winbindd: explain that this check protects the AD DC machine account password (for...

Change-Id: I2e2eb2e7fc4a12f27025f42e4cc41560311ce6c8
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/source3/winbindd/winbindd_change_machine_acct.c b/source3/winbindd/winbindd_change_machine_acct.c
index a5514e22ebca5336129208eb327a83ddd66c6b6f..f335e345e54d45630f057a9c83be82e818f00d78 100644 (file)
--- a/source3/winbindd/winbindd_change_machine_acct.c
+++ b/source3/winbindd/winbindd_change_machine_acct.c
@@ -52,6 +52,10 @@ struct tevent_req *winbindd_change_machine_acct_send(TALLOC_CTX *mem_ctx,
                /*
                 * Internal domains are passdb based, we can always
                 * contact them.
+                *
+                * This also protects us from changing the password on
+                * the AD DC without updating all the right databases.
+                * Do not remove this until that code is fixed.
                 */
                tevent_req_done(req);
                return tevent_req_post(req, ev);