r4344: Unify memory handling in dcerpc_samr.c a bit
[samba.git] / source4 / rpc_server / samr / dcesrv_samr.c
index 60147a94fb2c8a479ecf2df1046a9342462f517e..2e71ad990da7543d8cb361dc80887b0341afee31 100644 (file)
 */
 
 #include "includes.h"
+#include "librpc/gen_ndr/ndr_samr.h"
+#include "rpc_server/dcerpc_server.h"
 #include "rpc_server/common/common.h"
 #include "rpc_server/samr/dcesrv_samr.h"
-
+#include "system/time.h"
+#include "lib/ldb/include/ldb.h"
 
 
 /*
-  destroy a general handle. This relies on the talloc destructor being set up correctly
+  destroy a general handle. 
 */
 static void samr_handle_destroy(struct dcesrv_connection *conn, struct dcesrv_handle *h)
 {
@@ -45,17 +48,17 @@ static NTSTATUS samr_Connect(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem
        struct samr_connect_state *c_state;
        struct dcesrv_handle *handle;
 
-       ZERO_STRUCTP(r->out.handle);
+       ZERO_STRUCTP(r->out.connect_handle);
 
-       c_state = talloc_p(NULL, struct samr_connect_state);
+       c_state = talloc_p(dce_call->conn, struct samr_connect_state);
        if (!c_state) {
                return NT_STATUS_NO_MEMORY;
        }
 
        /* make sure the sam database is accessible */
-       c_state->sam_ctx = samdb_connect(mem_ctx);
+       c_state->sam_ctx = samdb_connect(c_state);
        if (c_state->sam_ctx == NULL) {
-               talloc_destroy(c_state);
+               talloc_free(c_state);
                return NT_STATUS_INVALID_SYSTEM_SERVICE;
        }
 
@@ -69,7 +72,7 @@ static NTSTATUS samr_Connect(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem
        handle->destroy = samr_handle_destroy;
 
        c_state->access_mask = r->in.access_mask;
-       *r->out.handle = handle->wire_handle;
+       *r->out.connect_handle = handle->wire_handle;
 
        return NT_STATUS_OK;
 }
@@ -87,7 +90,7 @@ static NTSTATUS samr_Close(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_c
 
        DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);
 
-       /* this causes the callback samr_XXX_destroy() to be called by
+       /* this causes the parameters samr_XXX_destroy() to be called by
           the handle destroy code which destroys the state associated
           with the handle */
        dcesrv_handle_destroy(dce_call->conn, h);
@@ -115,13 +118,13 @@ static NTSTATUS samr_QuerySecurity(struct dcesrv_call_state *dce_call, TALLOC_CT
                                   struct samr_QuerySecurity *r)
 {
        struct dcesrv_handle *h;
-       struct samr_SdBuf *sd;
+       struct sec_desc_buf *sd;
 
        r->out.sdbuf = NULL;
 
        DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);
 
-       sd = talloc_p(mem_ctx, struct samr_SdBuf);
+       sd = talloc_p(mem_ctx, struct sec_desc_buf);
        if (sd == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -162,18 +165,18 @@ static NTSTATUS samr_LookupDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX
                
        r->out.sid = NULL;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_CONNECT);
+       DCESRV_PULL_HANDLE(h, r->in.connect_handle, SAMR_HANDLE_CONNECT);
 
        c_state = h->data;
 
-       if (r->in.domain->name == NULL) {
+       if (r->in.domain->string == NULL) {
                return NT_STATUS_INVALID_PARAMETER;
        }
 
        sidstr = samdb_search_string(c_state->sam_ctx,
                                     mem_ctx, NULL, "objectSid",
                                     "(&(name=%s)(objectclass=domain))",
-                                    r->in.domain->name);
+                                    r->in.domain->string);
        if (sidstr == NULL) {
                return NT_STATUS_NO_SUCH_DOMAIN;
        }
@@ -181,7 +184,7 @@ static NTSTATUS samr_LookupDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX
        sid = dom_sid_parse_talloc(mem_ctx, sidstr);
        if (sid == NULL) {
                DEBUG(0,("samdb: Invalid sid '%s' for domain %s\n",
-                        sidstr, r->in.domain->name));
+                        sidstr, r->in.domain->string));
                return NT_STATUS_INTERNAL_DB_CORRUPTION;
        }
 
@@ -209,7 +212,7 @@ static NTSTATUS samr_EnumDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX
        r->out.sam = NULL;
        r->out.num_entries = 0;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_CONNECT);
+       DCESRV_PULL_HANDLE(h, r->in.connect_handle, SAMR_HANDLE_CONNECT);
 
        c_state = h->data;
 
@@ -245,7 +248,7 @@ static NTSTATUS samr_EnumDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
        for (i=0;i<count-start_i;i++) {
                array->entries[i].idx = start_i + i;
-               array->entries[i].name.name = domains[start_i+i];
+               array->entries[i].name.string = domains[start_i+i];
        }
 
        r->out.sam = array;
@@ -256,18 +259,6 @@ static NTSTATUS samr_EnumDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX
 }
 
 
-/*
-  close an open domain context
-*/
-static int samr_Domain_destructor(void *ptr)
-{
-       struct samr_domain_state *d_state = ptr;
-       /* we need to explicitly free the connect state to lower the
-          reference count */
-       talloc_free(d_state->connect_state);
-       return 0;
-}
-
 /* 
   samr_OpenDomain 
 */
@@ -284,7 +275,7 @@ static NTSTATUS samr_OpenDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *
 
        ZERO_STRUCTP(r->out.domain_handle);
 
-       DCESRV_PULL_HANDLE(h_conn, r->in.handle, SAMR_HANDLE_CONNECT);
+       DCESRV_PULL_HANDLE(h_conn, r->in.connect_handle, SAMR_HANDLE_CONNECT);
 
        c_state = h_conn->data;
 
@@ -315,7 +306,7 @@ static NTSTATUS samr_OpenDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *
                return NT_STATUS_NO_MEMORY;
        }
 
-       d_state->connect_state = c_state;
+       d_state->connect_state = talloc_reference(d_state, c_state);
        d_state->sam_ctx = c_state->sam_ctx;
        d_state->domain_sid = talloc_strdup(d_state, sidstr);
        d_state->domain_name = talloc_strdup(d_state, domain_name);
@@ -331,9 +322,7 @@ static NTSTATUS samr_OpenDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *
                talloc_free(d_state);
                return NT_STATUS_NO_MEMORY;
        }
-       talloc_set_destructor(d_state, samr_Domain_destructor);
-       talloc_increase_ref_count(c_state);
-
+       
        h_domain->data = d_state;
        h_domain->destroy = samr_handle_destroy;
        *r->out.domain_handle = h_domain->wire_handle;
@@ -360,10 +349,10 @@ static NTSTATUS samr_info_DomInfo2(struct samr_domain_state *state, TALLOC_CTX *
        /* where is this supposed to come from? is it settable? */
        info->force_logoff_time = 0x8000000000000000LL;
 
-       info->comment.name = samdb_result_string(res[0], "comment", NULL);
-       info->domain.name  = samdb_result_string(res[0], "name", NULL);
+       info->comment.string = samdb_result_string(res[0], "comment", NULL);
+       info->domain.string  = samdb_result_string(res[0], "name", NULL);
 
-       info->primary.name = lp_netbios_name();
+       info->primary.string = lp_netbios_name();
        info->sequence_num = 0;
        info->role = ROLE_DOMAIN_PDC;
        info->num_users = samdb_search_count(state->sam_ctx, mem_ctx, NULL, "(objectClass=user)");
@@ -388,7 +377,7 @@ static NTSTATUS samr_QueryDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_
 
        r->out.info = NULL;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_DOMAIN);
+       DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
 
        d_state = h->data;
 
@@ -417,18 +406,6 @@ static NTSTATUS samr_SetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CT
        DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 }
 
-/*
-  close an open domain context
-*/
-static int samr_Account_destructor(void *ptr)
-{
-       struct samr_account_state *a_state = ptr;
-       /* we need to explicitly free the domain state to lower the
-          reference count */
-       talloc_free(a_state->domain_state);
-       return 0;
-}
-
 /* 
   samr_CreateDomainGroup 
 */
@@ -441,7 +418,8 @@ static NTSTATUS samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLO
        const char *name;
        struct ldb_message msg;
        uint32_t rid;
-       const char *groupname, *sidstr;
+       const char *groupname, *sidstr, *guidstr;
+       struct GUID guid;
        time_t now = time(NULL);
        struct dcesrv_handle *g_handle;
        int ret;
@@ -450,11 +428,11 @@ static NTSTATUS samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLO
        ZERO_STRUCTP(r->out.group_handle);
        *r->out.rid = 0;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_DOMAIN);
+       DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
 
        d_state = h->data;
 
-       groupname = r->in.name->name;
+       groupname = r->in.name->string;
 
        if (groupname == NULL) {
                return NT_STATUS_INVALID_PARAMETER;
@@ -492,26 +470,27 @@ static NTSTATUS samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLO
                return NT_STATUS_NO_MEMORY;
        }
 
+       /* a new GUID */
+       guid = GUID_random();
+       guidstr = GUID_string(mem_ctx, &guid);
+       if (!guidstr) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
        /* add core elements to the ldb_message for the user */
        msg.dn = talloc_asprintf(mem_ctx, "CN=%s,CN=Users,%s", groupname,
                                 d_state->domain_dn);
        if (!msg.dn) {
                return NT_STATUS_NO_MEMORY;
        }
-       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg,
-                            "name", groupname);
-       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg,
-                            "cn", groupname);
-       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg,
-                            "sAMAccountName", groupname);
-       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg,
-                            "objectClass", "group");
-       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg,
-                            "objectSid", sidstr);
-       samdb_msg_set_ldaptime(d_state->sam_ctx, mem_ctx, &msg,
-                              "whenCreated", now);
-       samdb_msg_set_ldaptime(d_state->sam_ctx, mem_ctx, &msg,
-                              "whenChanged", now);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "name", groupname);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "cn", groupname);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "sAMAccountName", groupname);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "objectClass", "group");
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "objectSid", sidstr);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "objectGUID", guidstr);
+       samdb_msg_set_ldaptime(d_state->sam_ctx, mem_ctx, &msg, "whenCreated", now);
+       samdb_msg_set_ldaptime(d_state->sam_ctx, mem_ctx, &msg, "whenChanged", now);
                             
        /* create the group */
        ret = samdb_add(d_state->sam_ctx, mem_ctx, &msg);
@@ -526,11 +505,11 @@ static NTSTATUS samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLO
        }
        a_state->sam_ctx = d_state->sam_ctx;
        a_state->access_mask = r->in.access_mask;
-       a_state->domain_state = d_state;
-       a_state->account_dn = talloc_steal(d_state, msg.dn);
-       a_state->account_sid = talloc_strdup(d_state, sidstr);
-       a_state->account_name = talloc_strdup(d_state, groupname);
-       if (!a_state->account_name || !a_state->account_sid) {
+       a_state->domain_state = talloc_reference(a_state, d_state);
+       a_state->account_dn = talloc_steal(a_state, msg.dn);
+       a_state->account_sid = talloc_steal(a_state, sidstr);
+       a_state->account_name = talloc_strdup(a_state, groupname);
+       if (!a_state->account_name) {
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -543,10 +522,6 @@ static NTSTATUS samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLO
        g_handle->data = a_state;
        g_handle->destroy = samr_handle_destroy;
 
-       /* the domain state is in use one more time */
-       talloc_increase_ref_count(d_state);
-       talloc_set_destructor(a_state, samr_Account_destructor);
-
        *r->out.group_handle = g_handle->wire_handle;
        *r->out.rid = rid;      
 
@@ -578,22 +553,23 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
        const char *name;
        struct ldb_message msg;
        uint32_t rid;
-       const char *account_name, *sidstr;
+       const char *account_name, *sidstr, *guidstr;
+       struct GUID guid;
        time_t now = time(NULL);
        struct dcesrv_handle *u_handle;
        int ret;
        NTSTATUS status;
        const char *container, *additional_class=NULL;
 
-       ZERO_STRUCTP(r->out.acct_handle);
+       ZERO_STRUCTP(r->out.user_handle);
        *r->out.access_granted = 0;
        *r->out.rid = 0;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_DOMAIN);
+       DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
 
        d_state = h->data;
 
-       account_name = r->in.account_name->name;
+       account_name = r->in.account_name->string;
 
        if (account_name == NULL) {
                return NT_STATUS_INVALID_PARAMETER;
@@ -642,7 +618,7 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
                }
 
-               container = "DomainControllers";
+               container = "Domain Controllers";
                additional_class = "computer";
 
        } else if (r->in.acct_flags == ACB_DOMTRUST) {
@@ -654,7 +630,7 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
                }
 
-               container = "ForeignDomains";  /* FIXME: Is this correct?*/
+               container = "Users";
                additional_class = "computer";
 
        } else {
@@ -674,6 +650,13 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
                return NT_STATUS_NO_MEMORY;
        }
 
+       /* a new GUID */
+       guid = GUID_random();
+       guidstr = GUID_string(mem_ctx, &guid);
+       if (!guidstr) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
        /* add core elements to the ldb_message for the user */
        msg.dn = talloc_asprintf(mem_ctx, "CN=%s,CN=%s,%s", account_name, container, d_state->domain_dn);
        if (!msg.dn) {
@@ -687,6 +670,7 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
                samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "objectClass", additional_class);
        }
        samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "objectSid", sidstr);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "objectGUID", guidstr);
        samdb_msg_set_ldaptime(d_state->sam_ctx, mem_ctx, &msg, "whenCreated", now);
        samdb_msg_set_ldaptime(d_state->sam_ctx, mem_ctx, &msg, "whenChanged", now);
 
@@ -703,11 +687,11 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
        }
        a_state->sam_ctx = d_state->sam_ctx;
        a_state->access_mask = r->in.access_mask;
-       a_state->domain_state = d_state;
-       a_state->account_dn = talloc_steal(d_state, msg.dn);
-       a_state->account_sid = talloc_strdup(d_state, sidstr);
-       a_state->account_name = talloc_strdup(d_state, account_name);
-       if (!a_state->account_name || !a_state->account_sid) {
+       a_state->domain_state = talloc_reference(a_state, d_state);
+       a_state->account_dn = talloc_steal(a_state, msg.dn);
+       a_state->account_sid = talloc_steal(a_state, sidstr);
+       a_state->account_name = talloc_strdup(a_state, account_name);
+       if (!a_state->account_name) {
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -721,10 +705,9 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
        u_handle->destroy = samr_handle_destroy;
 
        /* the domain state is in use one more time */
-       talloc_increase_ref_count(d_state);
-       talloc_set_destructor(a_state, samr_Account_destructor);
+       
 
-       *r->out.acct_handle = u_handle->wire_handle;
+       *r->out.user_handle = u_handle->wire_handle;
        *r->out.access_granted = 0xf07ff; /* TODO: fix access mask calculations */
        *r->out.rid = rid;      
 
@@ -743,11 +726,11 @@ static NTSTATUS samr_CreateUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *
 
 
        /* a simple wrapper around samr_CreateUser2 works nicely */
-       r2.in.handle = r->in.handle;
+       r2.in.domain_handle = r->in.domain_handle;
        r2.in.account_name = r->in.account_name;
        r2.in.acct_flags = ACB_NORMAL;
        r2.in.access_mask = r->in.access_mask;
-       r2.out.acct_handle = r->out.acct_handle;
+       r2.out.user_handle = r->out.user_handle;
        r2.out.access_granted = &access_granted;
        r2.out.rid = r->out.rid;
 
@@ -779,7 +762,7 @@ static NTSTATUS samr_EnumDomainUsers(struct dcesrv_call_state *dce_call, TALLOC_
        r->out.sam = NULL;
        r->out.num_entries = 0;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_DOMAIN);
+       DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
 
        d_state = h->data;
        
@@ -801,7 +784,7 @@ static NTSTATUS samr_EnumDomainUsers(struct dcesrv_call_state *dce_call, TALLOC_
        }
        for (i=0;i<count;i++) {
                entries[i].idx = samdb_result_rid_from_sid(mem_ctx, res[i], "objectSid", 0);
-               entries[i].name.name = samdb_result_string(res[i], "sAMAccountName", "");
+               entries[i].name.string = samdb_result_string(res[i], "sAMAccountName", "");
        }
 
        /* sort the results by rid */
@@ -846,7 +829,122 @@ static NTSTATUS samr_EnumDomainUsers(struct dcesrv_call_state *dce_call, TALLOC_
 static NTSTATUS samr_CreateDomAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
                       struct samr_CreateDomAlias *r)
 {
-       DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+       struct samr_domain_state *d_state;
+       struct samr_account_state *a_state;
+       struct dcesrv_handle *h;
+       const char *aliasname, *name, *sidstr, *guidstr;
+       struct GUID guid;
+       time_t now = time(NULL);
+       struct ldb_message msg;
+       uint32_t rid;
+       struct dcesrv_handle *a_handle;
+       int ret;
+       NTSTATUS status;
+
+       ZERO_STRUCTP(r->out.alias_handle);
+       *r->out.rid = 0;
+
+       DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
+
+       d_state = h->data;
+
+       aliasname = r->in.aliasname->string;
+
+       if (aliasname == NULL) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       /* Check if alias already exists */
+       name = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL,
+                                  "sAMAccountName",
+                                  "(&(sAMAccountName=%s)(objectclass=group))",
+                                  aliasname);
+
+       if (name != NULL) {
+               return NT_STATUS_ALIAS_EXISTS;
+       }
+
+       ZERO_STRUCT(msg);
+
+       /* pull in all the template attributes */
+       ret = samdb_copy_template(d_state->sam_ctx, mem_ctx, &msg, 
+                                 "(&(name=TemplateAlias)"
+                                 "(objectclass=aliasTemplate))");
+       if (ret != 0) {
+               DEBUG(0,("Failed to load TemplateAlias from samdb\n"));
+               return NT_STATUS_INTERNAL_DB_CORRUPTION;
+       }
+
+       /* allocate a rid */
+       status = samdb_allocate_next_id(d_state->sam_ctx, mem_ctx, 
+                                       d_state->domain_dn, "nextRid", &rid);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
+       /* and the group SID */
+       sidstr = talloc_asprintf(mem_ctx, "%s-%u", d_state->domain_sid, rid);
+       if (!sidstr) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       /* a new GUID */
+       guid = GUID_random();
+       guidstr = GUID_string(mem_ctx, &guid);
+       if (!guidstr) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       /* add core elements to the ldb_message for the user */
+       msg.dn = talloc_asprintf(mem_ctx, "CN=%s,CN=Users,%s", aliasname,
+                                d_state->domain_dn);
+       if (!msg.dn) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "name", aliasname);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "cn", aliasname);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "sAMAccountName", aliasname);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "objectClass", "group");
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "objectSid", sidstr);
+       samdb_msg_add_string(d_state->sam_ctx, mem_ctx, &msg, "objectGUID", guidstr);
+       samdb_msg_set_ldaptime(d_state->sam_ctx, mem_ctx, &msg, "whenCreated", now);
+       samdb_msg_set_ldaptime(d_state->sam_ctx, mem_ctx, &msg, "whenChanged", now);
+
+       /* create the alias */
+       ret = samdb_add(d_state->sam_ctx, mem_ctx, &msg);
+       if (ret != 0) {
+               DEBUG(0,("Failed to create alias record %s\n", msg.dn));
+               return NT_STATUS_INTERNAL_DB_CORRUPTION;
+       }
+
+       a_state = talloc_p(d_state, struct samr_account_state);
+       if (!a_state) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       a_state->sam_ctx = d_state->sam_ctx;
+       a_state->access_mask = r->in.access_mask;
+       a_state->domain_state = talloc_reference(a_state, d_state);
+       a_state->account_dn = talloc_steal(a_state, msg.dn);
+       a_state->account_sid = talloc_steal(a_state, sidstr);
+       a_state->account_name = talloc_strdup(a_state, aliasname);
+       if (!a_state->account_name) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       /* create the policy handle */
+       a_handle = dcesrv_handle_new(dce_call->conn, SAMR_HANDLE_ALIAS);
+       if (a_handle == NULL)
+               return NT_STATUS_NO_MEMORY;
+
+       a_handle->data = a_state;
+       a_handle->destroy = samr_handle_destroy;
+
+       *r->out.alias_handle = a_handle->wire_handle;
+       *r->out.rid = rid;
+
+       return NT_STATUS_OK;
 }
 
 
@@ -886,7 +984,7 @@ static NTSTATUS samr_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX
        ZERO_STRUCT(r->out.rids);
        ZERO_STRUCT(r->out.types);
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_DOMAIN);
+       DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
 
        d_state = h->data;
 
@@ -912,7 +1010,7 @@ static NTSTATUS samr_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX
                r->out.types.ids[i] = SID_NAME_UNKNOWN;
 
                count = samdb_search(d_state->sam_ctx, mem_ctx, d_state->domain_dn, &res, attrs, 
-                                    "sAMAccountName=%s", r->in.names[i].name);
+                                    "sAMAccountName=%s", r->in.names[i].string);
                if (count != 1) {
                        status = STATUS_SOME_UNMAPPED;
                        continue;
@@ -977,9 +1075,9 @@ static NTSTATUS samr_OpenGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *m
        const char * const attrs[2] = { "sAMAccountName", NULL };
        int ret;
 
-       ZERO_STRUCTP(r->out.acct_handle);
+       ZERO_STRUCTP(r->out.group_handle);
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_DOMAIN);
+       DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
 
        d_state = h->data;
 
@@ -1014,11 +1112,11 @@ static NTSTATUS samr_OpenGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *m
        }
        a_state->sam_ctx = d_state->sam_ctx;
        a_state->access_mask = r->in.access_mask;
-       a_state->domain_state = d_state;
+       a_state->domain_state = talloc_reference(a_state, d_state);
        a_state->account_dn = talloc_steal(a_state, msgs[0]->dn);
-       a_state->account_sid = talloc_strdup(a_state, sidstr);
+       a_state->account_sid = talloc_steal(a_state, sidstr);
        a_state->account_name = talloc_strdup(a_state, groupname);
-       if (!a_state->account_name || !a_state->account_sid) {
+       if (!a_state->account_name) {
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -1031,11 +1129,7 @@ static NTSTATUS samr_OpenGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *m
        g_handle->data = a_state;
        g_handle->destroy = samr_handle_destroy;
 
-       /* the domain state is in use one more time */
-       talloc_increase_ref_count(d_state);
-       talloc_set_destructor(a_state, samr_Account_destructor);
-
-       *r->out.acct_handle = g_handle->wire_handle;
+       *r->out.group_handle = g_handle->wire_handle;
 
        return NT_STATUS_OK;
 }
@@ -1084,7 +1178,7 @@ static NTSTATUS samr_OpenGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *m
 } while (0)
 
 #define SET_LHOURS(msg, field, attr) do { \
-       if (samdb_msg_add_logon_hours(a_state->sam_ctx, mem_ctx, msg, attr, r->in.info->field) != 0) { \
+       if (samdb_msg_add_logon_hours(a_state->sam_ctx, mem_ctx, msg, attr, &r->in.info->field) != 0) { \
                return NT_STATUS_NO_MEMORY; \
        } \
 } while (0)
@@ -1104,7 +1198,7 @@ static NTSTATUS samr_QueryGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_C
 
        r->out.info = NULL;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_GROUP);
+       DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
 
        a_state = h->data;
 
@@ -1126,19 +1220,19 @@ static NTSTATUS samr_QueryGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_C
        /* Fill in the level */
        switch (r->in.level) {
        case GroupInfoAll:
-               QUERY_STRING(msg, all.name.name,        "sAMAccountName");
-               r->out.info->all.unknown = 7; /* Do like w2k3 */
+               QUERY_STRING(msg, all.name.string,        "sAMAccountName");
+               r->out.info->all.attributes = 7; /* Do like w2k3 */
                QUERY_UINT  (msg, all.num_members,      "numMembers")
-               QUERY_STRING(msg, all.description.name, "description");
+               QUERY_STRING(msg, all.description.string, "description");
                break;
        case GroupInfoName:
-               QUERY_STRING(msg, name.name,            "sAMAccountName");
+               QUERY_STRING(msg, name.string,            "sAMAccountName");
                break;
        case GroupInfoX:
                r->out.info->unknown.unknown = 7;
                break;
        case GroupInfoDescription:
-               QUERY_STRING(msg, description.name, "description");
+               QUERY_STRING(msg, description.string, "description");
                break;
        default:
                r->out.info = NULL;
@@ -1160,7 +1254,7 @@ static NTSTATUS samr_SetGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX
        struct ldb_message mod, *msg = &mod;
        int ret;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_GROUP);
+       DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
 
        a_state = h->data;
 
@@ -1172,12 +1266,12 @@ static NTSTATUS samr_SetGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
        switch (r->in.level) {
        case GroupInfoDescription:
-               SET_STRING(msg, description.name,         "description");
+               SET_STRING(msg, description.string,         "description");
                break;
        case GroupInfoName:
                /* On W2k3 this does not change the name, it changes the
                 * sAMAccountName attribute */
-               SET_STRING(msg, name.name,                "sAMAccountName");
+               SET_STRING(msg, name.string,                "sAMAccountName");
                break;
        case GroupInfoX:
                /* This does not do anything obviously visible in W2k3 LDAP */
@@ -1217,9 +1311,9 @@ static NTSTATUS samr_DeleteDomainGroup(struct dcesrv_call_state *dce_call, TALLO
        struct samr_account_state *a_state;
        int ret;
 
-        *r->out.handle = *r->in.handle;
+        *r->out.group_handle = *r->in.group_handle;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_GROUP);
+       DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
 
        a_state = h->data;
 
@@ -1228,7 +1322,7 @@ static NTSTATUS samr_DeleteDomainGroup(struct dcesrv_call_state *dce_call, TALLO
                return NT_STATUS_UNSUCCESSFUL;
        }
 
-       ZERO_STRUCTP(r->out.handle);
+       ZERO_STRUCTP(r->out.group_handle);
 
        return NT_STATUS_OK;
 }
@@ -1349,9 +1443,9 @@ static NTSTATUS samr_OpenUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *me
        const char * const attrs[2] = { "sAMAccountName", NULL };
        int ret;
 
-       ZERO_STRUCTP(r->out.acct_handle);
+       ZERO_STRUCTP(r->out.user_handle);
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_DOMAIN);
+       DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
 
        d_state = h->data;
 
@@ -1386,11 +1480,11 @@ static NTSTATUS samr_OpenUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *me
        }
        a_state->sam_ctx = d_state->sam_ctx;
        a_state->access_mask = r->in.access_mask;
-       a_state->domain_state = d_state;
-       a_state->account_dn = talloc_steal(d_state, msgs[0]->dn);
-       a_state->account_sid = talloc_strdup(d_state, sidstr);
-       a_state->account_name = talloc_strdup(d_state, account_name);
-       if (!a_state->account_name || !a_state->account_sid) {
+       a_state->domain_state = talloc_reference(a_state, d_state);
+       a_state->account_dn = talloc_steal(a_state, msgs[0]->dn);
+       a_state->account_sid = talloc_steal(a_state, sidstr);
+       a_state->account_name = talloc_strdup(a_state, account_name);
+       if (!a_state->account_name) {
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -1403,11 +1497,7 @@ static NTSTATUS samr_OpenUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *me
        u_handle->data = a_state;
        u_handle->destroy = samr_handle_destroy;
 
-       /* the domain state is in use one more time */
-       talloc_increase_ref_count(d_state);
-       talloc_set_destructor(a_state, samr_Account_destructor);
-
-       *r->out.acct_handle = u_handle->wire_handle;
+       *r->out.user_handle = u_handle->wire_handle;
 
        return NT_STATUS_OK;
 
@@ -1424,9 +1514,9 @@ static NTSTATUS samr_DeleteUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *
        struct samr_account_state *a_state;
        int ret;
 
-       *r->out.handle = *r->in.handle;
+       *r->out.user_handle = *r->in.user_handle;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_USER);
+       DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
 
        a_state = h->data;
 
@@ -1435,7 +1525,7 @@ static NTSTATUS samr_DeleteUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *
                return NT_STATUS_UNSUCCESSFUL;
        }
 
-       ZERO_STRUCTP(r->out.handle);
+       ZERO_STRUCTP(r->out.user_handle);
 
        return NT_STATUS_OK;
 }
@@ -1454,7 +1544,7 @@ static NTSTATUS samr_QueryUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CT
 
        r->out.info = NULL;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_USER);
+       DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
 
        a_state = h->data;
 
@@ -1476,140 +1566,140 @@ static NTSTATUS samr_QueryUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CT
        /* fill in the reply */
        switch (r->in.level) {
        case 1:
-               QUERY_STRING(msg, info1.account_name.name,"sAMAccountName");
-               QUERY_STRING(msg, info1.full_name.name,   "displayName");
-               QUERY_UINT  (msg, info1.primary_gid,      "primaryGroupID");
-               QUERY_STRING(msg, info1.description.name, "description");
-               QUERY_STRING(msg, info1.comment.name,     "comment");
+               QUERY_STRING(msg, info1.account_name.string,   "sAMAccountName");
+               QUERY_STRING(msg, info1.full_name.string,      "displayName");
+               QUERY_UINT  (msg, info1.primary_gid,           "primaryGroupID");
+               QUERY_STRING(msg, info1.description.string,    "description");
+               QUERY_STRING(msg, info1.comment.string,        "comment");
                break;
 
        case 2:
-               QUERY_STRING(msg, info2.comment.name,     "comment");
-               QUERY_UINT  (msg, info2.country_code,     "countryCode");
-               QUERY_UINT  (msg, info2.code_page,        "codePage");
+               QUERY_STRING(msg, info2.comment.string,        "comment");
+               QUERY_UINT  (msg, info2.country_code,          "countryCode");
+               QUERY_UINT  (msg, info2.code_page,             "codePage");
                break;
 
        case 3:
-               QUERY_STRING(msg, info3.account_name.name,   "sAMAccountName");
-               QUERY_STRING(msg, info3.full_name.name,      "displayName");
-               QUERY_RID   (msg, info3.rid,                 "objectSid");
-               QUERY_UINT  (msg, info3.primary_gid,         "primaryGroupID");
-               QUERY_STRING(msg, info3.home_directory.name, "homeDirectory");
-               QUERY_STRING(msg, info3.home_drive.name,     "homeDrive");
-               QUERY_STRING(msg, info3.logon_script.name,   "scriptPath");
-               QUERY_STRING(msg, info3.profile_path.name,   "profilePath");
-               QUERY_STRING(msg, info3.workstations.name,   "userWorkstations");
-               QUERY_NTTIME(msg, info3.last_logon,          "lastLogon");
-               QUERY_NTTIME(msg, info3.last_logoff,         "lastLogoff");
-               QUERY_NTTIME(msg, info3.last_password_change,"pwdLastSet");
-               QUERY_APASSC(msg, info3.allow_password_change,"pwdLastSet");
-               QUERY_FPASSC(msg, info3.force_password_change,"pwdLastSet");
-               QUERY_LHOURS(msg, info3.logon_hours,         "logonHours");
-               QUERY_UINT  (msg, info3.bad_password_count,  "badPwdCount");
-               QUERY_UINT  (msg, info3.num_logons,          "logonCount");
-               QUERY_AFLAGS(msg, info3.acct_flags,          "userAccountControl");
+               QUERY_STRING(msg, info3.account_name.string,   "sAMAccountName");
+               QUERY_STRING(msg, info3.full_name.string,      "displayName");
+               QUERY_RID   (msg, info3.rid,                   "objectSid");
+               QUERY_UINT  (msg, info3.primary_gid,           "primaryGroupID");
+               QUERY_STRING(msg, info3.home_directory.string, "homeDirectory");
+               QUERY_STRING(msg, info3.home_drive.string,     "homeDrive");
+               QUERY_STRING(msg, info3.logon_script.string,   "scriptPath");
+               QUERY_STRING(msg, info3.profile_path.string,   "profilePath");
+               QUERY_STRING(msg, info3.workstations.string,   "userWorkstations");
+               QUERY_NTTIME(msg, info3.last_logon,            "lastLogon");
+               QUERY_NTTIME(msg, info3.last_logoff,           "lastLogoff");
+               QUERY_NTTIME(msg, info3.last_password_change,  "pwdLastSet");
+               QUERY_APASSC(msg, info3.allow_password_change, "pwdLastSet");
+               QUERY_FPASSC(msg, info3.force_password_change, "pwdLastSet");
+               QUERY_LHOURS(msg, info3.logon_hours,           "logonHours");
+               QUERY_UINT  (msg, info3.bad_password_count,    "badPwdCount");
+               QUERY_UINT  (msg, info3.logon_count,           "logonCount");
+               QUERY_AFLAGS(msg, info3.acct_flags,            "userAccountControl");
                break;
 
        case 4:
-               QUERY_LHOURS(msg, info4.logon_hours,         "logonHours");
+               QUERY_LHOURS(msg, info4.logon_hours,           "logonHours");
                break;
 
        case 5:
-               QUERY_STRING(msg, info5.account_name.name,   "sAMAccountName");
-               QUERY_STRING(msg, info5.full_name.name,      "displayName");
-               QUERY_RID   (msg, info5.rid,                 "objectSid");
-               QUERY_UINT  (msg, info5.primary_gid,         "primaryGroupID");
-               QUERY_STRING(msg, info5.home_directory.name, "homeDirectory");
-               QUERY_STRING(msg, info5.home_drive.name,     "homeDrive");
-               QUERY_STRING(msg, info5.logon_script.name,   "scriptPath");
-               QUERY_STRING(msg, info5.profile_path.name,   "profilePath");
-               QUERY_STRING(msg, info5.description.name,    "description");
-               QUERY_STRING(msg, info5.workstations.name,   "userWorkstations");
-               QUERY_NTTIME(msg, info5.last_logon,          "lastLogon");
-               QUERY_NTTIME(msg, info5.last_logoff,         "lastLogoff");
-               QUERY_LHOURS(msg, info5.logon_hours,         "logonHours");
-               QUERY_UINT  (msg, info5.bad_password_count,  "badPwdCount");
-               QUERY_UINT  (msg, info5.num_logons,          "logonCount");
-               QUERY_NTTIME(msg, info5.last_password_change,"pwdLastSet");
-               QUERY_NTTIME(msg, info5.acct_expiry,         "accountExpires");
-               QUERY_AFLAGS(msg, info5.acct_flags,          "userAccountControl");
+               QUERY_STRING(msg, info5.account_name.string,   "sAMAccountName");
+               QUERY_STRING(msg, info5.full_name.string,      "displayName");
+               QUERY_RID   (msg, info5.rid,                   "objectSid");
+               QUERY_UINT  (msg, info5.primary_gid,           "primaryGroupID");
+               QUERY_STRING(msg, info5.home_directory.string, "homeDirectory");
+               QUERY_STRING(msg, info5.home_drive.string,     "homeDrive");
+               QUERY_STRING(msg, info5.logon_script.string,   "scriptPath");
+               QUERY_STRING(msg, info5.profile_path.string,   "profilePath");
+               QUERY_STRING(msg, info5.description.string,    "description");
+               QUERY_STRING(msg, info5.workstations.string,   "userWorkstations");
+               QUERY_NTTIME(msg, info5.last_logon,            "lastLogon");
+               QUERY_NTTIME(msg, info5.last_logoff,           "lastLogoff");
+               QUERY_LHOURS(msg, info5.logon_hours,           "logonHours");
+               QUERY_UINT  (msg, info5.bad_password_count,    "badPwdCount");
+               QUERY_UINT  (msg, info5.logon_count,           "logonCount");
+               QUERY_NTTIME(msg, info5.last_password_change,  "pwdLastSet");
+               QUERY_NTTIME(msg, info5.acct_expiry,           "accountExpires");
+               QUERY_AFLAGS(msg, info5.acct_flags,            "userAccountControl");
                break;
 
        case 6:
-               QUERY_STRING(msg, info6.account_name.name,   "sAMAccountName");
-               QUERY_STRING(msg, info6.full_name.name,      "displayName");
+               QUERY_STRING(msg, info6.account_name.string,   "sAMAccountName");
+               QUERY_STRING(msg, info6.full_name.string,      "displayName");
                break;
 
        case 7:
-               QUERY_STRING(msg, info7.account_name.name,   "sAMAccountName");
+               QUERY_STRING(msg, info7.account_name.string,   "sAMAccountName");
                break;
 
        case 8:
-               QUERY_STRING(msg, info8.full_name.name,      "displayName");
+               QUERY_STRING(msg, info8.full_name.string,      "displayName");
                break;
 
        case 9:
-               QUERY_UINT  (msg, info9.primary_gid,         "primaryGroupID");
+               QUERY_UINT  (msg, info9.primary_gid,           "primaryGroupID");
                break;
 
        case 10:
-               QUERY_STRING(msg, info10.home_directory.name, "homeDirectory");
-               QUERY_STRING(msg, info10.home_drive.name,     "homeDrive");
+               QUERY_STRING(msg, info10.home_directory.string,"homeDirectory");
+               QUERY_STRING(msg, info10.home_drive.string,    "homeDrive");
                break;
 
        case 11:
-               QUERY_STRING(msg, info11.logon_script.name,   "scriptPath");
+               QUERY_STRING(msg, info11.logon_script.string,  "scriptPath");
                break;
 
        case 12:
-               QUERY_STRING(msg, info12.profile_path.name,   "profilePath");
+               QUERY_STRING(msg, info12.profile_path.string,  "profilePath");
                break;
 
        case 13:
-               QUERY_STRING(msg, info13.description.name,    "description");
+               QUERY_STRING(msg, info13.description.string,   "description");
                break;
 
        case 14:
-               QUERY_STRING(msg, info14.workstations.name,   "userWorkstations");
+               QUERY_STRING(msg, info14.workstations.string,  "userWorkstations");
                break;
 
        case 16:
-               QUERY_AFLAGS(msg, info16.acct_flags,          "userAccountControl");
+               QUERY_AFLAGS(msg, info16.acct_flags,           "userAccountControl");
                break;
 
        case 17:
-               QUERY_NTTIME(msg, info17.acct_expiry,         "accountExpires");
+               QUERY_NTTIME(msg, info17.acct_expiry,          "accountExpires");
 
        case 20:
-               QUERY_STRING(msg, info20.callback.name,       "userParameters");
+               QUERY_STRING(msg, info20.parameters.string,    "userParameters");
                break;
 
        case 21:
-               QUERY_NTTIME(msg, info21.last_logon,          "lastLogon");
-               QUERY_NTTIME(msg, info21.last_logoff,         "lastLogoff");
-               QUERY_NTTIME(msg, info21.last_password_change,     "pwdLastSet");
-               QUERY_NTTIME(msg, info21.acct_expiry,         "accountExpires");
+               QUERY_NTTIME(msg, info21.last_logon,           "lastLogon");
+               QUERY_NTTIME(msg, info21.last_logoff,          "lastLogoff");
+               QUERY_NTTIME(msg, info21.last_password_change, "pwdLastSet");
+               QUERY_NTTIME(msg, info21.acct_expiry,          "accountExpires");
                QUERY_APASSC(msg, info21.allow_password_change,"pwdLastSet");
                QUERY_FPASSC(msg, info21.force_password_change,"pwdLastSet");
-               QUERY_STRING(msg, info21.account_name.name,   "sAMAccountName");
-               QUERY_STRING(msg, info21.full_name.name,      "displayName");
-               QUERY_STRING(msg, info21.home_directory.name, "homeDirectory");
-               QUERY_STRING(msg, info21.home_drive.name,     "homeDrive");
-               QUERY_STRING(msg, info21.logon_script.name,   "scriptPath");
-               QUERY_STRING(msg, info21.profile_path.name,   "profilePath");
-               QUERY_STRING(msg, info21.description.name,    "description");
-               QUERY_STRING(msg, info21.workstations.name,   "userWorkstations");
-               QUERY_STRING(msg, info21.comment.name,        "comment");
-               QUERY_STRING(msg, info21.callback.name,       "userParameters");
-               QUERY_RID   (msg, info21.rid,                 "objectSid");
-               QUERY_UINT  (msg, info21.primary_gid,         "primaryGroupID");
-               QUERY_AFLAGS(msg, info21.acct_flags,          "userAccountControl");
+               QUERY_STRING(msg, info21.account_name.string,  "sAMAccountName");
+               QUERY_STRING(msg, info21.full_name.string,     "displayName");
+               QUERY_STRING(msg, info21.home_directory.string,"homeDirectory");
+               QUERY_STRING(msg, info21.home_drive.string,    "homeDrive");
+               QUERY_STRING(msg, info21.logon_script.string,  "scriptPath");
+               QUERY_STRING(msg, info21.profile_path.string,  "profilePath");
+               QUERY_STRING(msg, info21.description.string,   "description");
+               QUERY_STRING(msg, info21.workstations.string,  "userWorkstations");
+               QUERY_STRING(msg, info21.comment.string,       "comment");
+               QUERY_STRING(msg, info21.parameters.string,    "userParameters");
+               QUERY_RID   (msg, info21.rid,                  "objectSid");
+               QUERY_UINT  (msg, info21.primary_gid,          "primaryGroupID");
+               QUERY_AFLAGS(msg, info21.acct_flags,           "userAccountControl");
                r->out.info->info21.fields_present = 0x00FFFFFF;
-               QUERY_LHOURS(msg, info21.logon_hours,         "logonHours");
-               QUERY_UINT  (msg, info21.bad_password_count,  "badPwdCount");
-               QUERY_UINT  (msg, info21.num_logons,          "logonCount");
-               QUERY_UINT  (msg, info21.country_code,        "countryCode");
-               QUERY_UINT  (msg, info21.code_page,           "codePage");
+               QUERY_LHOURS(msg, info21.logon_hours,          "logonHours");
+               QUERY_UINT  (msg, info21.bad_password_count,   "badPwdCount");
+               QUERY_UINT  (msg, info21.logon_count,          "logonCount");
+               QUERY_UINT  (msg, info21.country_code,         "countryCode");
+               QUERY_UINT  (msg, info21.code_page,            "codePage");
                break;
                
 
@@ -1634,7 +1724,7 @@ static NTSTATUS samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX
        int ret;
        NTSTATUS status = NT_STATUS_OK;
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_USER);
+       DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
 
        a_state = h->data;
 
@@ -1646,103 +1736,110 @@ static NTSTATUS samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
        switch (r->in.level) {
        case 2:
-               SET_STRING(msg, info2.comment.name,         "comment");
-               SET_UINT  (msg, info2.country_code,         "countryCode");
-               SET_UINT  (msg, info2.code_page,            "codePage");
+               SET_STRING(msg, info2.comment.string,          "comment");
+               SET_UINT  (msg, info2.country_code,            "countryCode");
+               SET_UINT  (msg, info2.code_page,               "codePage");
                break;
 
        case 4:
-               SET_LHOURS(msg, info4.logon_hours,          "logonHours");
+               SET_LHOURS(msg, info4.logon_hours,             "logonHours");
                break;
 
        case 6:
-               SET_STRING(msg, info6.full_name.name,       "displayName");
+               SET_STRING(msg, info6.full_name.string,        "displayName");
                break;
 
        case 8:
-               SET_STRING(msg, info8.full_name.name,       "displayName");
+               SET_STRING(msg, info8.full_name.string,        "displayName");
                break;
 
        case 9:
-               SET_UINT(msg, info9.primary_gid,            "primaryGroupID");
+               SET_UINT(msg, info9.primary_gid,               "primaryGroupID");
                break;
 
        case 10:
-               SET_STRING(msg, info10.home_directory.name, "homeDirectory");
-               SET_STRING(msg, info10.home_drive.name,     "homeDrive");
+               SET_STRING(msg, info10.home_directory.string,  "homeDirectory");
+               SET_STRING(msg, info10.home_drive.string,      "homeDrive");
                break;
 
        case 11:
-               SET_STRING(msg, info11.logon_script.name,   "scriptPath");
+               SET_STRING(msg, info11.logon_script.string,    "scriptPath");
                break;
 
        case 12:
-               SET_STRING(msg, info12.profile_path.name,   "profilePath");
+               SET_STRING(msg, info12.profile_path.string,    "profilePath");
                break;
 
        case 13:
-               SET_STRING(msg, info13.description.name,    "description");
+               SET_STRING(msg, info13.description.string,     "description");
                break;
 
        case 14:
-               SET_STRING(msg, info14.workstations.name,   "userWorkstations");
+               SET_STRING(msg, info14.workstations.string,    "userWorkstations");
                break;
 
        case 16:
-               SET_AFLAGS(msg, info16.acct_flags,          "userAccountControl");
+               SET_AFLAGS(msg, info16.acct_flags,             "userAccountControl");
                break;
 
        case 20:
-               SET_STRING(msg, info20.callback.name,       "userParameters");
+               SET_STRING(msg, info20.parameters.string,      "userParameters");
                break;
 
        case 21:
 #define IFSET(bit) if (bit & r->in.info->info21.fields_present)
                IFSET(SAMR_FIELD_NAME)         
-                       SET_STRING(msg, info21.full_name.name,    "displayName");
+                       SET_STRING(msg, info21.full_name.string,    "displayName");
                IFSET(SAMR_FIELD_DESCRIPTION)  
-                       SET_STRING(msg, info21.description.name,  "description");
+                       SET_STRING(msg, info21.description.string,  "description");
                IFSET(SAMR_FIELD_COMMENT)      
-                       SET_STRING(msg, info21.comment.name,      "comment");
+                       SET_STRING(msg, info21.comment.string,      "comment");
                IFSET(SAMR_FIELD_LOGON_SCRIPT) 
-                       SET_STRING(msg, info21.logon_script.name, "scriptPath");
+                       SET_STRING(msg, info21.logon_script.string, "scriptPath");
                IFSET(SAMR_FIELD_PROFILE_PATH)      
-                       SET_STRING(msg, info21.profile_path.name, "profilePath");
+                       SET_STRING(msg, info21.profile_path.string, "profilePath");
                IFSET(SAMR_FIELD_WORKSTATION)  
-                       SET_STRING(msg, info21.workstations.name, "userWorkstations");
+                       SET_STRING(msg, info21.workstations.string, "userWorkstations");
                IFSET(SAMR_FIELD_LOGON_HOURS)  
-                       SET_LHOURS(msg, info21.logon_hours,       "logonHours");
-               IFSET(SAMR_FIELD_CALLBACK)     
-                       SET_STRING(msg, info21.callback.name,     "userParameters");
+                       SET_LHOURS(msg, info21.logon_hours,         "logonHours");
+               IFSET(SAMR_FIELD_ACCT_FLAGS)     
+                       SET_AFLAGS(msg, info21.acct_flags,          "userAccountControl");
+               IFSET(SAMR_FIELD_PARAMETERS)     
+                       SET_STRING(msg, info21.parameters.string,   "userParameters");
                IFSET(SAMR_FIELD_COUNTRY_CODE) 
-                       SET_UINT  (msg, info21.country_code,      "countryCode");
+                       SET_UINT  (msg, info21.country_code,        "countryCode");
                IFSET(SAMR_FIELD_CODE_PAGE)    
-                       SET_UINT  (msg, info21.code_page,         "codePage");
+                       SET_UINT  (msg, info21.code_page,           "codePage");
+
+
+               /* Any reason the rest of these can't be set? */
 #undef IFSET
                break;
 
        case 23:
 #define IFSET(bit) if (bit & r->in.info->info23.info.fields_present)
                IFSET(SAMR_FIELD_NAME)         
-                       SET_STRING(msg, info23.info.full_name.name,    "displayName");
+                       SET_STRING(msg, info23.info.full_name.string,    "displayName");
                IFSET(SAMR_FIELD_DESCRIPTION)  
-                       SET_STRING(msg, info23.info.description.name,  "description");
+                       SET_STRING(msg, info23.info.description.string,  "description");
                IFSET(SAMR_FIELD_COMMENT)      
-                       SET_STRING(msg, info23.info.comment.name,      "comment");
+                       SET_STRING(msg, info23.info.comment.string,      "comment");
                IFSET(SAMR_FIELD_LOGON_SCRIPT) 
-                       SET_STRING(msg, info23.info.logon_script.name, "scriptPath");
+                       SET_STRING(msg, info23.info.logon_script.string, "scriptPath");
                IFSET(SAMR_FIELD_PROFILE_PATH)      
-                       SET_STRING(msg, info23.info.profile_path.name, "profilePath");
+                       SET_STRING(msg, info23.info.profile_path.string, "profilePath");
                IFSET(SAMR_FIELD_WORKSTATION)  
-                       SET_STRING(msg, info23.info.workstations.name, "userWorkstations");
+                       SET_STRING(msg, info23.info.workstations.string, "userWorkstations");
                IFSET(SAMR_FIELD_LOGON_HOURS)  
-                       SET_LHOURS(msg, info23.info.logon_hours,       "logonHours");
-               IFSET(SAMR_FIELD_CALLBACK)     
-                       SET_STRING(msg, info23.info.callback.name,     "userParameters");
+                       SET_LHOURS(msg, info23.info.logon_hours,         "logonHours");
+               IFSET(SAMR_FIELD_ACCT_FLAGS)     
+                       SET_AFLAGS(msg, info23.info.acct_flags,          "userAccountControl");
+               IFSET(SAMR_FIELD_PARAMETERS)     
+                       SET_STRING(msg, info23.info.parameters.string,   "userParameters");
                IFSET(SAMR_FIELD_COUNTRY_CODE) 
-                       SET_UINT  (msg, info23.info.country_code,      "countryCode");
+                       SET_UINT  (msg, info23.info.country_code,        "countryCode");
                IFSET(SAMR_FIELD_CODE_PAGE)    
-                       SET_UINT  (msg, info23.info.code_page,         "codePage");
+                       SET_UINT  (msg, info23.info.code_page,           "codePage");
                IFSET(SAMR_FIELD_PASSWORD) {
                        status = samr_set_password(dce_call,
                                                   a_state->sam_ctx,
@@ -1750,6 +1847,13 @@ static NTSTATUS samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX
                                                   a_state->domain_state->domain_dn,
                                                   mem_ctx, msg, 
                                                   &r->in.info->info23.password);
+               } else IFSET(SAMR_FIELD_PASSWORD2) {
+                       status = samr_set_password(dce_call,
+                                                  a_state->sam_ctx,
+                                                  a_state->account_dn,
+                                                  a_state->domain_state->domain_dn,
+                                                  mem_ctx, msg, 
+                                                  &r->in.info->info23.password);
                }
 #undef IFSET
                break;
@@ -1767,25 +1871,27 @@ static NTSTATUS samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX
        case 25:
 #define IFSET(bit) if (bit & r->in.info->info25.info.fields_present)
                IFSET(SAMR_FIELD_NAME)         
-                       SET_STRING(msg, info25.info.full_name.name,    "displayName");
+                       SET_STRING(msg, info25.info.full_name.string,    "displayName");
                IFSET(SAMR_FIELD_DESCRIPTION)  
-                       SET_STRING(msg, info25.info.description.name,  "description");
+                       SET_STRING(msg, info25.info.description.string,  "description");
                IFSET(SAMR_FIELD_COMMENT)      
-                       SET_STRING(msg, info25.info.comment.name,      "comment");
+                       SET_STRING(msg, info25.info.comment.string,      "comment");
                IFSET(SAMR_FIELD_LOGON_SCRIPT) 
-                       SET_STRING(msg, info25.info.logon_script.name, "scriptPath");
+                       SET_STRING(msg, info25.info.logon_script.string, "scriptPath");
                IFSET(SAMR_FIELD_PROFILE_PATH)      
-                       SET_STRING(msg, info25.info.profile_path.name, "profilePath");
+                       SET_STRING(msg, info25.info.profile_path.string, "profilePath");
                IFSET(SAMR_FIELD_WORKSTATION)  
-                       SET_STRING(msg, info25.info.workstations.name, "userWorkstations");
+                       SET_STRING(msg, info25.info.workstations.string, "userWorkstations");
                IFSET(SAMR_FIELD_LOGON_HOURS)  
-                       SET_LHOURS(msg, info25.info.logon_hours,       "logonHours");
-               IFSET(SAMR_FIELD_CALLBACK)     
-                       SET_STRING(msg, info25.info.callback.name,     "userParameters");
+                       SET_LHOURS(msg, info25.info.logon_hours,         "logonHours");
+               IFSET(SAMR_FIELD_ACCT_FLAGS)     
+                       SET_AFLAGS(msg, info25.info.acct_flags,          "userAccountControl");
+               IFSET(SAMR_FIELD_PARAMETERS)     
+                       SET_STRING(msg, info25.info.parameters.string,   "userParameters");
                IFSET(SAMR_FIELD_COUNTRY_CODE) 
-                       SET_UINT  (msg, info25.info.country_code,      "countryCode");
+                       SET_UINT  (msg, info25.info.country_code,        "countryCode");
                IFSET(SAMR_FIELD_CODE_PAGE)    
-                       SET_UINT  (msg, info25.info.code_page,         "codePage");
+                       SET_UINT  (msg, info25.info.code_page,           "codePage");
                IFSET(SAMR_FIELD_PASSWORD) {
                        status = samr_set_password_ex(dce_call,
                                                      a_state->sam_ctx,
@@ -1793,6 +1899,13 @@ static NTSTATUS samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX
                                                      a_state->domain_state->domain_dn,
                                                      mem_ctx, msg, 
                                                      &r->in.info->info25.password);
+               } else IFSET(SAMR_FIELD_PASSWORD2) {
+                       status = samr_set_password_ex(dce_call,
+                                                     a_state->sam_ctx,
+                                                     a_state->account_dn,
+                                                     a_state->domain_state->domain_dn,
+                                                     mem_ctx, msg, 
+                                                     &r->in.info->info25.password);
                }
 #undef IFSET
                break;
@@ -1889,12 +2002,12 @@ static NTSTATUS samr_GetUserPwInfo(struct dcesrv_call_state *dce_call, TALLOC_CT
 
        ZERO_STRUCT(r->out.info);
 
-       DCESRV_PULL_HANDLE(h, r->in.handle, SAMR_HANDLE_USER);
+       DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
 
        a_state = h->data;
 
-       r->out.info.min_password_len = samdb_search_uint(a_state->sam_ctx, mem_ctx, 0, NULL, "minPwdLength", 
-                                                   "dn=%s", a_state->domain_state->domain_dn);
+       r->out.info.min_password_length = samdb_search_uint(a_state->sam_ctx, mem_ctx, 0, NULL, "minPwdLength", 
+                                                           "dn=%s", a_state->domain_state->domain_dn);
        r->out.info.password_properties = samdb_search_uint(a_state->sam_ctx, mem_ctx, 0, NULL, "pwdProperties", 
                                                            "dn=%s", a_state->account_dn);
        return NT_STATUS_OK;
@@ -1932,7 +2045,7 @@ static NTSTATUS samr_QueryUserInfo2(struct dcesrv_call_state *dce_call, TALLOC_C
        struct samr_QueryUserInfo r1;
        NTSTATUS status;
 
-       r1.in.handle = r->in.handle;
+       r1.in.user_handle = r->in.user_handle;
        r1.in.level  = r->in.level;
        
        status = samr_QueryUserInfo(dce_call, mem_ctx, &r1);
@@ -2028,7 +2141,7 @@ static NTSTATUS samr_GetDomPwInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX
                return NT_STATUS_INTERNAL_DB_CORRUPTION;
        }
 
-       r->out.info.min_password_len         = samdb_result_uint(msgs[0], "minPwdLength", 0);
+       r->out.info.min_password_length = samdb_result_uint(msgs[0], "minPwdLength", 0);
        r->out.info.password_properties = samdb_result_uint(msgs[0], "pwdProperties", 1);
 
        samdb_search_free(sam_ctx, mem_ctx, msgs);
@@ -2048,7 +2161,7 @@ static NTSTATUS samr_Connect2(struct dcesrv_call_state *dce_call, TALLOC_CTX *me
 
        c.in.system_name = NULL;
        c.in.access_mask = r->in.access_mask;
-       c.out.handle = r->out.handle;
+       c.out.connect_handle = r->out.connect_handle;
 
        return samr_Connect(dce_call, mem_ctx, &c);
 }
@@ -2064,7 +2177,7 @@ static NTSTATUS samr_SetUserInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX
 {
        struct samr_SetUserInfo r2;
 
-       r2.in.handle = r->in.handle;
+       r2.in.user_handle = r->in.user_handle;
        r2.in.level = r->in.level;
        r2.in.info = r->in.info;
 
@@ -2102,7 +2215,7 @@ static NTSTATUS samr_Connect3(struct dcesrv_call_state *dce_call, TALLOC_CTX *me
 
        c.in.system_name = NULL;
        c.in.access_mask = r->in.access_mask;
-       c.out.handle = r->out.handle;
+       c.out.connect_handle = r->out.connect_handle;
 
        return samr_Connect(dce_call, mem_ctx, &c);
 }
@@ -2118,7 +2231,7 @@ static NTSTATUS samr_Connect4(struct dcesrv_call_state *dce_call, TALLOC_CTX *me
 
        c.in.system_name = NULL;
        c.in.access_mask = r->in.access_mask;
-       c.out.handle = r->out.handle;
+       c.out.connect_handle = r->out.connect_handle;
 
        return samr_Connect(dce_call, mem_ctx, &c);
 }
@@ -2135,7 +2248,7 @@ static NTSTATUS samr_Connect5(struct dcesrv_call_state *dce_call, TALLOC_CTX *me
 
        c.in.system_name = NULL;
        c.in.access_mask = r->in.access_mask;
-       c.out.handle = r->out.handle;
+       c.out.connect_handle = r->out.connect_handle;
 
        status = samr_Connect(dce_call, mem_ctx, &c);