3 files changed, 15 insertions, 10 deletions

diff --git a/source4/rpc_server/drsuapi/dcesrv_drsuapi.h b/source4/rpc_server/drsuapi/dcesrv_drsuapi.h
index a6b11c5dac..40978629fa 100644
--- a/source4/rpc_server/drsuapi/dcesrv_drsuapi.h
+++ b/source4/rpc_server/drsuapi/dcesrv_drsuapi.h
@@ -55,7 +55,7 @@ int drsuapi_search_with_extended_dn(struct ldb_context *ldb,
 				    enum ldb_scope scope,
 				    const char * const *attrs,
 				    const char *sort_attrib,
-				    const char *format, ...) PRINTF_ATTRIBUTE(8,9);
+				    const char *filter);
 
 WERROR drs_security_level_check(struct dcesrv_call_state *dce_call,
 				const char* call);
diff --git a/source4/rpc_server/drsuapi/drsutil.c b/source4/rpc_server/drsuapi/drsutil.c
index e1d6bedd99..c78ebdd5fe 100644
--- a/source4/rpc_server/drsuapi/drsutil.c
+++ b/source4/rpc_server/drsuapi/drsutil.c
@@ -50,12 +50,11 @@ int drsuapi_search_with_extended_dn(struct ldb_context *ldb,
 				    enum ldb_scope scope,
 				    const char * const *attrs,
 				    const char *sort_attrib,
-				    const char *format, ...)
+				    const char *filter)
 {
 	va_list ap;
 	int ret;
 	struct ldb_request *req;
-	char *filter;
 	TALLOC_CTX *tmp_ctx;
 	struct ldb_result *res;
 
@@ -66,10 +65,6 @@ int drsuapi_search_with_extended_dn(struct ldb_context *ldb,
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	va_start(ap, format);
-	filter = talloc_vasprintf(tmp_ctx, format, ap);
-	va_end(ap);
-
 	if (filter == NULL) {
 		talloc_free(tmp_ctx);
 		return LDB_ERR_OPERATIONS_ERROR;
diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c
index f38f95c044..75f5651791 100644
--- a/source4/rpc_server/drsuapi/getncchanges.c
+++ b/source4/rpc_server/drsuapi/getncchanges.c
@@ -306,7 +306,8 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_
 	DATA_BLOB session_key;
 	const char *attrs[] = { "*", "parentGUID", "distinguishedName", NULL };
 	WERROR werr;
-	
+	char* search_filter;
+
 	*r->out.level_out = 6;
 	/* TODO: linked attributes*/
 	r->out.ctr->ctr6.linked_attributes_count = 0;
@@ -355,12 +356,21 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_
 	}
 
 	/* Construct response. */
+	search_filter = talloc_asprintf(mem_ctx,
+					"(uSNChanged>=%llu)",
+					(unsigned long long)(r->in.req->req8.highwatermark.highest_usn+1));
+
+	if ((r->in.req->req8.replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY)
+	    == DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY) {
+		search_filter = talloc_asprintf(mem_ctx,
+						"(&%s(isCriticalSystemObject=true))",
+						search_filter);
+	}
 	ncRoot_dn = ldb_dn_new(mem_ctx, sam_ctx, ncRoot->dn);
 	ret = drsuapi_search_with_extended_dn(sam_ctx, mem_ctx, &site_res,
 					      ncRoot_dn, LDB_SCOPE_SUBTREE, attrs,
 					      "distinguishedName",
-					      "(uSNChanged>=%llu)", 
-					      (unsigned long long)(r->in.req->req8.highwatermark.highest_usn+1));
+					      search_filter);
 	if (ret != LDB_SUCCESS) {
 		return WERR_DS_DRA_INTERNAL_ERROR;
 	}