data,
+			RAP_GOTO(rap_push_string(call->ndr_push_data,
 					       call->heap,
 					       r.out.info[i].info1.comment));
 
@@ -357,8 +397,8 @@ static NTSTATUS _rap_netserverenum2(struct rap_call *call)
 
 	call->status = r.out.status;
 
-	NDR_CHECK(ndr_push_uint16(call->ndr_push_param, NDR_SCALARS, r.out.count));
-	NDR_CHECK(ndr_push_uint16(call->ndr_push_param, NDR_SCALARS, r.out.available));
+	NDR_RETURN(ndr_push_uint16(call->ndr_push_param, NDR_SCALARS, r.out.count));
+	NDR_RETURN(ndr_push_uint16(call->ndr_push_param, NDR_SCALARS, r.out.available));
 
 	result = NT_STATUS_OK;
 
@@ -398,10 +438,10 @@ NTSTATUS ipc_rap_call(TALLOC_CTX *mem_ctx, struct smb_trans2 *trans)
 	if (call == NULL)
 		return NT_STATUS_NO_MEMORY;
 
-	NDR_CHECK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &call->callno));
-	NDR_CHECK(ndr_pull_string(call->ndr_pull_param, NDR_SCALARS,
+	NDR_RETURN(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &call->callno));
+	NDR_RETURN(ndr_pull_string(call->ndr_pull_param, NDR_SCALARS,
 				  &call->paramdesc));
-	NDR_CHECK(ndr_pull_string(call->ndr_pull_param, NDR_SCALARS,
+	NDR_RETURN(ndr_pull_string(call->ndr_pull_param, NDR_SCALARS,
 				  &call->datadesc));
 
 	call->ndr_push_param = ndr_push_init_ctx(call);
@@ -439,17 +479,17 @@ NTSTATUS ipc_rap_call(TALLOC_CTX *mem_ctx, struct smb_trans2 *trans)
 	final_param->flags = RAPNDR_FLAGS;
 	final_data->flags = RAPNDR_FLAGS;
 
-	NDR_CHECK(ndr_push_uint16(final_param, NDR_SCALARS, call->status));
-	NDR_CHECK(ndr_push_uint16(final_param,
+	NDR_RETURN(ndr_push_uint16(final_param, NDR_SCALARS, call->status));
+	NDR_RETURN(ndr_push_uint16(final_param,
 				  NDR_SCALARS, call->heap->offset - result_data.length));
-	NDR_CHECK(ndr_push_bytes(final_param, result_param.data,
+	NDR_RETURN(ndr_push_bytes(final_param, result_param.data,
 				 result_param.length));
 
-	NDR_CHECK(ndr_push_bytes(final_data, result_data.data,
+	NDR_RETURN(ndr_push_bytes(final_data, result_data.data,
 				 result_data.length));
 
 	for (i=call->heap->num_strings-1; i>=0; i--)
-		NDR_CHECK(ndr_push_string(final_data, NDR_SCALARS,
+		NDR_RETURN(ndr_push_string(final_data, NDR_SCALARS,
 					  call->heap->strings[i]));
 
 	trans->out.setup_count = 0;
diff --git a/source4/ntvfs/posix/pvfs_xattr.c b/source4/ntvfs/posix/pvfs_xattr.c
index ead3585e0d..f723aad955 100644
--- a/source4/ntvfs/posix/pvfs_xattr.c
+++ b/source4/ntvfs/posix/pvfs_xattr.c
@@ -107,6 +107,7 @@ _PUBLIC_ NTSTATUS pvfs_xattr_ndr_load(struct pvfs_state *pvfs,
 {
 	NTSTATUS status;
 	DATA_BLOB blob;
+	enum ndr_err_code ndr_err;
 
 	status = pull_xattr_blob(pvfs, mem_ctx, attr_name, fname, 
 				 fd, XATTR_DOSATTRIB_ESTIMATED_SIZE, &blob);
@@ -115,11 +116,14 @@ _PUBLIC_ NTSTATUS pvfs_xattr_ndr_load(struct pvfs_state *pvfs,
 	}
 
 	/* pull the blob */
-	status = ndr_pull_struct_blob(&blob, mem_ctx, p, (ndr_pull_flags_fn_t)pull_fn);
+	ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, p, (ndr_pull_flags_fn_t)pull_fn);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
 	data_blob_free(&blob);
 
-	return status;
+	return NT_STATUS_OK;
 }
 
 /*
@@ -132,11 +136,12 @@ _PUBLIC_ NTSTATUS pvfs_xattr_ndr_save(struct pvfs_state *pvfs,
 	TALLOC_CTX *mem_ctx = talloc_new(NULL);
 	DATA_BLOB blob;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
-	status = ndr_push_struct_blob(&blob, mem_ctx, p, (ndr_push_flags_fn_t)push_fn);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_struct_blob(&blob, mem_ctx, p, (ndr_push_flags_fn_t)push_fn);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(mem_ctx);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	status = push_xattr_blob(pvfs, attr_name, fname, fd, &blob);
diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index 4388c86f22..e146509b67 100644
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -1027,6 +1027,7 @@ static int dcesrv_call_dequeue(struct dcesrv_call_state *call)
 NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
 {
 	struct ndr_pull *ndr;
+	enum ndr_err_code ndr_err;
 	NTSTATUS status;
 	struct dcesrv_call_state *call;
 	DATA_BLOB blob;
@@ -1059,11 +1060,11 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
 		ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
 	}
 
-	status = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, &call->pkt);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, &call->pkt);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(dce_conn->partial_input.data);
 		talloc_free(call);
-		return status;
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	/* we have to check the signing here, before combining the
diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index 911cfe4799..0ce55dd069 100644
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -39,6 +39,7 @@ bool dcesrv_auth_bind(struct dcesrv_call_state *call)
 	struct dcesrv_connection *dce_conn = call->conn;
 	struct dcesrv_auth *auth = &dce_conn->auth_state;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	if (pkt->u.bind.auth_info.length == 0) {
 		dce_conn->auth_state.auth_info = NULL;
@@ -50,11 +51,11 @@ bool dcesrv_auth_bind(struct dcesrv_call_state *call)
 		return false;
 	}
 
-	status = ndr_pull_struct_blob(&pkt->u.bind.auth_info,
-				      call,
-				      dce_conn->auth_state.auth_info,
-				      (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_struct_blob(&pkt->u.bind.auth_info,
+				       call,
+				       dce_conn->auth_state.auth_info,
+				       (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return false;
 	}
 
@@ -143,6 +144,7 @@ bool dcesrv_auth_auth3(struct dcesrv_call_state *call)
 	struct ncacn_packet *pkt = &call->pkt;
 	struct dcesrv_connection *dce_conn = call->conn;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	/* We can't work without an existing gensec state, and an new blob to feed it */
 	if (!dce_conn->auth_state.auth_info ||
@@ -151,11 +153,11 @@ bool dcesrv_auth_auth3(struct dcesrv_call_state *call)
 		return false;
 	}
 
-	status = ndr_pull_struct_blob(&pkt->u.auth3.auth_info,
-				      call,
-				      dce_conn->auth_state.auth_info,
-				      (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_struct_blob(&pkt->u.auth3.auth_info,
+				       call,
+				       dce_conn->auth_state.auth_info,
+				       (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return false;
 	}
 
@@ -192,7 +194,7 @@ bool dcesrv_auth_alter(struct dcesrv_call_state *call)
 {
 	struct ncacn_packet *pkt = &call->pkt;
 	struct dcesrv_connection *dce_conn = call->conn;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	/* on a pure interface change there is no auth blob */
 	if (pkt->u.alter.auth_info.length == 0) {
@@ -209,11 +211,11 @@ bool dcesrv_auth_alter(struct dcesrv_call_state *call)
 		return false;
 	}
 
-	status = ndr_pull_struct_blob(&pkt->u.alter.auth_info,
-				      call,
-				      dce_conn->auth_state.auth_info,
-				      (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_struct_blob(&pkt->u.alter.auth_info,
+				       call,
+				       dce_conn->auth_state.auth_info,
+				       (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return false;
 	}
 
@@ -304,6 +306,7 @@ bool dcesrv_auth_request(struct dcesrv_call_state *call, DATA_BLOB *full_packet)
 	struct dcerpc_auth auth;
 	struct ndr_pull *ndr;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	if (!dce_conn->auth_state.auth_info ||
 	    !dce_conn->auth_state.gensec_security) {
@@ -332,8 +335,8 @@ bool dcesrv_auth_request(struct dcesrv_call_state *call, DATA_BLOB *full_packet)
 		ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
 	}
 
-	status = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		talloc_free(ndr);
 		return false;
 	}
@@ -392,6 +395,7 @@ bool dcesrv_auth_response(struct dcesrv_call_state *call,
 {
 	struct dcesrv_connection *dce_conn = call->conn;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct ndr_push *ndr;
 	uint32_t payload_length;
 	DATA_BLOB creds2;
@@ -411,8 +415,8 @@ bool dcesrv_auth_response(struct dcesrv_call_state *call,
 		ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
 	}
 
-	status = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return false;
 	}
 
@@ -441,9 +445,9 @@ bool dcesrv_auth_response(struct dcesrv_call_state *call,
 	}
 
 	/* add the auth verifier */
-	status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, 
+	ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS,
 				      dce_conn->auth_state.auth_info);
-	if (!NT_STATUS_IS_OK(status)) {
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		return false;
 	}
 
diff --git a/source4/rpc_server/remote/dcesrv_remote.c b/source4/rpc_server/remote/dcesrv_remote.c
index f009323ae2..f91334510c 100644
--- a/source4/rpc_server/remote/dcesrv_remote.c
+++ b/source4/rpc_server/remote/dcesrv_remote.c
@@ -124,7 +124,7 @@ static void remote_op_unbind(struct dcesrv_connection_context *context, const st
 
 static NTSTATUS remote_op_ndr_pull(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, struct ndr_pull *pull, void **r)
 {
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	const struct ndr_interface_table *table = (const struct ndr_interface_table *)dce_call->context->iface->private;
 	uint16_t opnum = dce_call->pkt.u.request.opnum;
 
@@ -141,8 +141,8 @@ static NTSTATUS remote_op_ndr_pull(struct dcesrv_call_state *dce_call, TALLOC_CT
 	}
 
         /* unravel the NDR for the packet */
-	status = table->calls[opnum].ndr_pull(pull, NDR_IN, *r);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = table->calls[opnum].ndr_pull(pull, NDR_IN, *r);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		dcerpc_log_packet(table, opnum, NDR_IN,
 				  &dce_call->pkt.u.request.stub_and_verifier);
 		dce_call->fault_code = DCERPC_FAULT_NDR;
@@ -188,13 +188,13 @@ static NTSTATUS remote_op_dispatch(struct dcesrv_call_state *dce_call, TALLOC_CT
 
 static NTSTATUS remote_op_ndr_push(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, struct ndr_push *push, const void *r)
 {
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	const struct ndr_interface_table *table = dce_call->context->iface->private;
 	uint16_t opnum = dce_call->pkt.u.request.opnum;
 
         /* unravel the NDR for the packet */
-	status = table->calls[opnum].ndr_push(push, NDR_OUT, r);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = table->calls[opnum].ndr_push(push, NDR_OUT, r);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		dce_call->fault_code = DCERPC_FAULT_NDR;
 		return NT_STATUS_NET_WRITE_FAULT;
 	}
diff --git a/source4/rpc_server/winreg/rpc_winreg.c b/source4/rpc_server/winreg/rpc_winreg.c
index 3aea8e62c1..14da907dfa 100644
--- a/source4/rpc_server/winreg/rpc_winreg.c
+++ b/source4/rpc_server/winreg/rpc_winreg.c
@@ -122,15 +122,15 @@ static WERROR dcesrv_winreg_CreateKey(struct dcesrv_call_state *dce_call,
 	/* the security descriptor is optional */
 	if (r->in.secdesc != NULL) {
 		DATA_BLOB sdblob;
-		NTSTATUS status;
+		enum ndr_err_code ndr_err;
 		sdblob.data = r->in.secdesc->sd.data;
 		sdblob.length = r->in.secdesc->sd.len;
 		if (sdblob.data == NULL) {
 			return WERR_INVALID_PARAM;
 		}
-		status = ndr_pull_struct_blob_all(&sdblob, mem_ctx, &sd,
-						  (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob_all(&sdblob, mem_ctx, &sd,
+						   (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			return WERR_INVALID_PARAM;
 		}
 	}
diff --git a/source4/smb_server/blob.c b/source4/smb_server/blob.c
index 5cbd74a028..3683991526 100644
--- a/source4/smb_server/blob.c
+++ b/source4/smb_server/blob.c
@@ -272,12 +272,18 @@ NTSTATUS smbsrv_push_passthru_fsinfo(TALLOC_CTX *mem_ctx,
 
 		return NT_STATUS_OK;
 
-	case RAW_QFS_OBJECTID_INFORMATION:
+	case RAW_QFS_OBJECTID_INFORMATION: {
+		enum ndr_err_code ndr_err;
+
 		BLOB_CHECK(smbsrv_blob_grow_data(mem_ctx, blob, 64));
 
-		BLOB_CHECK(ndr_push_struct_blob(&guid_blob, mem_ctx, 
-						&fsinfo->objectid_information.out.guid,
-						(ndr_push_flags_fn_t)ndr_push_GUID));
+		ndr_err = ndr_push_struct_blob(&guid_blob, mem_ctx,
+					       &fsinfo->objectid_information.out.guid,
+					       (ndr_push_flags_fn_t)ndr_push_GUID);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			BLOB_CHECK(ndr_map_error2ntstatus(ndr_err));
+		}
+
 		memcpy(blob->data, guid_blob.data, guid_blob.length);
 
 		for (i=0;i<6;i++) {
@@ -285,7 +291,7 @@ NTSTATUS smbsrv_push_passthru_fsinfo(TALLOC_CTX *mem_ctx,
 		}
 
 		return NT_STATUS_OK;
-
+	}
 	default:
 		return NT_STATUS_INVALID_LEVEL;
 	}
diff --git a/source4/smb_server/smb/nttrans.c b/source4/smb_server/smb/nttrans.c
index 922dccff60..046f6ca0ec 100644
--- a/source4/smb_server/smb/nttrans.c
+++ b/source4/smb_server/smb/nttrans.c
@@ -103,6 +103,7 @@ static NTSTATUS nttrans_create(struct smbsrv_request *req,
 	uint32_t sd_length, ea_length;
 	NTSTATUS status;
 	uint8_t *params;
+	enum ndr_err_code ndr_err;
 
 	if (trans->in.params.length < 54) {
 		return NT_STATUS_INVALID_PARAMETER;
@@ -155,11 +156,11 @@ static NTSTATUS nttrans_create(struct smbsrv_request *req,
 		if (io->ntcreatex.in.sec_desc == NULL) {
 			return NT_STATUS_NO_MEMORY;
 		}
-		status = ndr_pull_struct_blob(&blob, io, 
-					      io->ntcreatex.in.sec_desc, 
-					      (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
+		ndr_err = ndr_pull_struct_blob(&blob, io,
+					       io->ntcreatex.in.sec_desc,
+					       (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			return ndr_map_error2ntstatus(ndr_err);
 		}
 	}
 
@@ -196,15 +197,18 @@ static NTSTATUS nttrans_query_sec_desc_send(struct nttrans_op *op)
 	union smb_fileinfo *io = talloc_get_type(op->op_info, union smb_fileinfo);
 	uint8_t *params;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	status = nttrans_setup_reply(op, op->trans, 4, 0, 0);
 	NT_STATUS_NOT_OK_RETURN(status);
 	params = op->trans->out.params.data;
 
-	status = ndr_push_struct_blob(&op->trans->out.data, op, 
-				      io->query_secdesc.out.sd, 
-				      (ndr_push_flags_fn_t)ndr_push_security_descriptor);
-	NT_STATUS_NOT_OK_RETURN(status);
+	ndr_err = ndr_push_struct_blob(&op->trans->out.data, op,
+				       io->query_secdesc.out.sd,
+				       (ndr_push_flags_fn_t)ndr_push_security_descriptor);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
 	SIVAL(params, 0, op->trans->out.data.length);
 
@@ -248,7 +252,7 @@ static NTSTATUS nttrans_set_sec_desc(struct smbsrv_request *req,
 {
 	struct smb_nttrans *trans = op->trans;
 	union smb_setfileinfo *io;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	if (trans->in.params.length < 8) {
 		return NT_STATUS_INVALID_PARAMETER;
@@ -265,10 +269,12 @@ static NTSTATUS nttrans_set_sec_desc(struct smbsrv_request *req,
 	io->set_secdesc.in.sd = talloc(io, struct security_descriptor);
 	NT_STATUS_HAVE_NO_MEMORY(io->set_secdesc.in.sd);
 
-	status = ndr_pull_struct_blob(&trans->in.data, req, 
-				      io->set_secdesc.in.sd, 
-				      (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
-	NT_STATUS_NOT_OK_RETURN(status);
+	ndr_err = ndr_pull_struct_blob(&trans->in.data, req,
+				       io->set_secdesc.in.sd,
+				       (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
 	SMBSRV_CHECK_FILE_HANDLE_NTSTATUS(io->set_secdesc.in.file.ntvfs);
 	return ntvfs_setfileinfo(req->ntvfs, io);
diff --git a/source4/smb_server/smb2/fileinfo.c b/source4/smb_server/smb2/fileinfo.c
index 41b31f586f..8715279dad 100644
--- a/source4/smb_server/smb2/fileinfo.c
+++ b/source4/smb_server/smb2/fileinfo.c
@@ -143,12 +143,14 @@ static NTSTATUS smb2srv_getinfo_fs(struct smb2srv_getinfo_op *op, uint8_t smb2_l
 static NTSTATUS smb2srv_getinfo_security_send(struct smb2srv_getinfo_op *op)
 {
 	union smb_fileinfo *io = talloc_get_type(op->io_ptr, union smb_fileinfo);
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
-	status = ndr_push_struct_blob(&op->info->out.blob, op->req,
-				      io->query_secdesc.out.sd,
-				      (ndr_push_flags_fn_t)ndr_push_security_descriptor);
-	NT_STATUS_NOT_OK_RETURN(status);
+	ndr_err = ndr_push_struct_blob(&op->info->out.blob, op->req,
+				       io->query_secdesc.out.sd,
+				       (ndr_push_flags_fn_t)ndr_push_security_descriptor);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
 	return NT_STATUS_OK;
 }
@@ -294,7 +296,7 @@ static NTSTATUS smb2srv_setinfo_fs(struct smb2srv_setinfo_op *op, uint8_t smb2_l
 static NTSTATUS smb2srv_setinfo_security(struct smb2srv_setinfo_op *op, uint8_t smb2_level)
 {
 	union smb_setfileinfo *io;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	switch (smb2_level) {
 	case 0x00:
@@ -308,10 +310,12 @@ static NTSTATUS smb2srv_setinfo_security(struct smb2srv_setinfo_op *op, uint8_t
 		io->set_secdesc.in.sd = talloc(io, struct security_descriptor);
 		NT_STATUS_HAVE_NO_MEMORY(io->set_secdesc.in.sd);
 
-		status = ndr_pull_struct_blob(&op->info->in.blob, io, 
-					      io->set_secdesc.in.sd, 
-					      (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
-		NT_STATUS_NOT_OK_RETURN(status);
+		ndr_err = ndr_pull_struct_blob(&op->info->in.blob, io,
+					       io->set_secdesc.in.sd,
+					       (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+			return ndr_map_error2ntstatus(ndr_err);
+		}
 
 		return ntvfs_setfileinfo(op->req->ntvfs, io);
 	}
diff --git a/source4/torture/auth/pac.c b/source4/torture/auth/pac.c
index 30bb53587d..baa3bdf39a 100644
--- a/source4/torture/auth/pac.c
+++ b/source4/torture/auth/pac.c
@@ -262,6 +262,7 @@ static const uint8_t saved_pac[] = {
 static bool torture_pac_saved_check(struct torture_context *tctx)
 {
 	NTSTATUS nt_status;
+	enum ndr_err_code ndr_err;
 	DATA_BLOB tmp_blob, validate_blob;
 	struct PAC_DATA *pac_data, pac_data2;
 	struct PAC_LOGON_INFO *logon_info;
@@ -514,8 +515,9 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 	 * pointer, padding etc algorithms as win2k3.
 	 */
 	if (tmp_blob.length != validate_blob.length) {
-		nt_status = ndr_pull_struct_blob(&validate_blob, mem_ctx, &pac_data2,
-						 (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+		ndr_err = ndr_pull_struct_blob(&validate_blob, mem_ctx, &pac_data2,
+					       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+		nt_status = ndr_map_error2ntstatus(ndr_err);
 		torture_assert_ntstatus_ok(tctx, nt_status, "can't parse the PAC");
 		
 		NDR_PRINT_DEBUG(PAC_DATA, pac_data);
@@ -534,8 +536,9 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
 	}
 
 	if (memcmp(tmp_blob.data, validate_blob.data, tmp_blob.length) != 0) {
-		nt_status = ndr_pull_struct_blob(&validate_blob, mem_ctx, &pac_data2,
-						 (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+		ndr_err = ndr_pull_struct_blob(&validate_blob, mem_ctx, &pac_data2,
+					       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+		nt_status = ndr_map_error2ntstatus(ndr_err);
 		torture_assert_ntstatus_ok(tctx, nt_status, "can't parse the PAC");
 		
 		NDR_PRINT_DEBUG(PAC_DATA, pac_data);
diff --git a/source4/torture/ldap/uptodatevector.c b/source4/torture/ldap/uptodatevector.c
index b3c6e8d555..7b1614af52 100644
--- a/source4/torture/ldap/uptodatevector.c
+++ b/source4/torture/ldap/uptodatevector.c
@@ -43,7 +43,7 @@ static bool test_check_uptodatevector(struct torture_context *torture,
 	bool ok = true;
 	uint32_t i;
 	int ret;
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	struct ldb_result *r;
 	const struct ldb_val *utdv_val1;
 	struct replUpToDateVectorBlob utdv1;
@@ -70,9 +70,9 @@ static bool test_check_uptodatevector(struct torture_context *torture,
 	ZERO_STRUCT(utdv1);
 	utdv_val1 = ldb_msg_find_ldb_val(r->msgs[0], "replUpToDateVector");
 	if (utdv_val1) {
-		status = ndr_pull_struct_blob_all(utdv_val1, torture, &utdv1,
-						 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
-		if (!NT_STATUS_IS_OK(status)) {
+		ndr_err = ndr_pull_struct_blob_all(utdv_val1, torture, &utdv1,
+						   (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
+		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			return false;
 		}
 	}
@@ -116,9 +116,9 @@ static bool test_check_uptodatevector(struct torture_context *torture,
 		ZERO_STRUCT(utdv);
 		utdv_val = ldb_msg_find_ldb_val(r->msgs[0], "replUpToDateVector");
 		if (utdv_val) {
-			status = ndr_pull_struct_blob_all(utdv_val, torture, &utdv,
-							 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
-			if (!NT_STATUS_IS_OK(status)) {
+			ndr_err = ndr_pull_struct_blob_all(utdv_val, torture, &utdv,
+							   (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
+			if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 				return false;
 			}
 		}
diff --git a/source4/torture/ndr/ndr.c b/source4/torture/ndr/ndr.c
index 18ede54867..e1e2918cba 100644
--- a/source4/torture/ndr/ndr.c
+++ b/source4/torture/ndr/ndr.c
@@ -42,8 +42,8 @@ static bool wrap_ndr_pull_test(struct torture_context *tctx,
 
 	ndr->flags |= LIBNDR_FLAG_REF_ALLOC;
 
-	torture_assert_ntstatus_ok(tctx, data->pull_fn(ndr, data->ndr_flags, ds), 
-							   "pulling");
+	torture_assert_ndr_success(tctx, data->pull_fn(ndr, data->ndr_flags, ds),
+				   "pulling");
 
 	torture_assert(tctx, ndr->offset == ndr->data_size, 
 				   talloc_asprintf(tctx, 
@@ -99,13 +99,13 @@ static bool test_check_string_terminator(struct torture_context *tctx)
 	
 	ndr = ndr_pull_init_blob(&blob, mem_ctx);
 
-	torture_assert_ntstatus_ok(tctx, ndr_check_string_terminator(ndr, 1, 2),
-							   "simple check_string_terminator test failed");
+	torture_assert_ndr_success(tctx, ndr_check_string_terminator(ndr, 1, 2),
+				   "simple check_string_terminator test failed");
 
 	torture_assert(tctx, ndr->offset == 0,
 		"check_string_terminator did not reset offset");
 
-	if (NT_STATUS_IS_OK(ndr_check_string_terminator(ndr, 1, 3))) {
+	if (NDR_ERR_CODE_IS_SUCCESS(ndr_check_string_terminator(ndr, 1, 3))) {
 		torture_fail(tctx, "check_string_terminator checked beyond string boundaries");
 	}
 
@@ -117,17 +117,16 @@ static bool test_check_string_terminator(struct torture_context *tctx)
 	blob = strhex_to_data_blob("11220000");
 	ndr = ndr_pull_init_blob(&blob, mem_ctx);
 
-	torture_assert_ntstatus_ok(tctx, 
+	torture_assert_ndr_success(tctx,
 		ndr_check_string_terminator(ndr, 4, 1),
 		"check_string_terminator failed to recognize terminator");
 
-	torture_assert_ntstatus_ok(tctx, 
+	torture_assert_ndr_success(tctx,
 		ndr_check_string_terminator(ndr, 3, 1),
 		"check_string_terminator failed to recognize terminator");
 
-	if (NT_STATUS_IS_OK(ndr_check_string_terminator(ndr, 2, 1))) {
-		torture_fail(tctx, 
-					 "check_string_terminator erroneously reported terminator");
+	if (NDR_ERR_CODE_IS_SUCCESS(ndr_check_string_terminator(ndr, 2, 1))) {
+		torture_fail(tctx, "check_string_terminator erroneously reported terminator");
 	}
 
 	torture_assert(tctx, ndr->offset == 0,
diff --git a/source4/torture/rap/rap.c b/source4/torture/rap/rap.c
index 483b33dc11..9289577269 100644
--- a/source4/torture/rap/rap.c
+++ b/source4/torture/rap/rap.c
@@ -27,6 +27,32 @@
 #include "libcli/libcli.h"
 #include "librpc/ndr/libndr.h"
 
+#define RAP_GOTO(call) do { \
+	NTSTATUS _status; \
+	_status = call; \
+	if (!NT_STATUS_IS_OK(_status)) { \
+		result = _status; \
+		goto done; \
+	} \
+} while (0)
+
+#define NDR_GOTO(call) do { \
+	enum ndr_err_code _ndr_err; \
+	_ndr_err = call; \
+	if (!NDR_ERR_CODE_IS_SUCCESS(_ndr_err)) { \
+		result = ndr_map_error2ntstatus(_ndr_err); \
+		goto done; \
+	} \
+} while (0)
+
+#define NDR_RETURN(call) do { \
+	enum ndr_err_code _ndr_err; \
+	_ndr_err = call; \
+	if (!NDR_ERR_CODE_IS_SUCCESS(_ndr_err)) { \
+		return ndr_map_error2ntstatus(_ndr_err); \
+	} \
+} while (0)
+
 struct rap_call {
 	uint16_t callno;
 	char *paramdesc;
@@ -141,8 +167,8 @@ static NTSTATUS rap_pull_string(TALLOC_CTX *mem_ctx, struct ndr_pull *ndr,
 	const char *p;
 	size_t len;
 
-	NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &string_offset));
-	NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &ignore));
+	NDR_RETURN(ndr_pull_uint16(ndr, NDR_SCALARS, &string_offset));
+	NDR_RETURN(ndr_pull_uint16(ndr, NDR_SCALARS, &ignore));
 
 	string_offset -= convert;
 
@@ -184,14 +210,14 @@ static NTSTATUS rap_cli_do_call(struct smbcli_tree *tree, struct rap_call *call)
 	trans.in.setup = NULL;
 	trans.in.trans_name = "\\PIPE\\LANMAN";
 
-	NDR_CHECK(ndr_push_uint16(params, NDR_SCALARS, call->callno));
+	NDR_RETURN(ndr_push_uint16(params, NDR_SCALARS, call->callno));
 	if (call->paramdesc)
-		NDR_CHECK(ndr_push_string(params, NDR_SCALARS, call->paramdesc));
+		NDR_RETURN(ndr_push_string(params, NDR_SCALARS, call->paramdesc));
 	if (call->datadesc)
-		NDR_CHECK(ndr_push_string(params, NDR_SCALARS, call->datadesc));
+		NDR_RETURN(ndr_push_string(params, NDR_SCALARS, call->datadesc));
 
 	param_blob = ndr_push_blob(call->ndr_push_param);
-	NDR_CHECK(ndr_push_bytes(params, param_blob.data,
+	NDR_RETURN(ndr_push_bytes(params, param_blob.data,
 				 param_blob.length));
 
 	trans.in.params = ndr_push_blob(params);
@@ -211,11 +237,6 @@ static NTSTATUS rap_cli_do_call(struct smbcli_tree *tree, struct rap_call *call)
 	return result;
 }
 
-#define NDR_OK(call) do { NTSTATUS _status; \
-                             _status = call; \
-                             if (!NT_STATUS_IS_OK(_status)) \
-				goto done; \
-                        } while (0)
 
 static NTSTATUS smbcli_rap_netshareenum(struct smbcli_tree *tree,
 					TALLOC_CTX *mem_ctx,
@@ -248,10 +269,10 @@ static NTSTATUS smbcli_rap_netshareenum(struct smbcli_tree *tree,
 	if (!NT_STATUS_IS_OK(result))
 		goto done;
 
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.status));
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.convert));
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.count));
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.available));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.status));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.convert));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.count));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.available));
 
 	r->out.info = talloc_array(mem_ctx, union rap_shareenum_info, r->out.count);
 
@@ -263,17 +284,17 @@ static NTSTATUS smbcli_rap_netshareenum(struct smbcli_tree *tree,
 	for (i=0; i<r->out.count; i++) {
 		switch(r->in.level) {
 		case 0:
-			NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+			NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 					      (uint8_t *)r->out.info[i].info0.name, 13));
 			break;
 		case 1:
-			NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+			NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 					      (uint8_t *)r->out.info[i].info1.name, 13));
-			NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+			NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 					      (uint8_t *)&r->out.info[i].info1.pad, 1));
-			NDR_OK(ndr_pull_uint16(call->ndr_pull_data,
+			NDR_GOTO(ndr_pull_uint16(call->ndr_pull_data,
 					       NDR_SCALARS, &r->out.info[i].info1.type));
-			NDR_OK(rap_pull_string(mem_ctx, call->ndr_pull_data,
+			RAP_GOTO(rap_pull_string(mem_ctx, call->ndr_pull_data,
 					       r->out.convert,
 					       &r->out.info[i].info1.comment));
 			break;
@@ -345,10 +366,10 @@ static NTSTATUS smbcli_rap_netserverenum2(struct smbcli_tree *tree,
 
 	result = NT_STATUS_INVALID_PARAMETER;
 
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.status));
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.convert));
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.count));
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.available));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.status));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.convert));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.count));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.available));
 
 	r->out.info = talloc_array(mem_ctx, union rap_server_info, r->out.count);
 
@@ -360,19 +381,19 @@ static NTSTATUS smbcli_rap_netserverenum2(struct smbcli_tree *tree,
 	for (i=0; i<r->out.count; i++) {
 		switch(r->in.level) {
 		case 0:
-			NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+			NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 					      (uint8_t *)r->out.info[i].info0.name, 16));
 			break;
 		case 1:
-			NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+			NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 					      (uint8_t *)r->out.info[i].info1.name, 16));
-			NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+			NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 					      &r->out.info[i].info1.version_major, 1));
-			NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+			NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 					      &r->out.info[i].info1.version_minor, 1));
-			NDR_OK(ndr_pull_uint32(call->ndr_pull_data,
+			NDR_GOTO(ndr_pull_uint32(call->ndr_pull_data,
 					       NDR_SCALARS, &r->out.info[i].info1.servertype));
-			NDR_OK(rap_pull_string(mem_ctx, call->ndr_pull_data,
+			RAP_GOTO(rap_pull_string(mem_ctx, call->ndr_pull_data,
 					       r->out.convert,
 					       &r->out.info[i].info1.comment));
 		}
@@ -450,25 +471,25 @@ _PUBLIC_ NTSTATUS smbcli_rap_netservergetinfo(struct smbcli_tree *tree,
 	if (!NT_STATUS_IS_OK(result))
 		goto done;
 
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.status));
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.convert));
-	NDR_OK(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.available));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.status));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.convert));
+	NDR_GOTO(ndr_pull_uint16(call->ndr_pull_param, NDR_SCALARS, &r->out.available));
 
 	switch(r->in.level) {
 	case 0:
-		NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+		NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 				      (uint8_t *)r->out.info.info0.name, 16));
 		break;
 	case 1:
-		NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+		NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 				      (uint8_t *)r->out.info.info1.name, 16));
-		NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+		NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 				      &r->out.info.info1.version_major, 1));
-		NDR_OK(ndr_pull_bytes(call->ndr_pull_data,
+		NDR_GOTO(ndr_pull_bytes(call->ndr_pull_data,
 				      &r->out.info.info1.version_minor, 1));
-		NDR_OK(ndr_pull_uint32(call->ndr_pull_data,
+		NDR_GOTO(ndr_pull_uint32(call->ndr_pull_data,
 				       NDR_SCALARS, &r->out.info.info1.servertype));
-		NDR_OK(rap_pull_string(mem_ctx, call->ndr_pull_data,
+		RAP_GOTO(rap_pull_string(mem_ctx, call->ndr_pull_data,
 				       r->out.convert,
 				       &r->out.info.info1.comment));
 	}
diff --git a/source4/torture/rpc/eventlog.c b/source4/torture/rpc/eventlog.c
index c1d863454c..64b012fba6 100644
--- a/source4/torture/rpc/eventlog.c
+++ b/source4/torture/rpc/eventlog.c
@@ -105,6 +105,7 @@ static bool test_ReadEventLog(struct torture_context *tctx,
 		DATA_BLOB blob;
 		struct eventlog_Record rec;
 		struct ndr_pull *ndr;
+		enum ndr_err_code ndr_err;
 
 		/* Read first for number of bytes in record */
 
@@ -138,8 +139,9 @@ static bool test_ReadEventLog(struct torture_context *tctx,
 
 		ndr = ndr_pull_init_blob(&blob, tctx);
 
-		status = ndr_pull_eventlog_Record(
+		ndr_err = ndr_pull_eventlog_Record(
 			ndr, NDR_SCALARS|NDR_BUFFERS, &rec);
+		status = ndr_map_error2ntstatus(ndr_err);
 
 		NDR_PRINT_DEBUG(eventlog_Record, &rec);
 
diff --git a/source4/torture/rpc/samsync.c b/source4/torture/rpc/samsync.c
index 6f76e3b58b..a7cde8af4f 100644
--- a/source4/torture/rpc/samsync.c
+++ b/source4/torture/rpc/samsync.c
@@ -544,11 +544,12 @@ static bool samsync_handle_user(TALLOC_CTX *mem_ctx, struct samsync_state *samsy
 	if (user->user_private_info.SensitiveData) {
 		DATA_BLOB data;
 		struct netr_USER_KEYS keys;
+		enum ndr_err_code ndr_err;
 		data.data = user->user_private_info.SensitiveData;
 		data.length = user->user_private_info.DataLength;
 		creds_arcfour_crypt(samsync_state->creds, data.data, data.length);
-		nt_status = ndr_pull_struct_blob(&data, mem_ctx, &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
-		if (NT_STATUS_IS_OK(nt_status)) {
+		ndr_err = ndr_pull_struct_blob(&data, mem_ctx, &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
+		if (NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 			if (keys.keys.keys2.lmpassword.length == 16) {
 				sam_rid_crypt(rid, keys.keys.keys2.lmpassword.pwd.hash, lm_hash.hash, 0);
 				lm_hash_p = &lm_hash;
diff --git a/source4/torture/rpc/spoolss_notify.c b/source4/torture/rpc/spoolss_notify.c
index e44c2a874b..bffbd1108c 100644
--- a/source4/torture/rpc/spoolss_notify.c
+++ b/source4/torture/rpc/spoolss_notify.c
@@ -44,7 +44,7 @@ static void spoolss__op_unbind(struct dcesrv_connection_context *context, const
 
 static NTSTATUS spoolss__op_ndr_pull(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, struct ndr_pull *pull, void **r)
 {
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	uint16_t opnum = dce_call->pkt.u.request.opnum;
 
 	dce_call->fault_code = 0;
@@ -58,8 +58,8 @@ static NTSTATUS spoolss__op_ndr_pull(struct dcesrv_call_state *dce_call, TALLOC_
 	NT_STATUS_HAVE_NO_MEMORY(*r);
 
         /* unravel the NDR for the packet */
-	status = ndr_table_spoolss.calls[opnum].ndr_pull(pull, NDR_IN, *r);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_table_spoolss.calls[opnum].ndr_pull(pull, NDR_IN, *r);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		dcerpc_log_packet(&ndr_table_spoolss, opnum, NDR_IN,
 				  &dce_call->pkt.u.request.stub_and_verifier);
 		dce_call->fault_code = DCERPC_FAULT_NDR;
@@ -117,11 +117,11 @@ static NTSTATUS spoolss__op_reply(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
 static NTSTATUS spoolss__op_ndr_push(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, struct ndr_push *push, const void *r)
 {
-	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 	uint16_t opnum = dce_call->pkt.u.request.opnum;
 
-	status = ndr_table_spoolss.calls[opnum].ndr_push(push, NDR_OUT, r);
-	if (!NT_STATUS_IS_OK(status)) {
+	ndr_err = ndr_table_spoolss.calls[opnum].ndr_push(push, NDR_OUT, r);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		dce_call->fault_code = DCERPC_FAULT_NDR;
 		return NT_STATUS_NET_WRITE_FAULT;
 	}
diff --git a/source4/torture/rpc/winreg.c b/source4/torture/rpc/winreg.c
index 2ce1fa768c..45954f2c71 100644
--- a/source4/torture/rpc/winreg.c
+++ b/source4/torture/rpc/winreg.c
@@ -155,7 +155,7 @@ static bool test_CreateKey_sd(struct dcerpc_pipe *p,
 					SEC_ACE_FLAG_CONTAINER_INHERIT,
 					NULL);
 
-	torture_assert_ntstatus_ok(tctx,
+	torture_assert_ndr_success(tctx,
 		ndr_push_struct_blob(&sdblob, tctx, sd,
 				     (ndr_push_flags_fn_t)ndr_push_security_descriptor),
 				     "Failed to push security_descriptor ?!\n");
@@ -220,7 +220,7 @@ static bool _test_GetKeySecurity(struct dcerpc_pipe *p,
 
 	sd = talloc_zero(tctx, struct security_descriptor);
 
-	torture_assert_ntstatus_ok(tctx,
+	torture_assert_ndr_success(tctx,
 		ndr_pull_struct_blob(&sdblob, tctx, sd,
 				     (ndr_pull_flags_fn_t)ndr_pull_security_descriptor),
 				     "pull_security_descriptor failed");
@@ -264,7 +264,7 @@ static bool _test_SetKeySecurity(struct dcerpc_pipe *p,
 		NDR_PRINT_DEBUG(security_descriptor, sd);
 	}
 
-	torture_assert_ntstatus_ok(tctx,
+	torture_assert_ndr_success(tctx,
 		ndr_push_struct_blob(&sdblob, tctx, sd,
 				     (ndr_push_flags_fn_t)ndr_push_security_descriptor),
 				     "push_security_descriptor failed");
diff --git a/source4/torture/ui.h b/source4/torture/ui.h
index 71c2122315..ebf7844ae2 100644
--- a/source4/torture/ui.h
+++ b/source4/torture/ui.h
@@ -223,6 +223,13 @@ void torture_result(struct torture_context *test,
 	}\
 	} while(0)
 
+#define torture_assert_ndr_err_equal(torture_ctx,got,expected,cmt) \
+	do { enum ndr_err_code __got = got, __expected = expected; \
+	if (__got != __expected) { \
+		torture_result(torture_ctx, TORTURE_FAIL, __location__": "#got" was %d, expected %d (%s): %s", __got, __expected, __STRING(expected), cmt); \
+		return false; \
+	}\
+	} while(0)
 
 #define torture_assert_casestr_equal(torture_ctx,got,expected,cmt) \
 	do { const char *__got = (got), *__expected = (expected); \
@@ -334,6 +341,9 @@ void torture_result(struct torture_context *test,
 #define torture_assert_werr_ok(torture_ctx,expr,cmt) \
 		torture_assert_werr_equal(torture_ctx,expr,WERR_OK,cmt)
 
+#define torture_assert_ndr_success(torture_ctx,expr,cmt) \
+		torture_assert_ndr_err_equal(torture_ctx,expr,NDR_ERR_SUCCESS,cmt)
+
 /* Getting settings */
 const char *torture_setting_string(struct torture_context *test, \
 								   const char *name, 
diff --git a/source4/utils/getntacl.c b/source4/utils/getntacl.c
index 18a889a030..382a020c40 100644
--- a/source4/utils/getntacl.c
+++ b/source4/utils/getntacl.c
@@ -51,7 +51,7 @@ static NTSTATUS get_ntacl(TALLOC_CTX *mem_ctx,
 {
 	DATA_BLOB blob;
 	ssize_t size;
-	NTSTATUS result;
+	enum ndr_err_code ndr_err;
 	struct ndr_pull *ndr;
 
 	*ntacl = talloc(mem_ctx, struct xattr_NTACL);
@@ -73,10 +73,9 @@ static NTSTATUS get_ntacl(TALLOC_CTX *mem_ctx,
 
 	ndr = ndr_pull_init_blob(&blob, NULL);
 
-	result = ndr_pull_xattr_NTACL(ndr, NDR_SCALARS|NDR_BUFFERS, *ntacl);
-
-	if (!NT_STATUS_IS_OK(result)) {
-		return result;
+	ndr_err = ndr_pull_xattr_NTACL(ndr, NDR_SCALARS|NDR_BUFFERS, *ntacl);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	return NT_STATUS_OK;
diff --git a/source4/winbind/wb_pam_auth.c b/source4/winbind/wb_pam_auth.c
index 4a9be62228..06e2bff990 100644
--- a/source4/winbind/wb_pam_auth.c
+++ b/source4/winbind/wb_pam_auth.c
@@ -131,6 +131,7 @@ struct composite_context *wb_cmd_pam_auth_crap_send(TALLOC_CTX *mem_ctx,
 static void pam_auth_crap_recv_logon(struct composite_context *ctx)
 {
 	DATA_BLOB tmp_blob;
+	enum ndr_err_code ndr_err;
 	struct netr_SamBaseInfo *base;
 	struct pam_auth_crap_state *state =
 		talloc_get_type(ctx->async.private_data,
@@ -139,10 +140,13 @@ static void pam_auth_crap_recv_logon(struct composite_context *ctx)
 	state->ctx->status = wb_sam_logon_recv(ctx, state, state->req);
 	if (!composite_is_ok(state->ctx)) return;
 
-	state->ctx->status = ndr_push_struct_blob(
+	ndr_err = ndr_push_struct_blob(
 		&tmp_blob, state, state->req->out.validation.sam3,
 		(ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
-	if (!composite_is_ok(state->ctx)) return;
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		state->ctx->status = ndr_map_error2ntstatus(ndr_err);
+		if (!composite_is_ok(state->ctx)) return;
+	}
 
 	/* The Samba3 protocol is a bit broken (due to non-IDL
 	 * heritage, so for compatability we must add a non-zero 4
diff --git a/source4/wrepl_server/wrepl_in_connection.c b/source4/wrepl_server/wrepl_in_connection.c
index 1178eb766e..d26c89d35d 100644
--- a/source4/wrepl_server/wrepl_in_connection.c
+++ b/source4/wrepl_server/wrepl_in_connection.c
@@ -55,6 +55,7 @@ static NTSTATUS wreplsrv_recv_request(void *private, DATA_BLOB blob)
 	DATA_BLOB packet_out_blob;
 	struct wrepl_wrap packet_out_wrap;
 	NTSTATUS status;
+	enum ndr_err_code ndr_err;
 
 	call = talloc_zero(wreplconn, struct wreplsrv_in_call);
 	NT_STATUS_HAVE_NO_MEMORY(call);
@@ -64,9 +65,11 @@ static NTSTATUS wreplsrv_recv_request(void *private, DATA_BLOB blob)
 	packet_in_blob.data = blob.data + 4;
 	packet_in_blob.length = blob.length - 4;
 
-	status = ndr_pull_struct_blob(&packet_in_blob, call, &call->req_packet,
-				      (ndr_pull_flags_fn_t)ndr_pull_wrepl_packet);
-	NT_STATUS_NOT_OK_RETURN(status);
+	ndr_err = ndr_pull_struct_blob(&packet_in_blob, call, &call->req_packet,
+				       (ndr_pull_flags_fn_t)ndr_pull_wrepl_packet);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
 	if (DEBUGLVL(10)) {
 		DEBUG(10,("Received WINS-Replication packet of length %u\n", 
@@ -85,9 +88,11 @@ static NTSTATUS wreplsrv_recv_request(void *private, DATA_BLOB blob)
 
 	/* and now encode the reply */
 	packet_out_wrap.packet = call->rep_packet;
-	status = ndr_push_struct_blob(&packet_out_blob, call, &packet_out_wrap,
+	ndr_err = ndr_push_struct_blob(&packet_out_blob, call, &packet_out_wrap,
 				      (ndr_push_flags_fn_t)ndr_push_wrepl_wrap);
-	NT_STATUS_NOT_OK_RETURN(status);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
 
 	if (DEBUGLVL(10)) {
 		DEBUG(10,("Sending WINS-Replication packet of length %d\n", (int)packet_out_blob.length));