20 files changed, 479 insertions, 142 deletions

diff --git a/source3/librpc/gen_ndr/cli_eventlog.c b/source3/librpc/gen_ndr/cli_eventlog.c
index 72cd886cb4..0084776a08 100644
--- a/source3/librpc/gen_ndr/cli_eventlog.c
+++ b/source3/librpc/gen_ndr/cli_eventlog.c
@@ -9,14 +9,14 @@
 NTSTATUS rpccli_eventlog_ClearEventLogW(struct rpc_pipe_client *cli,
 					TALLOC_CTX *mem_ctx,
 					struct policy_handle *handle,
-					struct lsa_String *unknown)
+					struct lsa_String *backupfile)
 {
 	struct eventlog_ClearEventLogW r;
 	NTSTATUS status;
 
 	/* In parameters */
 	r.in.handle = handle;
-	r.in.unknown = unknown;
+	r.in.backupfile = backupfile;
 
 	if (DEBUGLEVEL >= 10) {
 		NDR_PRINT_IN_DEBUG(eventlog_ClearEventLogW, &r);
@@ -203,12 +203,15 @@ NTSTATUS rpccli_eventlog_GetNumRecords(struct rpc_pipe_client *cli,
 }
 
 NTSTATUS rpccli_eventlog_GetOldestRecord(struct rpc_pipe_client *cli,
-					 TALLOC_CTX *mem_ctx)
+					 TALLOC_CTX *mem_ctx,
+					 struct policy_handle *handle,
+					 uint32_t *oldest_entry)
 {
 	struct eventlog_GetOldestRecord r;
 	NTSTATUS status;
 
 	/* In parameters */
+	r.in.handle = handle;
 
 	if (DEBUGLEVEL >= 10) {
 		NDR_PRINT_IN_DEBUG(eventlog_GetOldestRecord, &r);
@@ -234,6 +237,7 @@ NTSTATUS rpccli_eventlog_GetOldestRecord(struct rpc_pipe_client *cli,
 	}
 
 	/* Return variables */
+	*oldest_entry = *r.out.oldest_entry;
 
 	/* Return result */
 	return r.out.result;
@@ -279,8 +283,8 @@ NTSTATUS rpccli_eventlog_ChangeNotify(struct rpc_pipe_client *cli,
 NTSTATUS rpccli_eventlog_OpenEventLogW(struct rpc_pipe_client *cli,
 				       TALLOC_CTX *mem_ctx,
 				       struct eventlog_OpenUnknown0 *unknown0,
-				       struct lsa_String logname,
-				       struct lsa_String servername,
+				       struct lsa_String *logname,
+				       struct lsa_String *servername,
 				       uint32_t unknown2,
 				       uint32_t unknown3,
 				       struct policy_handle *handle)
diff --git a/source3/librpc/gen_ndr/cli_eventlog.h b/source3/librpc/gen_ndr/cli_eventlog.h
index f75355c390..10790a21fc 100644
--- a/source3/librpc/gen_ndr/cli_eventlog.h
+++ b/source3/librpc/gen_ndr/cli_eventlog.h
@@ -4,7 +4,7 @@
 NTSTATUS rpccli_eventlog_ClearEventLogW(struct rpc_pipe_client *cli,
 					TALLOC_CTX *mem_ctx,
 					struct policy_handle *handle,
-					struct lsa_String *unknown);
+					struct lsa_String *backupfile);
 NTSTATUS rpccli_eventlog_BackupEventLogW(struct rpc_pipe_client *cli,
 					 TALLOC_CTX *mem_ctx);
 NTSTATUS rpccli_eventlog_CloseEventLog(struct rpc_pipe_client *cli,
@@ -17,14 +17,16 @@ NTSTATUS rpccli_eventlog_GetNumRecords(struct rpc_pipe_client *cli,
 				       struct policy_handle *handle,
 				       uint32_t *number);
 NTSTATUS rpccli_eventlog_GetOldestRecord(struct rpc_pipe_client *cli,
-					 TALLOC_CTX *mem_ctx);
+					 TALLOC_CTX *mem_ctx,
+					 struct policy_handle *handle,
+					 uint32_t *oldest_entry);
 NTSTATUS rpccli_eventlog_ChangeNotify(struct rpc_pipe_client *cli,
 				      TALLOC_CTX *mem_ctx);
 NTSTATUS rpccli_eventlog_OpenEventLogW(struct rpc_pipe_client *cli,
 				       TALLOC_CTX *mem_ctx,
 				       struct eventlog_OpenUnknown0 *unknown0,
-				       struct lsa_String logname,
-				       struct lsa_String servername,
+				       struct lsa_String *logname,
+				       struct lsa_String *servername,
 				       uint32_t unknown2,
 				       uint32_t unknown3,
 				       struct policy_handle *handle);
diff --git a/source3/librpc/gen_ndr/cli_lsa.c b/source3/librpc/gen_ndr/cli_lsa.c
index 76370cabf1..3599d9fe9c 100644
--- a/source3/librpc/gen_ndr/cli_lsa.c
+++ b/source3/librpc/gen_ndr/cli_lsa.c
@@ -135,7 +135,7 @@ NTSTATUS rpccli_lsa_QuerySecurity(struct rpc_pipe_client *cli,
 				  TALLOC_CTX *mem_ctx,
 				  struct policy_handle *handle,
 				  uint32_t sec_info,
-				  struct sec_desc_buf *sdbuf)
+				  struct sec_desc_buf **sdbuf)
 {
 	struct lsa_QuerySecurity r;
 	NTSTATUS status;
@@ -168,21 +168,25 @@ NTSTATUS rpccli_lsa_QuerySecurity(struct rpc_pipe_client *cli,
 	}
 
 	/* Return variables */
-	if (sdbuf && r.out.sdbuf) {
-		*sdbuf = *r.out.sdbuf;
-	}
+	*sdbuf = *r.out.sdbuf;
 
 	/* Return result */
 	return r.out.result;
 }
 
 NTSTATUS rpccli_lsa_SetSecObj(struct rpc_pipe_client *cli,
-			      TALLOC_CTX *mem_ctx)
+			      TALLOC_CTX *mem_ctx,
+			      struct policy_handle *handle,
+			      uint32_t sec_info,
+			      struct sec_desc_buf *sdbuf)
 {
 	struct lsa_SetSecObj r;
 	NTSTATUS status;
 
 	/* In parameters */
+	r.in.handle = handle;
+	r.in.sec_info = sec_info;
+	r.in.sdbuf = sdbuf;
 
 	if (DEBUGLEVEL >= 10) {
 		NDR_PRINT_IN_DEBUG(lsa_SetSecObj, &r);
@@ -1488,12 +1492,14 @@ NTSTATUS rpccli_lsa_LookupPrivDisplayName(struct rpc_pipe_client *cli,
 }
 
 NTSTATUS rpccli_lsa_DeleteObject(struct rpc_pipe_client *cli,
-				 TALLOC_CTX *mem_ctx)
+				 TALLOC_CTX *mem_ctx,
+				 struct policy_handle **handle)
 {
 	struct lsa_DeleteObject r;
 	NTSTATUS status;
 
 	/* In parameters */
+	r.in.handle = handle;
 
 	if (DEBUGLEVEL >= 10) {
 		NDR_PRINT_IN_DEBUG(lsa_DeleteObject, &r);
@@ -1519,6 +1525,7 @@ NTSTATUS rpccli_lsa_DeleteObject(struct rpc_pipe_client *cli,
 	}
 
 	/* Return variables */
+	*handle = *r.out.handle;
 
 	/* Return result */
 	return r.out.result;
diff --git a/source3/librpc/gen_ndr/cli_lsa.h b/source3/librpc/gen_ndr/cli_lsa.h
index c45aed1d37..4997f5cb35 100644
--- a/source3/librpc/gen_ndr/cli_lsa.h
+++ b/source3/librpc/gen_ndr/cli_lsa.h
@@ -17,9 +17,12 @@ NTSTATUS rpccli_lsa_QuerySecurity(struct rpc_pipe_client *cli,
 				  TALLOC_CTX *mem_ctx,
 				  struct policy_handle *handle,
 				  uint32_t sec_info,
-				  struct sec_desc_buf *sdbuf);
+				  struct sec_desc_buf **sdbuf);
 NTSTATUS rpccli_lsa_SetSecObj(struct rpc_pipe_client *cli,
-			      TALLOC_CTX *mem_ctx);
+			      TALLOC_CTX *mem_ctx,
+			      struct policy_handle *handle,
+			      uint32_t sec_info,
+			      struct sec_desc_buf *sdbuf);
 NTSTATUS rpccli_lsa_ChangePassword(struct rpc_pipe_client *cli,
 				   TALLOC_CTX *mem_ctx);
 NTSTATUS rpccli_lsa_OpenPolicy(struct rpc_pipe_client *cli,
@@ -163,7 +166,8 @@ NTSTATUS rpccli_lsa_LookupPrivDisplayName(struct rpc_pipe_client *cli,
 					  uint16_t *language_id,
 					  uint16_t unknown);
 NTSTATUS rpccli_lsa_DeleteObject(struct rpc_pipe_client *cli,
-				 TALLOC_CTX *mem_ctx);
+				 TALLOC_CTX *mem_ctx,
+				 struct policy_handle **handle);
 NTSTATUS rpccli_lsa_EnumAccountsWithUserRight(struct rpc_pipe_client *cli,
 					      TALLOC_CTX *mem_ctx,
 					      struct policy_handle *handle,
diff --git a/source3/librpc/gen_ndr/cli_samr.c b/source3/librpc/gen_ndr/cli_samr.c
index 73c123bbdd..a0441fcd84 100644
--- a/source3/librpc/gen_ndr/cli_samr.c
+++ b/source3/librpc/gen_ndr/cli_samr.c
@@ -136,7 +136,7 @@ NTSTATUS rpccli_samr_QuerySecurity(struct rpc_pipe_client *cli,
 				   TALLOC_CTX *mem_ctx,
 				   struct policy_handle *handle,
 				   uint32_t sec_info,
-				   struct sec_desc_buf *sdbuf)
+				   struct sec_desc_buf **sdbuf)
 {
 	struct samr_QuerySecurity r;
 	NTSTATUS status;
@@ -218,7 +218,7 @@ NTSTATUS rpccli_samr_LookupDomain(struct rpc_pipe_client *cli,
 				  TALLOC_CTX *mem_ctx,
 				  struct policy_handle *connect_handle,
 				  struct lsa_String *domain_name,
-				  struct dom_sid2 *sid)
+				  struct dom_sid2 **sid)
 {
 	struct samr_LookupDomain r;
 	NTSTATUS status;
@@ -354,7 +354,7 @@ NTSTATUS rpccli_samr_QueryDomainInfo(struct rpc_pipe_client *cli,
 				     TALLOC_CTX *mem_ctx,
 				     struct policy_handle *domain_handle,
 				     uint16_t level,
-				     union samr_DomainInfo *info)
+				     union samr_DomainInfo **info)
 {
 	struct samr_QueryDomainInfo r;
 	NTSTATUS status;
@@ -1120,7 +1120,7 @@ NTSTATUS rpccli_samr_DeleteGroupMember(struct rpc_pipe_client *cli,
 NTSTATUS rpccli_samr_QueryGroupMember(struct rpc_pipe_client *cli,
 				      TALLOC_CTX *mem_ctx,
 				      struct policy_handle *group_handle,
-				      struct samr_RidTypeArray *rids)
+				      struct samr_RidTypeArray **rids)
 {
 	struct samr_QueryGroupMember r;
 	NTSTATUS status;
@@ -2028,7 +2028,7 @@ NTSTATUS rpccli_samr_QueryDomainInfo2(struct rpc_pipe_client *cli,
 				      TALLOC_CTX *mem_ctx,
 				      struct policy_handle *domain_handle,
 				      uint16_t level,
-				      union samr_DomainInfo *info)
+				      union samr_DomainInfo **info)
 {
 	struct samr_QueryDomainInfo2 r;
 	NTSTATUS status;
@@ -2751,7 +2751,7 @@ NTSTATUS rpccli_samr_Connect3(struct rpc_pipe_client *cli,
 NTSTATUS rpccli_samr_Connect4(struct rpc_pipe_client *cli,
 			      TALLOC_CTX *mem_ctx,
 			      const char *system_name,
-			      uint32_t unknown,
+			      enum samr_ConnectVersion client_version,
 			      uint32_t access_mask,
 			      struct policy_handle *connect_handle)
 {
@@ -2760,7 +2760,7 @@ NTSTATUS rpccli_samr_Connect4(struct rpc_pipe_client *cli,
 
 	/* In parameters */
 	r.in.system_name = system_name;
-	r.in.unknown = unknown;
+	r.in.client_version = client_version;
 	r.in.access_mask = access_mask;
 
 	if (DEBUGLEVEL >= 10) {
diff --git a/source3/librpc/gen_ndr/cli_samr.h b/source3/librpc/gen_ndr/cli_samr.h
index 23f2d1f1b6..52e6b13c7a 100644
--- a/source3/librpc/gen_ndr/cli_samr.h
+++ b/source3/librpc/gen_ndr/cli_samr.h
@@ -18,7 +18,7 @@ NTSTATUS rpccli_samr_QuerySecurity(struct rpc_pipe_client *cli,
 				   TALLOC_CTX *mem_ctx,
 				   struct policy_handle *handle,
 				   uint32_t sec_info,
-				   struct sec_desc_buf *sdbuf);
+				   struct sec_desc_buf **sdbuf);
 NTSTATUS rpccli_samr_Shutdown(struct rpc_pipe_client *cli,
 			      TALLOC_CTX *mem_ctx,
 			      struct policy_handle *connect_handle);
@@ -26,7 +26,7 @@ NTSTATUS rpccli_samr_LookupDomain(struct rpc_pipe_client *cli,
 				  TALLOC_CTX *mem_ctx,
 				  struct policy_handle *connect_handle,
 				  struct lsa_String *domain_name,
-				  struct dom_sid2 *sid);
+				  struct dom_sid2 **sid);
 NTSTATUS rpccli_samr_EnumDomains(struct rpc_pipe_client *cli,
 				 TALLOC_CTX *mem_ctx,
 				 struct policy_handle *connect_handle,
@@ -44,7 +44,7 @@ NTSTATUS rpccli_samr_QueryDomainInfo(struct rpc_pipe_client *cli,
 				     TALLOC_CTX *mem_ctx,
 				     struct policy_handle *domain_handle,
 				     uint16_t level,
-				     union samr_DomainInfo *info);
+				     union samr_DomainInfo **info);
 NTSTATUS rpccli_samr_SetDomainInfo(struct rpc_pipe_client *cli,
 				   TALLOC_CTX *mem_ctx,
 				   struct policy_handle *domain_handle,
@@ -143,7 +143,7 @@ NTSTATUS rpccli_samr_DeleteGroupMember(struct rpc_pipe_client *cli,
 NTSTATUS rpccli_samr_QueryGroupMember(struct rpc_pipe_client *cli,
 				      TALLOC_CTX *mem_ctx,
 				      struct policy_handle *group_handle,
-				      struct samr_RidTypeArray *rids);
+				      struct samr_RidTypeArray **rids);
 NTSTATUS rpccli_samr_SetMemberAttributesOfGroup(struct rpc_pipe_client *cli,
 						TALLOC_CTX *mem_ctx,
 						struct policy_handle *group_handle,
@@ -250,7 +250,7 @@ NTSTATUS rpccli_samr_QueryDomainInfo2(struct rpc_pipe_client *cli,
 				      TALLOC_CTX *mem_ctx,
 				      struct policy_handle *domain_handle,
 				      uint16_t level,
-				      union samr_DomainInfo *info);
+				      union samr_DomainInfo **info);
 NTSTATUS rpccli_samr_QueryUserInfo2(struct rpc_pipe_client *cli,
 				    TALLOC_CTX *mem_ctx,
 				    struct policy_handle *user_handle,
@@ -347,7 +347,7 @@ NTSTATUS rpccli_samr_Connect3(struct rpc_pipe_client *cli,
 NTSTATUS rpccli_samr_Connect4(struct rpc_pipe_client *cli,
 			      TALLOC_CTX *mem_ctx,
 			      const char *system_name,
-			      uint32_t unknown,
+			      enum samr_ConnectVersion client_version,
 			      uint32_t access_mask,
 			      struct policy_handle *connect_handle);
 NTSTATUS rpccli_samr_ChangePasswordUser3(struct rpc_pipe_client *cli,
diff --git a/source3/librpc/gen_ndr/eventlog.h b/source3/librpc/gen_ndr/eventlog.h
index 656dadcc6c..0fd929dd99 100644
--- a/source3/librpc/gen_ndr/eventlog.h
+++ b/source3/librpc/gen_ndr/eventlog.h
@@ -53,7 +53,7 @@ struct eventlog_Record {
 struct eventlog_ClearEventLogW {
 	struct {
 		struct policy_handle *handle;/* [ref] */
-		struct lsa_String *unknown;/* [unique] */
+		struct lsa_String *backupfile;/* [unique] */
 	} in;
 
 	struct {
@@ -107,6 +107,11 @@ struct eventlog_GetNumRecords {
 
 struct eventlog_GetOldestRecord {
 	struct {
+		struct policy_handle *handle;/* [ref] */
+	} in;
+
+	struct {
+		uint32_t *oldest_entry;/* [ref] */
 		NTSTATUS result;
 	} out;
 
@@ -124,8 +129,8 @@ struct eventlog_ChangeNotify {
 struct eventlog_OpenEventLogW {
 	struct {
 		struct eventlog_OpenUnknown0 *unknown0;/* [unique] */
-		struct lsa_String logname;
-		struct lsa_String servername;
+		struct lsa_String *logname;/* [ref] */
+		struct lsa_String *servername;/* [ref] */
 		uint32_t unknown2;
 		uint32_t unknown3;
 	} in;
@@ -159,7 +164,7 @@ struct eventlog_ReadEventLogW {
 		struct policy_handle *handle;/* [ref] */
 		uint32_t flags;
 		uint32_t offset;
-		uint32_t number_of_bytes;
+		uint32_t number_of_bytes;/* [range(0,0x7FFFF)] */
 	} in;
 
 	struct {
diff --git a/source3/librpc/gen_ndr/lsa.h b/source3/librpc/gen_ndr/lsa.h
index 2657557d90..32e6739095 100644
--- a/source3/librpc/gen_ndr/lsa.h
+++ b/source3/librpc/gen_ndr/lsa.h
@@ -229,7 +229,7 @@ struct lsa_SidPtr {
 };
 
 struct lsa_SidArray {
-	uint32_t num_sids;/* [range(0 1000)] */
+	uint32_t num_sids;/* [range(0,1000)] */
 	struct lsa_SidPtr *sids;/* [unique,size_is(num_sids)] */
 }/* [public] */;
 
@@ -274,12 +274,12 @@ struct lsa_TranslatedSid {
 };
 
 struct lsa_TransSidArray {
-	uint32_t count;/* [range(0 1000)] */
+	uint32_t count;/* [range(0,1000)] */
 	struct lsa_TranslatedSid *sids;/* [unique,size_is(count)] */
 };
 
 struct lsa_RefDomainList {
-	uint32_t count;/* [range(0 1000)] */
+	uint32_t count;/* [range(0,1000)] */
 	struct lsa_DomainInfo *domains;/* [unique,size_is(count)] */
 	uint32_t max_size;
 };
@@ -312,7 +312,7 @@ struct lsa_TranslatedName {
 };
 
 struct lsa_TransNameArray {
-	uint32_t count;/* [range(0 1000)] */
+	uint32_t count;/* [range(0,1000)] */
 	struct lsa_TranslatedName *names;/* [unique,size_is(count)] */
 };
 
@@ -322,7 +322,7 @@ struct lsa_LUIDAttribute {
 };
 
 struct lsa_PrivilegeSet {
-	uint32_t count;/* [range(0 1000)] */
+	uint32_t count;/* [range(0,1000)] */
 	uint32_t unknown;
 	struct lsa_LUIDAttribute *set;/* [size_is(count)] */
 };
@@ -334,7 +334,7 @@ struct lsa_DATA_BUF {
 }/* [flag(LIBNDR_PRINT_ARRAY_HEX)] */;
 
 struct lsa_DATA_BUF2 {
-	uint32_t size;/* [range(0 65536)] */
+	uint32_t size;/* [range(0,65536)] */
 	uint8_t *data;/* [unique,size_is(size)] */
 }/* [flag(LIBNDR_PRINT_ARRAY_HEX)] */;
 
@@ -501,7 +501,7 @@ struct lsa_TranslatedName2 {
 };
 
 struct lsa_TransNameArray2 {
-	uint32_t count;/* [range(0 1000)] */
+	uint32_t count;/* [range(0,1000)] */
 	struct lsa_TranslatedName2 *names;/* [unique,size_is(count)] */
 };
 
@@ -513,7 +513,7 @@ struct lsa_TranslatedSid2 {
 };
 
 struct lsa_TransSidArray2 {
-	uint32_t count;/* [range(0 1000)] */
+	uint32_t count;/* [range(0,1000)] */
 	struct lsa_TranslatedSid2 *sids;/* [unique,size_is(count)] */
 };
 
@@ -525,12 +525,12 @@ struct lsa_TranslatedSid3 {
 };
 
 struct lsa_TransSidArray3 {
-	uint32_t count;/* [range(0 1000)] */
+	uint32_t count;/* [range(0,1000)] */
 	struct lsa_TranslatedSid3 *sids;/* [unique,size_is(count)] */
 };
 
 struct lsa_ForestTrustBinaryData {
-	uint32_t length;/* [range(0 131072)] */
+	uint32_t length;/* [range(0,131072)] */
 	uint8_t *data;/* [unique,size_is(length)] */
 };
 
@@ -572,7 +572,7 @@ struct lsa_ForestTrustRecord {
 };
 
 struct lsa_ForestTrustInformation {
-	uint32_t count;/* [range(0 4000)] */
+	uint32_t count;/* [range(0,4000)] */
 	struct lsa_ForestTrustRecord **entries;/* [unique,size_is(count)] */
 }/* [public] */;
 
@@ -625,7 +625,7 @@ struct lsa_QuerySecurity {
 	} in;
 
 	struct {
-		struct sec_desc_buf *sdbuf;/* [unique] */
+		struct sec_desc_buf **sdbuf;/* [ref] */
 		NTSTATUS result;
 	} out;
 
@@ -634,6 +634,12 @@ struct lsa_QuerySecurity {
 
 struct lsa_SetSecObj {
 	struct {
+		struct policy_handle *handle;/* [ref] */
+		uint32_t sec_info;
+		struct sec_desc_buf *sdbuf;/* [ref] */
+	} in;
+
+	struct {
 		NTSTATUS result;
 	} out;
 
@@ -717,7 +723,7 @@ struct lsa_CreateAccount {
 struct lsa_EnumAccounts {
 	struct {
 		struct policy_handle *handle;/* [ref] */
-		uint32_t num_entries;/* [range(0 8192)] */
+		uint32_t num_entries;/* [range(0,8192)] */
 		uint32_t *resume_handle;/* [ref] */
 	} in;
 
@@ -764,7 +770,7 @@ struct lsa_EnumTrustDom {
 struct lsa_LookupNames {
 	struct {
 		struct policy_handle *handle;/* [ref] */
-		uint32_t num_names;/* [range(0 1000)] */
+		uint32_t num_names;/* [range(0,1000)] */
 		struct lsa_String *names;/* [size_is(num_names)] */
 		enum lsa_LookupNamesLevel level;
 		struct lsa_TransSidArray *sids;/* [ref] */
@@ -1035,6 +1041,11 @@ struct lsa_LookupPrivDisplayName {
 
 struct lsa_DeleteObject {
 	struct {
+		struct policy_handle **handle;/* [ref] */
+	} in;
+
+	struct {
+		struct policy_handle **handle;/* [ref] */
 		NTSTATUS result;
 	} out;
 
@@ -1351,7 +1362,7 @@ struct lsa_LookupSids2 {
 struct lsa_LookupNames2 {
 	struct {
 		struct policy_handle *handle;/* [ref] */
-		uint32_t num_names;/* [range(0 1000)] */
+		uint32_t num_names;/* [range(0,1000)] */
 		struct lsa_String *names;/* [size_is(num_names)] */
 		enum lsa_LookupNamesLevel level;
 		uint32_t unknown1;
@@ -1445,7 +1456,7 @@ struct lsa_CREDRPROFILELOADED {
 struct lsa_LookupNames3 {
 	struct {
 		struct policy_handle *handle;/* [ref] */
-		uint32_t num_names;/* [range(0 1000)] */
+		uint32_t num_names;/* [range(0,1000)] */
 		struct lsa_String *names;/* [size_is(num_names)] */
 		enum lsa_LookupNamesLevel level;
 		uint32_t unknown1;
@@ -1549,7 +1560,7 @@ struct lsa_LookupSids3 {
 
 struct lsa_LookupNames4 {
 	struct {
-		uint32_t num_names;/* [range(0 1000)] */
+		uint32_t num_names;/* [range(0,1000)] */
 		struct lsa_String *names;/* [size_is(num_names)] */
 		enum lsa_LookupNamesLevel level;
 		uint32_t unknown1;
diff --git a/source3/librpc/gen_ndr/ndr_dssetup.c b/source3/librpc/gen_ndr/ndr_dssetup.c
index f089b71cd4..37586549a6 100644
--- a/source3/librpc/gen_ndr/ndr_dssetup.c
+++ b/source3/librpc/gen_ndr/ndr_dssetup.c
@@ -88,7 +88,6 @@ static enum ndr_err_code ndr_push_dssetup_DsRolePrimaryDomInfoBasic(struct ndr_p
 			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->forest, CH_UTF16)));
 			NDR_CHECK(ndr_push_charset(ndr, NDR_SCALARS, r->forest, ndr_charset_length(r->forest, CH_UTF16), sizeof(uint16_t), CH_UTF16));
 		}
-		NDR_CHECK(ndr_push_GUID(ndr, NDR_BUFFERS, &r->domain_guid));
 	}
 	return NDR_ERR_SUCCESS;
 }
@@ -162,7 +161,6 @@ static enum ndr_err_code ndr_pull_dssetup_DsRolePrimaryDomInfoBasic(struct ndr_p
 			NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->forest, ndr_get_array_length(ndr, &r->forest), sizeof(uint16_t), CH_UTF16));
 			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_forest_0, 0);
 		}
-		NDR_CHECK(ndr_pull_GUID(ndr, NDR_BUFFERS, &r->domain_guid));
 	}
 	return NDR_ERR_SUCCESS;
 }
diff --git a/source3/librpc/gen_ndr/ndr_eventlog.c b/source3/librpc/gen_ndr/ndr_eventlog.c
index ebd76515ff..c6a77c54e5 100644
--- a/source3/librpc/gen_ndr/ndr_eventlog.c
+++ b/source3/librpc/gen_ndr/ndr_eventlog.c
@@ -130,7 +130,7 @@ _PUBLIC_ enum ndr_err_code ndr_pull_eventlog_Record(struct ndr_pull *ndr, int nd
 			ndr_set_flags(&ndr->flags, LIBNDR_FLAG_STR_NULLTERM);
 			NDR_PULL_ALLOC_N(ndr, r->strings, r->num_of_strings);
 			_mem_save_strings_0 = NDR_PULL_GET_MEM_CTX(ndr);
-			NDR_PULL_SET_MEM_CTX(ndr, *r->strings, 0);
+			NDR_PULL_SET_MEM_CTX(ndr, r->strings, 0);
 			for (cntr_strings_0 = 0; cntr_strings_0 < r->num_of_strings; cntr_strings_0++) {
 				NDR_CHECK(ndr_pull_string(ndr, NDR_SCALARS, &r->strings[cntr_strings_0]));
 			}
@@ -194,9 +194,9 @@ static enum ndr_err_code ndr_push_eventlog_ClearEventLogW(struct ndr_push *ndr,
 			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
 		}
 		NDR_CHECK(ndr_push_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.handle));
-		NDR_CHECK(ndr_push_unique_ptr(ndr, r->in.unknown));
-		if (r->in.unknown) {
-			NDR_CHECK(ndr_push_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.unknown));
+		NDR_CHECK(ndr_push_unique_ptr(ndr, r->in.backupfile));
+		if (r->in.backupfile) {
+			NDR_CHECK(ndr_push_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.backupfile));
 		}
 	}
 	if (flags & NDR_OUT) {
@@ -207,9 +207,9 @@ static enum ndr_err_code ndr_push_eventlog_ClearEventLogW(struct ndr_push *ndr,
 
 static enum ndr_err_code ndr_pull_eventlog_ClearEventLogW(struct ndr_pull *ndr, int flags, struct eventlog_ClearEventLogW *r)
 {
-	uint32_t _ptr_unknown;
+	uint32_t _ptr_backupfile;
 	TALLOC_CTX *_mem_save_handle_0;
-	TALLOC_CTX *_mem_save_unknown_0;
+	TALLOC_CTX *_mem_save_backupfile_0;
 	if (flags & NDR_IN) {
 		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
 			NDR_PULL_ALLOC(ndr, r->in.handle);
@@ -218,17 +218,17 @@ static enum ndr_err_code ndr_pull_eventlog_ClearEventLogW(struct ndr_pull *ndr,
 		NDR_PULL_SET_MEM_CTX(ndr, r->in.handle, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.handle));
 		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_handle_0, LIBNDR_FLAG_REF_ALLOC);
-		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_unknown));
-		if (_ptr_unknown) {
-			NDR_PULL_ALLOC(ndr, r->in.unknown);
+		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_backupfile));
+		if (_ptr_backupfile) {
+			NDR_PULL_ALLOC(ndr, r->in.backupfile);
 		} else {
-			r->in.unknown = NULL;
+			r->in.backupfile = NULL;
 		}
-		if (r->in.unknown) {
-			_mem_save_unknown_0 = NDR_PULL_GET_MEM_CTX(ndr);
-			NDR_PULL_SET_MEM_CTX(ndr, r->in.unknown, 0);
-			NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.unknown));
-			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown_0, 0);
+		if (r->in.backupfile) {
+			_mem_save_backupfile_0 = NDR_PULL_GET_MEM_CTX(ndr);
+			NDR_PULL_SET_MEM_CTX(ndr, r->in.backupfile, 0);
+			NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.backupfile));
+			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_backupfile_0, 0);
 		}
 	}
 	if (flags & NDR_OUT) {
@@ -251,10 +251,10 @@ _PUBLIC_ void ndr_print_eventlog_ClearEventLogW(struct ndr_print *ndr, const cha
 		ndr->depth++;
 		ndr_print_policy_handle(ndr, "handle", r->in.handle);
 		ndr->depth--;
-		ndr_print_ptr(ndr, "unknown", r->in.unknown);
+		ndr_print_ptr(ndr, "backupfile", r->in.backupfile);
 		ndr->depth++;
-		if (r->in.unknown) {
-			ndr_print_lsa_String(ndr, "unknown", r->in.unknown);
+		if (r->in.backupfile) {
+			ndr_print_lsa_String(ndr, "backupfile", r->in.backupfile);
 		}
 		ndr->depth--;
 		ndr->depth--;
@@ -506,8 +506,16 @@ _PUBLIC_ void ndr_print_eventlog_GetNumRecords(struct ndr_print *ndr, const char
 static enum ndr_err_code ndr_push_eventlog_GetOldestRecord(struct ndr_push *ndr, int flags, const struct eventlog_GetOldestRecord *r)
 {
 	if (flags & NDR_IN) {
+		if (r->in.handle == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.handle));
 	}
 	if (flags & NDR_OUT) {
+		if (r->out.oldest_entry == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, *r->out.oldest_entry));
 		NDR_CHECK(ndr_push_NTSTATUS(ndr, NDR_SCALARS, r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -515,9 +523,29 @@ static enum ndr_err_code ndr_push_eventlog_GetOldestRecord(struct ndr_push *ndr,
 
 static enum ndr_err_code ndr_pull_eventlog_GetOldestRecord(struct ndr_pull *ndr, int flags, struct eventlog_GetOldestRecord *r)
 {
+	TALLOC_CTX *_mem_save_handle_0;
+	TALLOC_CTX *_mem_save_oldest_entry_0;
 	if (flags & NDR_IN) {
+		ZERO_STRUCT(r->out);
+
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, r->in.handle);
+		}
+		_mem_save_handle_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->in.handle, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.handle));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_handle_0, LIBNDR_FLAG_REF_ALLOC);
+		NDR_PULL_ALLOC(ndr, r->out.oldest_entry);
+		ZERO_STRUCTP(r->out.oldest_entry);
 	}
 	if (flags & NDR_OUT) {
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, r->out.oldest_entry);
+		}
+		_mem_save_oldest_entry_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->out.oldest_entry, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, r->out.oldest_entry));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_oldest_entry_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_NTSTATUS(ndr, NDR_SCALARS, &r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -533,11 +561,19 @@ _PUBLIC_ void ndr_print_eventlog_GetOldestRecord(struct ndr_print *ndr, const ch
 	if (flags & NDR_IN) {
 		ndr_print_struct(ndr, "in", "eventlog_GetOldestRecord");
 		ndr->depth++;
+		ndr_print_ptr(ndr, "handle", r->in.handle);
+		ndr->depth++;
+		ndr_print_policy_handle(ndr, "handle", r->in.handle);
+		ndr->depth--;
 		ndr->depth--;
 	}
 	if (flags & NDR_OUT) {
 		ndr_print_struct(ndr, "out", "eventlog_GetOldestRecord");
 		ndr->depth++;
+		ndr_print_ptr(ndr, "oldest_entry", r->out.oldest_entry);
+		ndr->depth++;
+		ndr_print_uint32(ndr, "oldest_entry", *r->out.oldest_entry);
+		ndr->depth--;
 		ndr_print_NTSTATUS(ndr, "result", r->out.result);
 		ndr->depth--;
 	}
@@ -592,8 +628,14 @@ static enum ndr_err_code ndr_push_eventlog_OpenEventLogW(struct ndr_push *ndr, i
 		if (r->in.unknown0) {
 			NDR_CHECK(ndr_push_eventlog_OpenUnknown0(ndr, NDR_SCALARS, r->in.unknown0));
 		}
-		NDR_CHECK(ndr_push_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, &r->in.logname));
-		NDR_CHECK(ndr_push_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, &r->in.servername));
+		if (r->in.logname == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.logname));
+		if (r->in.servername == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.servername));
 		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->in.unknown2));
 		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->in.unknown3));
 	}
@@ -611,6 +653,8 @@ static enum ndr_err_code ndr_pull_eventlog_OpenEventLogW(struct ndr_pull *ndr, i
 {
 	uint32_t _ptr_unknown0;
 	TALLOC_CTX *_mem_save_unknown0_0;
+	TALLOC_CTX *_mem_save_logname_0;
+	TALLOC_CTX *_mem_save_servername_0;
 	TALLOC_CTX *_mem_save_handle_0;
 	if (flags & NDR_IN) {
 		ZERO_STRUCT(r->out);
@@ -627,8 +671,20 @@ static enum ndr_err_code ndr_pull_eventlog_OpenEventLogW(struct ndr_pull *ndr, i
 			NDR_CHECK(ndr_pull_eventlog_OpenUnknown0(ndr, NDR_SCALARS, r->in.unknown0));
 			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_unknown0_0, 0);
 		}
-		NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, &r->in.logname));
-		NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, &r->in.servername));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, r->in.logname);
+		}
+		_mem_save_logname_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->in.logname, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.logname));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_logname_0, LIBNDR_FLAG_REF_ALLOC);
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, r->in.servername);
+		}
+		_mem_save_servername_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->in.servername, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_lsa_String(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.servername));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_servername_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.unknown2));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.unknown3));
 		NDR_PULL_ALLOC(ndr, r->out.handle);
@@ -663,8 +719,14 @@ _PUBLIC_ void ndr_print_eventlog_OpenEventLogW(struct ndr_print *ndr, const char
 			ndr_print_eventlog_OpenUnknown0(ndr, "unknown0", r->in.unknown0);
 		}
 		ndr->depth--;
-		ndr_print_lsa_String(ndr, "logname", &r->in.logname);
-		ndr_print_lsa_String(ndr, "servername", &r->in.servername);
+		ndr_print_ptr(ndr, "logname", r->in.logname);
+		ndr->depth++;
+		ndr_print_lsa_String(ndr, "logname", r->in.logname);
+		ndr->depth--;
+		ndr_print_ptr(ndr, "servername", r->in.servername);
+		ndr->depth++;
+		ndr_print_lsa_String(ndr, "servername", r->in.servername);
+		ndr->depth--;
 		ndr_print_uint32(ndr, "unknown2", r->in.unknown2);
 		ndr_print_uint32(ndr, "unknown3", r->in.unknown3);
 		ndr->depth--;
@@ -812,6 +874,9 @@ static enum ndr_err_code ndr_pull_eventlog_ReadEventLogW(struct ndr_pull *ndr, i
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.flags));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.offset));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.number_of_bytes));
+		if (r->in.number_of_bytes < 0 || r->in.number_of_bytes > 0x7FFFF) {
+			return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+		}
 		NDR_PULL_ALLOC_N(ndr, r->out.data, r->in.number_of_bytes);
 		memset(r->out.data, 0, r->in.number_of_bytes * sizeof(*r->out.data));
 		NDR_PULL_ALLOC(ndr, r->out.sent_size);
diff --git a/source3/librpc/gen_ndr/ndr_lsa.c b/source3/librpc/gen_ndr/ndr_lsa.c
index 25fa3d2129..89b7da5785 100644
--- a/source3/librpc/gen_ndr/ndr_lsa.c
+++ b/source3/librpc/gen_ndr/ndr_lsa.c
@@ -4768,10 +4768,14 @@ static enum ndr_err_code ndr_push_lsa_QuerySecurity(struct ndr_push *ndr, int fl
 		NDR_CHECK(ndr_push_security_secinfo(ndr, NDR_SCALARS, r->in.sec_info));
 	}
 	if (flags & NDR_OUT) {
-		NDR_CHECK(ndr_push_unique_ptr(ndr, r->out.sdbuf));
-		if (r->out.sdbuf) {
-			NDR_CHECK(ndr_push_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.sdbuf));
+		if (r->out.sdbuf == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		if (*r->out.sdbuf == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
 		}
+		NDR_CHECK(ndr_push_ref_ptr(ndr));
+		NDR_CHECK(ndr_push_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.sdbuf));
 		NDR_CHECK(ndr_push_NTSTATUS(ndr, NDR_SCALARS, r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -4782,6 +4786,7 @@ static enum ndr_err_code ndr_pull_lsa_QuerySecurity(struct ndr_pull *ndr, int fl
 	uint32_t _ptr_sdbuf;
 	TALLOC_CTX *_mem_save_handle_0;
 	TALLOC_CTX *_mem_save_sdbuf_0;
+	TALLOC_CTX *_mem_save_sdbuf_1;
 	if (flags & NDR_IN) {
 		ZERO_STRUCT(r->out);
 
@@ -4793,20 +4798,24 @@ static enum ndr_err_code ndr_pull_lsa_QuerySecurity(struct ndr_pull *ndr, int fl
 		NDR_CHECK(ndr_pull_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.handle));
 		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_handle_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_security_secinfo(ndr, NDR_SCALARS, &r->in.sec_info));
+		NDR_PULL_ALLOC(ndr, r->out.sdbuf);
+		ZERO_STRUCTP(r->out.sdbuf);
 	}
 	if (flags & NDR_OUT) {
-		NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sdbuf));
-		if (_ptr_sdbuf) {
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
 			NDR_PULL_ALLOC(ndr, r->out.sdbuf);
-		} else {
-			r->out.sdbuf = NULL;
 		}
-		if (r->out.sdbuf) {
-			_mem_save_sdbuf_0 = NDR_PULL_GET_MEM_CTX(ndr);
-			NDR_PULL_SET_MEM_CTX(ndr, r->out.sdbuf, 0);
-			NDR_CHECK(ndr_pull_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.sdbuf));
-			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sdbuf_0, 0);
+		_mem_save_sdbuf_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->out.sdbuf, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_sdbuf));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, *r->out.sdbuf);
 		}
+		_mem_save_sdbuf_1 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, *r->out.sdbuf, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.sdbuf));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sdbuf_1, LIBNDR_FLAG_REF_ALLOC);
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sdbuf_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_NTSTATUS(ndr, NDR_SCALARS, &r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -4834,9 +4843,10 @@ _PUBLIC_ void ndr_print_lsa_QuerySecurity(struct ndr_print *ndr, const char *nam
 		ndr->depth++;
 		ndr_print_ptr(ndr, "sdbuf", r->out.sdbuf);
 		ndr->depth++;
-		if (r->out.sdbuf) {
-			ndr_print_sec_desc_buf(ndr, "sdbuf", r->out.sdbuf);
-		}
+		ndr_print_ptr(ndr, "sdbuf", *r->out.sdbuf);
+		ndr->depth++;
+		ndr_print_sec_desc_buf(ndr, "sdbuf", *r->out.sdbuf);
+		ndr->depth--;
 		ndr->depth--;
 		ndr_print_NTSTATUS(ndr, "result", r->out.result);
 		ndr->depth--;
@@ -4847,6 +4857,15 @@ _PUBLIC_ void ndr_print_lsa_QuerySecurity(struct ndr_print *ndr, const char *nam
 static enum ndr_err_code ndr_push_lsa_SetSecObj(struct ndr_push *ndr, int flags, const struct lsa_SetSecObj *r)
 {
 	if (flags & NDR_IN) {
+		if (r->in.handle == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.handle));
+		NDR_CHECK(ndr_push_security_secinfo(ndr, NDR_SCALARS, r->in.sec_info));
+		if (r->in.sdbuf == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.sdbuf));
 	}
 	if (flags & NDR_OUT) {
 		NDR_CHECK(ndr_push_NTSTATUS(ndr, NDR_SCALARS, r->out.result));
@@ -4856,7 +4875,24 @@ static enum ndr_err_code ndr_push_lsa_SetSecObj(struct ndr_push *ndr, int flags,
 
 static enum ndr_err_code ndr_pull_lsa_SetSecObj(struct ndr_pull *ndr, int flags, struct lsa_SetSecObj *r)
 {
+	TALLOC_CTX *_mem_save_handle_0;
+	TALLOC_CTX *_mem_save_sdbuf_0;
 	if (flags & NDR_IN) {
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, r->in.handle);
+		}
+		_mem_save_handle_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->in.handle, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.handle));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_handle_0, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_security_secinfo(ndr, NDR_SCALARS, &r->in.sec_info));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, r->in.sdbuf);
+		}
+		_mem_save_sdbuf_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->in.sdbuf, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.sdbuf));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sdbuf_0, LIBNDR_FLAG_REF_ALLOC);
 	}
 	if (flags & NDR_OUT) {
 		NDR_CHECK(ndr_pull_NTSTATUS(ndr, NDR_SCALARS, &r->out.result));
@@ -4874,6 +4910,15 @@ _PUBLIC_ void ndr_print_lsa_SetSecObj(struct ndr_print *ndr, const char *name, i
 	if (flags & NDR_IN) {
 		ndr_print_struct(ndr, "in", "lsa_SetSecObj");
 		ndr->depth++;
+		ndr_print_ptr(ndr, "handle", r->in.handle);
+		ndr->depth++;
+		ndr_print_policy_handle(ndr, "handle", r->in.handle);
+		ndr->depth--;
+		ndr_print_security_secinfo(ndr, "sec_info", r->in.sec_info);
+		ndr_print_ptr(ndr, "sdbuf", r->in.sdbuf);
+		ndr->depth++;
+		ndr_print_sec_desc_buf(ndr, "sdbuf", r->in.sdbuf);
+		ndr->depth--;
 		ndr->depth--;
 	}
 	if (flags & NDR_OUT) {
@@ -7592,8 +7637,24 @@ _PUBLIC_ void ndr_print_lsa_LookupPrivDisplayName(struct ndr_print *ndr, const c
 static enum ndr_err_code ndr_push_lsa_DeleteObject(struct ndr_push *ndr, int flags, const struct lsa_DeleteObject *r)
 {
 	if (flags & NDR_IN) {
+		if (r->in.handle == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		if (*r->in.handle == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_ref_ptr(ndr));
+		NDR_CHECK(ndr_push_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, *r->in.handle));
 	}
 	if (flags & NDR_OUT) {
+		if (r->out.handle == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		if (*r->out.handle == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_ref_ptr(ndr));
+		NDR_CHECK(ndr_push_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.handle));
 		NDR_CHECK(ndr_push_NTSTATUS(ndr, NDR_SCALARS, r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -7601,9 +7662,44 @@ static enum ndr_err_code ndr_push_lsa_DeleteObject(struct ndr_push *ndr, int fla
 
 static enum ndr_err_code ndr_pull_lsa_DeleteObject(struct ndr_pull *ndr, int flags, struct lsa_DeleteObject *r)
 {
+	uint32_t _ptr_handle;
+	TALLOC_CTX *_mem_save_handle_0;
+	TALLOC_CTX *_mem_save_handle_1;
 	if (flags & NDR_IN) {
+		ZERO_STRUCT(r->out);
+
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, r->in.handle);
+		}
+		_mem_save_handle_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->in.handle, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_handle));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, *r->in.handle);
+		}
+		_mem_save_handle_1 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, *r->in.handle, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, *r->in.handle));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_handle_1, LIBNDR_FLAG_REF_ALLOC);
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_handle_0, LIBNDR_FLAG_REF_ALLOC);
+		NDR_PULL_ALLOC(ndr, r->out.handle);
+		*r->out.handle = *r->in.handle;
 	}
 	if (flags & NDR_OUT) {
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, r->out.handle);
+		}
+		_mem_save_handle_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->out.handle, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_handle));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, *r->out.handle);
+		}
+		_mem_save_handle_1 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, *r->out.handle, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_policy_handle(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.handle));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_handle_1, LIBNDR_FLAG_REF_ALLOC);
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_handle_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_NTSTATUS(ndr, NDR_SCALARS, &r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -7619,11 +7715,25 @@ _PUBLIC_ void ndr_print_lsa_DeleteObject(struct ndr_print *ndr, const char *name
 	if (flags & NDR_IN) {
 		ndr_print_struct(ndr, "in", "lsa_DeleteObject");
 		ndr->depth++;
+		ndr_print_ptr(ndr, "handle", r->in.handle);
+		ndr->depth++;
+		ndr_print_ptr(ndr, "handle", *r->in.handle);
+		ndr->depth++;
+		ndr_print_policy_handle(ndr, "handle", *r->in.handle);
+		ndr->depth--;
+		ndr->depth--;
 		ndr->depth--;
 	}
 	if (flags & NDR_OUT) {
 		ndr_print_struct(ndr, "out", "lsa_DeleteObject");
 		ndr->depth++;
+		ndr_print_ptr(ndr, "handle", r->out.handle);
+		ndr->depth++;
+		ndr_print_ptr(ndr, "handle", *r->out.handle);
+		ndr->depth++;
+		ndr_print_policy_handle(ndr, "handle", *r->out.handle);
+		ndr->depth--;
+		ndr->depth--;
 		ndr_print_NTSTATUS(ndr, "result", r->out.result);
 		ndr->depth--;
 	}
diff --git a/source3/librpc/gen_ndr/ndr_samr.c b/source3/librpc/gen_ndr/ndr_samr.c
index adbe549df0..ff3f0a1c98 100644
--- a/source3/librpc/gen_ndr/ndr_samr.c
+++ b/source3/librpc/gen_ndr/ndr_samr.c
@@ -4380,6 +4380,32 @@ _PUBLIC_ void ndr_print_samr_PwInfo(struct ndr_print *ndr, const char *name, con
 	ndr->depth--;
 }
 
+static enum ndr_err_code ndr_push_samr_ConnectVersion(struct ndr_push *ndr, int ndr_flags, enum samr_ConnectVersion r)
+{
+	NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, r));
+	return NDR_ERR_SUCCESS;
+}
+
+static enum ndr_err_code ndr_pull_samr_ConnectVersion(struct ndr_pull *ndr, int ndr_flags, enum samr_ConnectVersion *r)
+{
+	uint16_t v;
+	NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &v));
+	*r = v;
+	return NDR_ERR_SUCCESS;
+}
+
+_PUBLIC_ void ndr_print_samr_ConnectVersion(struct ndr_print *ndr, const char *name, enum samr_ConnectVersion r)
+{
+	const char *val = NULL;
+
+	switch (r) {
+		case SAMR_CONNECT_PRE_W2K: val = "SAMR_CONNECT_PRE_W2K"; break;
+		case SAMR_CONNECT_W2K: val = "SAMR_CONNECT_W2K"; break;
+		case SAMR_CONNECT_AFTER_W2K: val = "SAMR_CONNECT_AFTER_W2K"; break;
+	}
+	ndr_print_enum(ndr, name, "ENUM", val, r);
+}
+
 static enum ndr_err_code ndr_push_samr_ChangeReject(struct ndr_push *ndr, int ndr_flags, const struct samr_ChangeReject *r)
 {
 	if (ndr_flags & NDR_SCALARS) {
@@ -4420,7 +4446,7 @@ static enum ndr_err_code ndr_push_samr_ConnectInfo1(struct ndr_push *ndr, int nd
 {
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_push_align(ndr, 4));
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->unknown1));
+		NDR_CHECK(ndr_push_samr_ConnectVersion(ndr, NDR_SCALARS, r->client_version));
 		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->unknown2));
 	}
 	if (ndr_flags & NDR_BUFFERS) {
@@ -4432,7 +4458,7 @@ static enum ndr_err_code ndr_pull_samr_ConnectInfo1(struct ndr_pull *ndr, int nd
 {
 	if (ndr_flags & NDR_SCALARS) {
 		NDR_CHECK(ndr_pull_align(ndr, 4));
-		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->unknown1));
+		NDR_CHECK(ndr_pull_samr_ConnectVersion(ndr, NDR_SCALARS, &r->client_version));
 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->unknown2));
 	}
 	if (ndr_flags & NDR_BUFFERS) {
@@ -4444,7 +4470,7 @@ _PUBLIC_ void ndr_print_samr_ConnectInfo1(struct ndr_print *ndr, const char *nam
 {
 	ndr_print_struct(ndr, name, "samr_ConnectInfo1");
 	ndr->depth++;
-	ndr_print_uint32(ndr, "unknown1", r->unknown1);
+	ndr_print_samr_ConnectVersion(ndr, "client_version", r->client_version);
 	ndr_print_uint32(ndr, "unknown2", r->unknown2);
 	ndr->depth--;
 }
@@ -5425,7 +5451,11 @@ static enum ndr_err_code ndr_push_samr_QuerySecurity(struct ndr_push *ndr, int f
 		if (r->out.sdbuf == NULL) {
 			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
 		}
-		NDR_CHECK(ndr_push_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.sdbuf));
+		if (*r->out.sdbuf == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_ref_ptr(ndr));
+		NDR_CHECK(ndr_push_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.sdbuf));
 		NDR_CHECK(ndr_push_NTSTATUS(ndr, NDR_SCALARS, r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -5433,8 +5463,10 @@ static enum ndr_err_code ndr_push_samr_QuerySecurity(struct ndr_push *ndr, int f
 
 static enum ndr_err_code ndr_pull_samr_QuerySecurity(struct ndr_pull *ndr, int flags, struct samr_QuerySecurity *r)
 {
+	uint32_t _ptr_sdbuf;
 	TALLOC_CTX *_mem_save_handle_0;
 	TALLOC_CTX *_mem_save_sdbuf_0;
+	TALLOC_CTX *_mem_save_sdbuf_1;
 	if (flags & NDR_IN) {
 		ZERO_STRUCT(r->out);
 
@@ -5455,7 +5487,14 @@ static enum ndr_err_code ndr_pull_samr_QuerySecurity(struct ndr_pull *ndr, int f
 		}
 		_mem_save_sdbuf_0 = NDR_PULL_GET_MEM_CTX(ndr);
 		NDR_PULL_SET_MEM_CTX(ndr, r->out.sdbuf, LIBNDR_FLAG_REF_ALLOC);
-		NDR_CHECK(ndr_pull_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.sdbuf));
+		NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_sdbuf));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, *r->out.sdbuf);
+		}
+		_mem_save_sdbuf_1 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, *r->out.sdbuf, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_sec_desc_buf(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.sdbuf));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sdbuf_1, LIBNDR_FLAG_REF_ALLOC);
 		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sdbuf_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_NTSTATUS(ndr, NDR_SCALARS, &r->out.result));
 	}
@@ -5484,7 +5523,10 @@ _PUBLIC_ void ndr_print_samr_QuerySecurity(struct ndr_print *ndr, const char *na
 		ndr->depth++;
 		ndr_print_ptr(ndr, "sdbuf", r->out.sdbuf);
 		ndr->depth++;
-		ndr_print_sec_desc_buf(ndr, "sdbuf", r->out.sdbuf);
+		ndr_print_ptr(ndr, "sdbuf", *r->out.sdbuf);
+		ndr->depth++;
+		ndr_print_sec_desc_buf(ndr, "sdbuf", *r->out.sdbuf);
+		ndr->depth--;
 		ndr->depth--;
 		ndr_print_NTSTATUS(ndr, "result", r->out.result);
 		ndr->depth--;
@@ -5565,7 +5607,11 @@ static enum ndr_err_code ndr_push_samr_LookupDomain(struct ndr_push *ndr, int fl
 		if (r->out.sid == NULL) {
 			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
 		}
-		NDR_CHECK(ndr_push_dom_sid2(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.sid));
+		if (*r->out.sid == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_ref_ptr(ndr));
+		NDR_CHECK(ndr_push_dom_sid2(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.sid));
 		NDR_CHECK(ndr_push_NTSTATUS(ndr, NDR_SCALARS, r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -5573,9 +5619,11 @@ static enum ndr_err_code ndr_push_samr_LookupDomain(struct ndr_push *ndr, int fl
 
 static enum ndr_err_code ndr_pull_samr_LookupDomain(struct ndr_pull *ndr, int flags, struct samr_LookupDomain *r)
 {
+	uint32_t _ptr_sid;
 	TALLOC_CTX *_mem_save_connect_handle_0;
 	TALLOC_CTX *_mem_save_domain_name_0;
 	TALLOC_CTX *_mem_save_sid_0;
+	TALLOC_CTX *_mem_save_sid_1;
 	if (flags & NDR_IN) {
 		ZERO_STRUCT(r->out);
 
@@ -5602,7 +5650,14 @@ static enum ndr_err_code ndr_pull_samr_LookupDomain(struct ndr_pull *ndr, int fl
 		}
 		_mem_save_sid_0 = NDR_PULL_GET_MEM_CTX(ndr);
 		NDR_PULL_SET_MEM_CTX(ndr, r->out.sid, LIBNDR_FLAG_REF_ALLOC);
-		NDR_CHECK(ndr_pull_dom_sid2(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.sid));
+		NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_sid));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, *r->out.sid);
+		}
+		_mem_save_sid_1 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, *r->out.sid, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_dom_sid2(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.sid));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sid_1, LIBNDR_FLAG_REF_ALLOC);
 		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sid_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_NTSTATUS(ndr, NDR_SCALARS, &r->out.result));
 	}
@@ -5634,7 +5689,10 @@ _PUBLIC_ void ndr_print_samr_LookupDomain(struct ndr_print *ndr, const char *nam
 		ndr->depth++;
 		ndr_print_ptr(ndr, "sid", r->out.sid);
 		ndr->depth++;
-		ndr_print_dom_sid2(ndr, "sid", r->out.sid);
+		ndr_print_ptr(ndr, "sid", *r->out.sid);
+		ndr->depth++;
+		ndr_print_dom_sid2(ndr, "sid", *r->out.sid);
+		ndr->depth--;
 		ndr->depth--;
 		ndr_print_NTSTATUS(ndr, "result", r->out.result);
 		ndr->depth--;
@@ -5882,8 +5940,12 @@ static enum ndr_err_code ndr_push_samr_QueryDomainInfo(struct ndr_push *ndr, int
 		if (r->out.info == NULL) {
 			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
 		}
-		NDR_CHECK(ndr_push_set_switch_value(ndr, r->out.info, r->in.level));
-		NDR_CHECK(ndr_push_samr_DomainInfo(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.info));
+		if (*r->out.info == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_ref_ptr(ndr));
+		NDR_CHECK(ndr_push_set_switch_value(ndr, *r->out.info, r->in.level));
+		NDR_CHECK(ndr_push_samr_DomainInfo(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.info));
 		NDR_CHECK(ndr_push_NTSTATUS(ndr, NDR_SCALARS, r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -5891,8 +5953,10 @@ static enum ndr_err_code ndr_push_samr_QueryDomainInfo(struct ndr_push *ndr, int
 
 static enum ndr_err_code ndr_pull_samr_QueryDomainInfo(struct ndr_pull *ndr, int flags, struct samr_QueryDomainInfo *r)
 {
+	uint32_t _ptr_info;
 	TALLOC_CTX *_mem_save_domain_handle_0;
 	TALLOC_CTX *_mem_save_info_0;
+	TALLOC_CTX *_mem_save_info_1;
 	if (flags & NDR_IN) {
 		ZERO_STRUCT(r->out);
 
@@ -5913,8 +5977,15 @@ static enum ndr_err_code ndr_pull_samr_QueryDomainInfo(struct ndr_pull *ndr, int
 		}
 		_mem_save_info_0 = NDR_PULL_GET_MEM_CTX(ndr);
 		NDR_PULL_SET_MEM_CTX(ndr, r->out.info, LIBNDR_FLAG_REF_ALLOC);
-		NDR_CHECK(ndr_pull_set_switch_value(ndr, r->out.info, r->in.level));
-		NDR_CHECK(ndr_pull_samr_DomainInfo(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.info));
+		NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_info));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, *r->out.info);
+		}
+		_mem_save_info_1 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, *r->out.info, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_set_switch_value(ndr, *r->out.info, r->in.level));
+		NDR_CHECK(ndr_pull_samr_DomainInfo(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.info));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_info_1, LIBNDR_FLAG_REF_ALLOC);
 		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_info_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_NTSTATUS(ndr, NDR_SCALARS, &r->out.result));
 	}
@@ -5943,8 +6014,11 @@ _PUBLIC_ void ndr_print_samr_QueryDomainInfo(struct ndr_print *ndr, const char *
 		ndr->depth++;
 		ndr_print_ptr(ndr, "info", r->out.info);
 		ndr->depth++;
-		ndr_print_set_switch_value(ndr, r->out.info, r->in.level);
-		ndr_print_samr_DomainInfo(ndr, "info", r->out.info);
+		ndr_print_ptr(ndr, "info", *r->out.info);
+		ndr->depth++;
+		ndr_print_set_switch_value(ndr, *r->out.info, r->in.level);
+		ndr_print_samr_DomainInfo(ndr, "info", *r->out.info);
+		ndr->depth--;
 		ndr->depth--;
 		ndr_print_NTSTATUS(ndr, "result", r->out.result);
 		ndr->depth--;
@@ -7610,7 +7684,11 @@ static enum ndr_err_code ndr_push_samr_QueryGroupMember(struct ndr_push *ndr, in
 		if (r->out.rids == NULL) {
 			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
 		}
-		NDR_CHECK(ndr_push_samr_RidTypeArray(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.rids));
+		if (*r->out.rids == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_ref_ptr(ndr));
+		NDR_CHECK(ndr_push_samr_RidTypeArray(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.rids));
 		NDR_CHECK(ndr_push_NTSTATUS(ndr, NDR_SCALARS, r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -7618,8 +7696,10 @@ static enum ndr_err_code ndr_push_samr_QueryGroupMember(struct ndr_push *ndr, in
 
 static enum ndr_err_code ndr_pull_samr_QueryGroupMember(struct ndr_pull *ndr, int flags, struct samr_QueryGroupMember *r)
 {
+	uint32_t _ptr_rids;
 	TALLOC_CTX *_mem_save_group_handle_0;
 	TALLOC_CTX *_mem_save_rids_0;
+	TALLOC_CTX *_mem_save_rids_1;
 	if (flags & NDR_IN) {
 		ZERO_STRUCT(r->out);
 
@@ -7639,7 +7719,14 @@ static enum ndr_err_code ndr_pull_samr_QueryGroupMember(struct ndr_pull *ndr, in
 		}
 		_mem_save_rids_0 = NDR_PULL_GET_MEM_CTX(ndr);
 		NDR_PULL_SET_MEM_CTX(ndr, r->out.rids, LIBNDR_FLAG_REF_ALLOC);
-		NDR_CHECK(ndr_pull_samr_RidTypeArray(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.rids));
+		NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_rids));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, *r->out.rids);
+		}
+		_mem_save_rids_1 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, *r->out.rids, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_samr_RidTypeArray(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.rids));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_rids_1, LIBNDR_FLAG_REF_ALLOC);
 		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_rids_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_NTSTATUS(ndr, NDR_SCALARS, &r->out.result));
 	}
@@ -7667,7 +7754,10 @@ _PUBLIC_ void ndr_print_samr_QueryGroupMember(struct ndr_print *ndr, const char
 		ndr->depth++;
 		ndr_print_ptr(ndr, "rids", r->out.rids);
 		ndr->depth++;
-		ndr_print_samr_RidTypeArray(ndr, "rids", r->out.rids);
+		ndr_print_ptr(ndr, "rids", *r->out.rids);
+		ndr->depth++;
+		ndr_print_samr_RidTypeArray(ndr, "rids", *r->out.rids);
+		ndr->depth--;
 		ndr->depth--;
 		ndr_print_NTSTATUS(ndr, "result", r->out.result);
 		ndr->depth--;
@@ -9381,8 +9471,12 @@ static enum ndr_err_code ndr_push_samr_QueryDomainInfo2(struct ndr_push *ndr, in
 		if (r->out.info == NULL) {
 			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
 		}
-		NDR_CHECK(ndr_push_set_switch_value(ndr, r->out.info, r->in.level));
-		NDR_CHECK(ndr_push_samr_DomainInfo(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.info));
+		if (*r->out.info == NULL) {
+			return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER, "NULL [ref] pointer");
+		}
+		NDR_CHECK(ndr_push_ref_ptr(ndr));
+		NDR_CHECK(ndr_push_set_switch_value(ndr, *r->out.info, r->in.level));
+		NDR_CHECK(ndr_push_samr_DomainInfo(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.info));
 		NDR_CHECK(ndr_push_NTSTATUS(ndr, NDR_SCALARS, r->out.result));
 	}
 	return NDR_ERR_SUCCESS;
@@ -9390,8 +9484,10 @@ static enum ndr_err_code ndr_push_samr_QueryDomainInfo2(struct ndr_push *ndr, in
 
 static enum ndr_err_code ndr_pull_samr_QueryDomainInfo2(struct ndr_pull *ndr, int flags, struct samr_QueryDomainInfo2 *r)
 {
+	uint32_t _ptr_info;
 	TALLOC_CTX *_mem_save_domain_handle_0;
 	TALLOC_CTX *_mem_save_info_0;
+	TALLOC_CTX *_mem_save_info_1;
 	if (flags & NDR_IN) {
 		ZERO_STRUCT(r->out);
 
@@ -9412,8 +9508,15 @@ static enum ndr_err_code ndr_pull_samr_QueryDomainInfo2(struct ndr_pull *ndr, in
 		}
 		_mem_save_info_0 = NDR_PULL_GET_MEM_CTX(ndr);
 		NDR_PULL_SET_MEM_CTX(ndr, r->out.info, LIBNDR_FLAG_REF_ALLOC);
-		NDR_CHECK(ndr_pull_set_switch_value(ndr, r->out.info, r->in.level));
-		NDR_CHECK(ndr_pull_samr_DomainInfo(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.info));
+		NDR_CHECK(ndr_pull_ref_ptr(ndr, &_ptr_info));
+		if (ndr->flags & LIBNDR_FLAG_REF_ALLOC) {
+			NDR_PULL_ALLOC(ndr, *r->out.info);
+		}
+		_mem_save_info_1 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, *r->out.info, LIBNDR_FLAG_REF_ALLOC);
+		NDR_CHECK(ndr_pull_set_switch_value(ndr, *r->out.info, r->in.level));
+		NDR_CHECK(ndr_pull_samr_DomainInfo(ndr, NDR_SCALARS|NDR_BUFFERS, *r->out.info));
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_info_1, LIBNDR_FLAG_REF_ALLOC);
 		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_info_0, LIBNDR_FLAG_REF_ALLOC);
 		NDR_CHECK(ndr_pull_NTSTATUS(ndr, NDR_SCALARS, &r->out.result));
 	}
@@ -9442,8 +9545,11 @@ _PUBLIC_ void ndr_print_samr_QueryDomainInfo2(struct ndr_print *ndr, const char
 		ndr->depth++;
 		ndr_print_ptr(ndr, "info", r->out.info);
 		ndr->depth++;
-		ndr_print_set_switch_value(ndr, r->out.info, r->in.level);
-		ndr_print_samr_DomainInfo(ndr, "info", r->out.info);
+		ndr_print_ptr(ndr, "info", *r->out.info);
+		ndr->depth++;
+		ndr_print_set_switch_value(ndr, *r->out.info, r->in.level);
+		ndr_print_samr_DomainInfo(ndr, "info", *r->out.info);
+		ndr->depth--;
 		ndr->depth--;
 		ndr_print_NTSTATUS(ndr, "result", r->out.result);
 		ndr->depth--;
@@ -10977,7 +11083,7 @@ static enum ndr_err_code ndr_push_samr_Connect4(struct ndr_push *ndr, int flags,
 			NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_charset_length(r->in.system_name, CH_UTF16)));
 			NDR_CHECK(ndr_push_charset(ndr, NDR_SCALARS, r->in.system_name, ndr_charset_length(r->in.system_name, CH_UTF16), sizeof(uint16_t), CH_UTF16));
 		}
-		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->in.unknown));
+		NDR_CHECK(ndr_push_samr_ConnectVersion(ndr, NDR_SCALARS, r->in.client_version));
 		NDR_CHECK(ndr_push_samr_ConnectAccessMask(ndr, NDR_SCALARS, r->in.access_mask));
 	}
 	if (flags & NDR_OUT) {
@@ -11016,7 +11122,7 @@ static enum ndr_err_code ndr_pull_samr_Connect4(struct ndr_pull *ndr, int flags,
 			NDR_CHECK(ndr_pull_charset(ndr, NDR_SCALARS, &r->in.system_name, ndr_get_array_length(ndr, &r->in.system_name), sizeof(uint16_t), CH_UTF16));
 			NDR_PULL_SET_MEM_CTX(ndr, _mem_save_system_name_0, 0);
 		}
-		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->in.unknown));
+		NDR_CHECK(ndr_pull_samr_ConnectVersion(ndr, NDR_SCALARS, &r->in.client_version));
 		NDR_CHECK(ndr_pull_samr_ConnectAccessMask(ndr, NDR_SCALARS, &r->in.access_mask));
 		NDR_PULL_ALLOC(ndr, r->out.connect_handle);
 		ZERO_STRUCTP(r->out.connect_handle);
@@ -11050,7 +11156,7 @@ _PUBLIC_ void ndr_print_samr_Connect4(struct ndr_print *ndr, const char *name, i
 			ndr_print_string(ndr, "system_name", r->in.system_name);
 		}
 		ndr->depth--;
-		ndr_print_uint32(ndr, "unknown", r->in.unknown);
+		ndr_print_samr_ConnectVersion(ndr, "client_version", r->in.client_version);
 		ndr_print_samr_ConnectAccessMask(ndr, "access_mask", r->in.access_mask);
 		ndr->depth--;
 	}
diff --git a/source3/librpc/gen_ndr/ndr_samr.h b/source3/librpc/gen_ndr/ndr_samr.h
index 96fd59b507..f769cddddb 100644
--- a/source3/librpc/gen_ndr/ndr_samr.h
+++ b/source3/librpc/gen_ndr/ndr_samr.h
@@ -237,6 +237,7 @@ void ndr_print_samr_DispEntryAscii(struct ndr_print *ndr, const char *name, cons
 void ndr_print_samr_DispInfoAscii(struct ndr_print *ndr, const char *name, const struct samr_DispInfoAscii *r);
 void ndr_print_samr_DispInfo(struct ndr_print *ndr, const char *name, const union samr_DispInfo *r);
 void ndr_print_samr_PwInfo(struct ndr_print *ndr, const char *name, const struct samr_PwInfo *r);
+void ndr_print_samr_ConnectVersion(struct ndr_print *ndr, const char *name, enum samr_ConnectVersion r);
 void ndr_print_samr_ChangeReject(struct ndr_print *ndr, const char *name, const struct samr_ChangeReject *r);
 void ndr_print_samr_ConnectInfo1(struct ndr_print *ndr, const char *name, const struct samr_ConnectInfo1 *r);
 void ndr_print_samr_ConnectInfo(struct ndr_print *ndr, const char *name, const union samr_ConnectInfo *r);
diff --git a/source3/librpc/gen_ndr/netlogon.h b/source3/librpc/gen_ndr/netlogon.h
index c8f3c03c79..612e30914a 100644
--- a/source3/librpc/gen_ndr/netlogon.h
+++ b/source3/librpc/gen_ndr/netlogon.h
@@ -1350,7 +1350,7 @@ struct netr_NETRLOGONSENDTOSAM {
 struct netr_DsRAddressToSitenamesW {
 	struct {
 		const char *server_name;/* [unique,charset(UTF16)] */
-		uint32_t count;/* [range(0 32000)] */
+		uint32_t count;/* [range(0,32000)] */
 		struct netr_DsRAddress *addresses;/* [ref,size_is(count)] */
 	} in;
 
@@ -1405,7 +1405,7 @@ struct netr_NetrEnumerateTrustedDomainsEx {
 struct netr_DsRAddressToSitenamesExW {
 	struct {
 		const char *server_name;/* [unique,charset(UTF16)] */
-		uint32_t count;/* [range(0 32000)] */
+		uint32_t count;/* [range(0,32000)] */
 		struct netr_DsRAddress *addresses;/* [ref,size_is(count)] */
 	} in;
 
diff --git a/source3/librpc/gen_ndr/samr.h b/source3/librpc/gen_ndr/samr.h
index c6a68e8bd5..d0e758d72f 100644
--- a/source3/librpc/gen_ndr/samr.h
+++ b/source3/librpc/gen_ndr/samr.h
@@ -200,7 +200,7 @@ union samr_DomainInfo {
 }/* [switch_type(uint16)] */;
 
 struct samr_Ids {
-	uint32_t count;/* [range(0 1024)] */
+	uint32_t count;/* [range(0,1024)] */
 	uint32_t *ids;/* [unique,size_is(count)] */
 };
 
@@ -603,6 +603,21 @@ struct samr_PwInfo {
 	uint32_t password_properties;
 };
 
+enum samr_ConnectVersion
+#ifndef USE_UINT_ENUMS
+ {
+	SAMR_CONNECT_PRE_W2K=1,
+	SAMR_CONNECT_W2K=2,
+	SAMR_CONNECT_AFTER_W2K=3
+}
+#else
+ { __donnot_use_enum_samr_ConnectVersion=0x7FFFFFFF}
+#define SAMR_CONNECT_PRE_W2K ( 1 )
+#define SAMR_CONNECT_W2K ( 2 )
+#define SAMR_CONNECT_AFTER_W2K ( 3 )
+#endif
+;
+
 enum samr_RejectReason;
 
 struct samr_ChangeReject {
@@ -612,7 +627,7 @@ struct samr_ChangeReject {
 };
 
 struct samr_ConnectInfo1 {
-	uint32_t unknown1;
+	enum samr_ConnectVersion client_version;
 	uint32_t unknown2;
 };
 
@@ -773,7 +788,7 @@ struct samr_QuerySecurity {
 	} in;
 
 	struct {
-		struct sec_desc_buf *sdbuf;/* [ref] */
+		struct sec_desc_buf **sdbuf;/* [ref] */
 		NTSTATUS result;
 	} out;
 
@@ -799,7 +814,7 @@ struct samr_LookupDomain {
 	} in;
 
 	struct {
-		struct dom_sid2 *sid;/* [ref] */
+		struct dom_sid2 **sid;/* [ref] */
 		NTSTATUS result;
 	} out;
 
@@ -845,7 +860,7 @@ struct samr_QueryDomainInfo {
 	} in;
 
 	struct {
-		union samr_DomainInfo *info;/* [ref,switch_is(level)] */
+		union samr_DomainInfo **info;/* [ref,switch_is(level)] */
 		NTSTATUS result;
 	} out;
 
@@ -983,7 +998,7 @@ struct samr_GetAliasMembership {
 struct samr_LookupNames {
 	struct {
 		struct policy_handle *domain_handle;/* [ref] */
-		uint32_t num_names;/* [range(0 1000)] */
+		uint32_t num_names;/* [range(0,1000)] */
 		struct lsa_String *names;/* [length_is(num_names),size_is(1000)] */
 	} in;
 
@@ -999,7 +1014,7 @@ struct samr_LookupNames {
 struct samr_LookupRids {
 	struct {
 		struct policy_handle *domain_handle;/* [ref] */
-		uint32_t num_rids;/* [range(0 1000)] */
+		uint32_t num_rids;/* [range(0,1000)] */
 		uint32_t *rids;/* [length_is(num_rids),size_is(1000)] */
 	} in;
 
@@ -1101,7 +1116,7 @@ struct samr_QueryGroupMember {
 	} in;
 
 	struct {
-		struct samr_RidTypeArray *rids;/* [ref] */
+		struct samr_RidTypeArray **rids;/* [ref] */
 		NTSTATUS result;
 	} out;
 
@@ -1399,7 +1414,7 @@ struct samr_QueryDomainInfo2 {
 	} in;
 
 	struct {
-		union samr_DomainInfo *info;/* [ref,switch_is(level)] */
+		union samr_DomainInfo **info;/* [ref,switch_is(level)] */
 		NTSTATUS result;
 	} out;
 
@@ -1637,7 +1652,7 @@ struct samr_Connect3 {
 struct samr_Connect4 {
 	struct {
 		const char *system_name;/* [unique,charset(UTF16)] */
-		uint32_t unknown;
+		enum samr_ConnectVersion client_version;
 		uint32_t access_mask;
 	} in;
 
diff --git a/source3/librpc/gen_ndr/security.h b/source3/librpc/gen_ndr/security.h
index f37b5d70f0..a17fd512f7 100644
--- a/source3/librpc/gen_ndr/security.h
+++ b/source3/librpc/gen_ndr/security.h
@@ -258,7 +258,7 @@ enum security_acl_revision
 struct security_acl {
 	enum security_acl_revision revision;
 	uint16_t size;/* [value(ndr_size_security_acl(r,ndr->flags))] */
-	uint32_t num_aces;/* [range(0 1000)] */
+	uint32_t num_aces;/* [range(0,1000)] */
 	struct security_ace *aces;
 }/* [gensize,public,nosize] */;
 
@@ -301,7 +301,7 @@ struct security_descriptor {
 }/* [gensize,public,flag(LIBNDR_FLAG_LITTLE_ENDIAN),nosize] */;
 
 struct sec_desc_buf {
-	uint32_t sd_size;/* [value(ndr_size_security_descriptor(sd,ndr->flags)),range(0 0x40000)] */
+	uint32_t sd_size;/* [value(ndr_size_security_descriptor(sd,ndr->flags)),range(0,0x40000)] */
 	struct security_descriptor *sd;/* [unique,subcontext(4)] */
 }/* [public] */;
 
diff --git a/source3/librpc/gen_ndr/srv_eventlog.c b/source3/librpc/gen_ndr/srv_eventlog.c
index d9310a8fbb..fc94993cee 100644
--- a/source3/librpc/gen_ndr/srv_eventlog.c
+++ b/source3/librpc/gen_ndr/srv_eventlog.c
@@ -418,6 +418,13 @@ static bool api_eventlog_GetOldestRecord(pipes_struct *p)
 		NDR_PRINT_IN_DEBUG(eventlog_GetOldestRecord, r);
 	}
 
+	ZERO_STRUCT(r->out);
+	r->out.oldest_entry = talloc_zero(r, uint32_t);
+	if (r->out.oldest_entry == NULL) {
+		talloc_free(r);
+		return false;
+	}
+
 	r->out.result = _eventlog_GetOldestRecord(p, r);
 
 	if (p->rng_fault_state) {
diff --git a/source3/librpc/gen_ndr/srv_lsa.c b/source3/librpc/gen_ndr/srv_lsa.c
index 8f8f985650..aa870a6d59 100644
--- a/source3/librpc/gen_ndr/srv_lsa.c
+++ b/source3/librpc/gen_ndr/srv_lsa.c
@@ -274,7 +274,7 @@ static bool api_lsa_QuerySecurity(pipes_struct *p)
 	}
 
 	ZERO_STRUCT(r->out);
-	r->out.sdbuf = talloc_zero(r, struct sec_desc_buf);
+	r->out.sdbuf = talloc_zero(r, struct sec_desc_buf *);
 	if (r->out.sdbuf == NULL) {
 		talloc_free(r);
 		return false;
@@ -2674,6 +2674,8 @@ static bool api_lsa_DeleteObject(pipes_struct *p)
 		NDR_PRINT_IN_DEBUG(lsa_DeleteObject, r);
 	}
 
+	ZERO_STRUCT(r->out);
+	r->out.handle = r->in.handle;
 	r->out.result = _lsa_DeleteObject(p, r);
 
 	if (p->rng_fault_state) {
diff --git a/source3/librpc/gen_ndr/srv_samr.c b/source3/librpc/gen_ndr/srv_samr.c
index 72116f355b..38cc59978c 100644
--- a/source3/librpc/gen_ndr/srv_samr.c
+++ b/source3/librpc/gen_ndr/srv_samr.c
@@ -273,7 +273,7 @@ static bool api_samr_QuerySecurity(pipes_struct *p)
 	}
 
 	ZERO_STRUCT(r->out);
-	r->out.sdbuf = talloc_zero(r, struct sec_desc_buf);
+	r->out.sdbuf = talloc_zero(r, struct sec_desc_buf *);
 	if (r->out.sdbuf == NULL) {
 		talloc_free(r);
 		return false;
@@ -426,7 +426,7 @@ static bool api_samr_LookupDomain(pipes_struct *p)
 	}
 
 	ZERO_STRUCT(r->out);
-	r->out.sid = talloc_zero(r, struct dom_sid2);
+	r->out.sid = talloc_zero(r, struct dom_sid2 *);
 	if (r->out.sid == NULL) {
 		talloc_free(r);
 		return false;
@@ -673,7 +673,7 @@ static bool api_samr_QueryDomainInfo(pipes_struct *p)
 	}
 
 	ZERO_STRUCT(r->out);
-	r->out.info = talloc_zero(r, union samr_DomainInfo);
+	r->out.info = talloc_zero(r, union samr_DomainInfo *);
 	if (r->out.info == NULL) {
 		talloc_free(r);
 		return false;
@@ -2051,7 +2051,7 @@ static bool api_samr_QueryGroupMember(pipes_struct *p)
 	}
 
 	ZERO_STRUCT(r->out);
-	r->out.rids = talloc_zero(r, struct samr_RidTypeArray);
+	r->out.rids = talloc_zero(r, struct samr_RidTypeArray *);
 	if (r->out.rids == NULL) {
 		talloc_free(r);
 		return false;
@@ -3670,7 +3670,7 @@ static bool api_samr_QueryDomainInfo2(pipes_struct *p)
 	}
 
 	ZERO_STRUCT(r->out);
-	r->out.info = talloc_zero(r, union samr_DomainInfo);
+	r->out.info = talloc_zero(r, union samr_DomainInfo *);
 	if (r->out.info == NULL) {
 		talloc_free(r);
 		return false;
diff --git a/source3/librpc/gen_ndr/unixinfo.h b/source3/librpc/gen_ndr/unixinfo.h
index 34dc27f469..bfe0934ccd 100644
--- a/source3/librpc/gen_ndr/unixinfo.h
+++ b/source3/librpc/gen_ndr/unixinfo.h
@@ -68,12 +68,12 @@ struct unixinfo_GidToSid {
 struct unixinfo_GetPWUid {
 	struct {
 		uint64_t *uids;/* [size_is(*count)] */
-		uint32_t *count;/* [ref,range(0 1023)] */
+		uint32_t *count;/* [ref,range(0,1023)] */
 	} in;
 
 	struct {
 		struct unixinfo_GetPWUidInfo *infos;/* [size_is(*count)] */
-		uint32_t *count;/* [ref,range(0 1023)] */
+		uint32_t *count;/* [ref,range(0,1023)] */
 		NTSTATUS result;
 	} out;