Introduce system MIT krb5 build with --with-system-mitkrb5 option.

System MIT krb5 build also enabled by specifying --without-ad-dc

When --with-system-mitkrb5 (or --withou-ad-dc) option is passed to top level
configure in WAF build we are trying to detect and use system-wide MIT krb5
libraries. As result, Samba 4 DC functionality will be disabled due to the fact
that it is currently impossible to implement embedded KDC server with MIT krb5.

Thus, --with-system-mitkrb5/--without-ad-dc build will only produce
  * Samba 4 client libraries and their Python bindings
  * Samba 3 server (smbd, nmbd, winbindd from source3/)
  * Samba 3 client libraries

In addition, Samba 4 DC server-specific tests will not be compiled into smbtorture.
This in particular affects spoolss_win, spoolss_notify, and remote_pac rpc tests.

48 files changed, 598 insertions, 471 deletions

diff --git a/buildtools/wafsamba/samba_utils.py b/buildtools/wafsamba/samba_utils.py
index 477e0b41db1..70d06704e74 100644
--- a/buildtools/wafsamba/samba_utils.py
+++ b/buildtools/wafsamba/samba_utils.py
@@ -642,8 +642,17 @@ def PROCESS_SEPARATE_RULE(self, rule):
     if txt:
         dc = {'ctx': self}
         if getattr(self.__class__, 'pre_recurse', None):
-            dc = self.pre_recurse(txt, file_path, [])
+            dc = self.pre_recurse(txt, file_path, self.curdir)
         exec(compile(txt, file_path, 'exec'), dc)
+        if getattr(self.__class__, 'post_recurse', None):
+            dc = self.post_recurse(txt, file_path, self.curdir)
 
 Build.BuildContext.PROCESS_SEPARATE_RULE = PROCESS_SEPARATE_RULE
 ConfigurationContext.PROCESS_SEPARATE_RULE = PROCESS_SEPARATE_RULE
+
+def AD_DC_BUILD_IS_ENABLED(self):
+    if self.CONFIG_SET('AD_DC_BUILD_IS_ENABLED'):
+        return True
+    return False
+
+Build.BuildContext.AD_DC_BUILD_IS_ENABLED = AD_DC_BUILD_IS_ENABLED
diff --git a/buildtools/wafsamba/wafsamba.py b/buildtools/wafsamba/wafsamba.py
index 534bace25b4..f1e7affbefe 100644
--- a/buildtools/wafsamba/wafsamba.py
+++ b/buildtools/wafsamba/wafsamba.py
@@ -413,6 +413,9 @@ def SAMBA_MODULE(bld, modname, source,
         source = bld.SUBDIR(subdir, source)
 
     if internal_module or BUILTIN_LIBRARY(bld, modname):
+        # Do not create modules for disabled subsystems
+        if subsystem and GET_TARGET_TYPE(bld, subsystem) == 'DISABLED':
+            return
         bld.SAMBA_SUBSYSTEM(modname, source,
                     deps=deps,
                     includes=includes,
@@ -430,6 +433,10 @@ def SAMBA_MODULE(bld, modname, source,
         SET_TARGET_TYPE(bld, modname, 'DISABLED')
         return
 
+    # Do not create modules for disabled subsystems
+    if subsystem and GET_TARGET_TYPE(bld, subsystem) == 'DISABLED':
+        return
+
     obj_target = modname + '.objlist'
 
     realname = modname
diff --git a/lib/addns/dns.h b/lib/addns/dns.h
index 2e805776421..2864bdf5396 100644
--- a/lib/addns/dns.h
+++ b/lib/addns/dns.h
@@ -436,7 +436,7 @@ const char *dns_errstr(DNS_ERROR err);
 
 /* from dnsgss.c */
 
-#ifdef HAVE_KRB5
+#ifdef HAVE_GSSAPI
 
 void display_status( const char *msg, OM_uint32 maj_stat, OM_uint32 min_stat ); 
 DNS_ERROR dns_negotiate_sec_ctx( const char *target_realm,
@@ -450,6 +450,6 @@ DNS_ERROR dns_sign_update(struct dns_update_request *req,
 			  const char *algorithmname,
 			  time_t time_signed, uint16 fudge);
 
-#endif	/* HAVE_KRB5 */
+#endif	/* HAVE_GSSAPI */
 
 #endif	/* _DNS_H */
diff --git a/lib/addns/dnsgss.c b/lib/addns/dnsgss.c
index 4fef8329262..4f7571f87d3 100644
--- a/lib/addns/dnsgss.c
+++ b/lib/addns/dnsgss.c
@@ -26,7 +26,7 @@
 #include <ctype.h>
 
 
-#ifdef HAVE_KRB5
+#ifdef HAVE_GSSAPI
 
 /*********************************************************************
 *********************************************************************/
@@ -331,4 +331,4 @@ DNS_ERROR dns_sign_update(struct dns_update_request *req,
 	return err;
 }
 
-#endif	/* HAVE_KRB5 */
+#endif	/* HAVE_GSSAPI */
diff --git a/lib/addns/wscript_build b/lib/addns/wscript_build
index 921815ac3ab..f1bab053c3a 100755
--- a/lib/addns/wscript_build
+++ b/lib/addns/wscript_build
@@ -2,6 +2,6 @@
 
 bld.SAMBA_LIBRARY('addns',
                    source='dnsquery.c dnsrecord.c dnsutils.c dnssock.c dnsgss.c dnsmarshall.c error.c',
-                   public_deps='DNS_HOSTS_FILE samba-util krb5 gssapi_krb5 uuid resolv',
+                   public_deps='DNS_HOSTS_FILE samba-util gssapi uuid resolv',
                    private_library=True,
                    vars=locals())
diff --git a/lib/krb5_wrap/wscript_build b/lib/krb5_wrap/wscript_build
index 2a61f5633fb..f5190bc0019 100755
--- a/lib/krb5_wrap/wscript_build
+++ b/lib/krb5_wrap/wscript_build
@@ -1,7 +1,11 @@
 #!/usr/bin/env python
 
+add_deps = ''
+if bld.CONFIG_SET('SAMBA4_USES_HEIMDAL'):
+    add_deps = ' asn1'
+
 bld.SAMBA_LIBRARY('krb5samba',
                   source='krb5_samba.c keytab_util.c',
-                  deps='samba-util asn1util talloc krb5 com_err',
-		  private_library=True
-		  )
+                  deps='samba-util asn1util talloc krb5 com_err' + add_deps,
+                  private_library=True
+                 )
diff --git a/lib/replace/system/gssapi.h b/lib/replace/system/gssapi.h
index c22663c1d04..6386c7b21a3 100644
--- a/lib/replace/system/gssapi.h
+++ b/lib/replace/system/gssapi.h
@@ -27,7 +27,7 @@
 
 */
 
-#ifdef HAVE_LIBGSSAPI
+#ifdef HAVE_GSSAPI
 
 #ifdef HAVE_GSSAPI_GSSAPI_EXT_H
 #include <gssapi/gssapi_ext.h>
diff --git a/source3/auth/wscript_build b/source3/auth/wscript_build
index 54d710c95d7..47dbea0a486 100644
--- a/source3/auth/wscript_build
+++ b/source3/auth/wscript_build
@@ -104,5 +104,5 @@ bld.SAMBA3_MODULE('auth_samba4',
                   source='auth_samba4.c',
                   init_function='',
                   deps='auth4 samba_server_gensec gensec',
-                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('auth_samba4'),
-                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('auth_samba4'))
+                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('auth_samba4') and bld.AD_DC_BUILD_IS_ENABLED(),
+                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('auth_samba4') and bld.AD_DC_BUILD_IS_ENABLED())
diff --git a/source3/configure.in b/source3/configure.in
index 43a090da18f..3e35d8f6f63 100644
--- a/source3/configure.in
+++ b/source3/configure.in
@@ -3547,7 +3547,7 @@ if test x"$with_ads_support" != x"no"; then
   	AC_MSG_WARN([Samba cannot be supported without GSSAPI])
 	use_ads=no
   else
-	AC_DEFINE(HAVE_LIBGSSAPI, , [Whether the platform has GSSAPI support])
+	AC_DEFINE(HAVE_GSSAPI, , [Whether the platform has GSSAPI support])
   fi
 
   AC_CHECK_FUNC_EXT(krb5_set_real_time, $KRB5_LIBS)
diff --git a/source3/librpc/wscript_build b/source3/librpc/wscript_build
index 8aa016135b7..ab4c23f801f 100644
--- a/source3/librpc/wscript_build
+++ b/source3/librpc/wscript_build
@@ -7,7 +7,7 @@ bld.SAMBA3_SUBSYSTEM('NDR_LIBNETAPI',
 
 bld.SAMBA3_SUBSYSTEM('NDR_LIBNET_JOIN',
 	source='gen_ndr/ndr_libnet_join.c',
-	public_deps='ndr'
+	public_deps='ndr krb5samba'
 	)
 
 bld.SAMBA3_SUBSYSTEM('NDR_MESSAGING',
diff --git a/source3/modules/getdate.h b/source3/modules/getdate.h
index 93d95ddde02..80b4a9875bf 100644
--- a/source3/modules/getdate.h
+++ b/source3/modules/getdate.h
@@ -13,7 +13,7 @@
    You should have received a copy of the GNU General Public License
    along with this program; if not, see <http://www.gnu.org/licenses/>.  */
 
-#if HAVE_CONFIG_H
+#ifdef HAVE_CONFIG_H
 # include <config.h>
 #endif
 
diff --git a/source3/modules/wscript_build b/source3/modules/wscript_build
index 3b257bcf66c..b912b8c1b66 100644
--- a/source3/modules/wscript_build
+++ b/source3/modules/wscript_build
@@ -188,8 +188,8 @@ bld.SAMBA3_MODULE('vfs_posix_eadb',
                  source='vfs_posix_eadb.c',
                  deps='tdb-wrap posix_eadb',
                  init_function='',
-                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_posix_eadb'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_posix_eadb'))
+                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_posix_eadb') and bld.AD_DC_BUILD_IS_ENABLED(),
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_posix_eadb') and bld.AD_DC_BUILD_IS_ENABLED())
 
 bld.SAMBA3_MODULE('vfs_posixacl',
                  subsystem='vfs',
@@ -457,8 +457,8 @@ bld.SAMBA3_MODULE('vfs_dfs_samba4',
                  source='vfs_dfs_samba4.c',
                  deps='samba-util dfs_server_ad samdb tevent',
                  init_function='',
-                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_dfs_samba4'),
-                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_dfs_samba4'))
+                 internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_dfs_samba4') and bld.AD_DC_BUILD_IS_ENABLED(),
+                 enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_dfs_samba4') and bld.AD_DC_BUILD_IS_ENABLED())
 
 PERFCOUNT_TEST_SRC = 'perfcount_test.c'
 
diff --git a/source3/passdb/wscript_build b/source3/passdb/wscript_build
index 82c96348c31..59a7f80697b 100644
--- a/source3/passdb/wscript_build
+++ b/source3/passdb/wscript_build
@@ -51,8 +51,8 @@ bld.SAMBA3_MODULE('pdb_samba4',
                   source='pdb_samba4.c',
                   init_function='',
                   deps='IDMAP samdb',
-                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('pdb_samba4'),
-                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('pdb_samba4'))
+                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('pdb_samba4') and bld.AD_DC_BUILD_IS_ENABLED(),
+                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('pdb_samba4') and bld.AD_DC_BUILD_IS_ENABLED())
 
 bld.SAMBA3_PYTHON('pypassdb',
                   source='py_passdb.c',
diff --git a/source3/winbindd/wscript_build b/source3/winbindd/wscript_build
index 07241e4982c..3b5d1d3d93d 100644
--- a/source3/winbindd/wscript_build
+++ b/source3/winbindd/wscript_build
@@ -37,7 +37,7 @@ bld.SAMBA3_SUBSYSTEM('IDMAP_ADEX',
 
 bld.SAMBA3_SUBSYSTEM('IDMAP_HASH',
                     source=IDMAP_HASH_SRC,
-                    deps='samba-util',
+                    deps='samba-util krb5samba',
                     vars=locals())
 
 bld.SAMBA3_SUBSYSTEM('IDMAP_AD',
@@ -142,7 +142,7 @@ bld.SAMBA3_LIBRARY('nss_info',
 bld.SAMBA3_MODULE('nss_info_template',
                  subsystem='nss_info',
                  source=NSS_INFO_TEMPLATE_SRC,
-                 deps='samba-util',
+                 deps='samba-util krb5samba',
                  init_function='',
                  internal_module=bld.SAMBA3_IS_STATIC_MODULE('nss_info_template'),
                  enabled=bld.SAMBA3_IS_ENABLED_MODULE('nss_info_template'))
diff --git a/source3/wscript b/source3/wscript
index 8bf378cd4da..0b36b22e610 100755
--- a/source3/wscript
+++ b/source3/wscript
@@ -28,7 +28,6 @@ def set_options(opt):
     opt.SAMBA3_ADD_OPTION('winbind')
     opt.SAMBA3_ADD_OPTION('swat')
     opt.SAMBA3_ADD_OPTION('ads')
-    opt.SAMBA3_ADD_OPTION('mit-krb5-checks', default=False)
     opt.SAMBA3_ADD_OPTION('ldap')
     opt.SAMBA3_ADD_OPTION('cups', with_name="enable", without_name="disable")
     opt.SAMBA3_ADD_OPTION('iprint', with_name="enable", without_name="disable")
@@ -1396,7 +1395,8 @@ main() {
         default_shared_modules.extend(TO_LIST('vfs_skel_opaque vfs_skel_transparent vfs_shadow_copy_test'))
         default_shared_modules.extend(TO_LIST('auth_skel pdb_test'))
 
-    default_static_modules.extend(TO_LIST('pdb_samba4 auth_samba4 vfs_dfs_samba4'))
+    if conf.CONFIG_SET('AD_DC_BUILD_IS_ENABLED'):
+        default_static_modules.extend(TO_LIST('pdb_samba4 auth_samba4 vfs_dfs_samba4'))
 
     if Options.options.with_acl_support and conf.CONFIG_SET('HAVE_POSIX_ACLS'):
         default_static_modules.extend(TO_LIST('vfs_posixacl'))
diff --git a/source3/wscript_build b/source3/wscript_build
index 69d988958d2..f923463b6bc 100755
--- a/source3/wscript_build
+++ b/source3/wscript_build
@@ -869,7 +869,7 @@ bld.SAMBA3_SUBSYSTEM('LIBADS_SERVER',
 
 bld.SAMBA3_SUBSYSTEM('LIBADS_PRINTER',
                     source=LIBADS_PRINTER_SRC,
-                    deps='samba-util',
+                    deps='samba-util krb5samba',
 		    vars=locals())
 
 bld.SAMBA3_SUBSYSTEM('LIBAFS',
@@ -1025,7 +1025,8 @@ bld.SAMBA3_SUBSYSTEM('PASSCHANGE',
                     source=PASSCHANGE_SRC,
                     deps='''LIBCLI_SAMR
                     INIT_LSA
-                    msrpc3''',
+                    msrpc3
+                    krb5samba''',
                     vars=locals())
 
 bld.SAMBA3_SUBSYSTEM('SAMBA_VERSION',
@@ -1103,7 +1104,7 @@ bld.SAMBA3_SUBSYSTEM('LIBCLI_WINREG_INTERNAL',
 
 bld.SAMBA3_SUBSYSTEM('RPC_CLIENT_SCHANNEL',
                     source=RPC_CLIENT_SCHANNEL_SRC,
-                    deps='samba-util',
+                    deps='samba-util krb5samba',
                     vars=locals())
 
 bld.SAMBA3_SUBSYSTEM('INIT_LSA',
@@ -1421,7 +1422,8 @@ bld.SAMBA3_BINARY('smbcacls',
                  talloc
                  popt_samba3
                  msrpc3
-                 libcli_lsa3''',
+                 libcli_lsa3
+                 krb5samba''',
                  vars=locals())
 
 bld.SAMBA3_BINARY('smbcquotas',
diff --git a/source4/auth/gensec/wscript_build b/source4/auth/gensec/wscript_build
index e7bc0219633..04fccc5171c 100755
--- a/source4/auth/gensec/wscript_build
+++ b/source4/auth/gensec/wscript_build
@@ -11,6 +11,7 @@ bld.SAMBA_MODULE('gensec_krb5',
 	init_function='gensec_krb5_init',
 	deps='samba-credentials authkrb5 com_err gensec_util',
 	internal_module=False,
+        enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
diff --git a/source4/auth/kerberos/wscript_build b/source4/auth/kerberos/wscript_build
index 0588bfb2e3f..ffcb54c1c06 100755
--- a/source4/auth/kerberos/wscript_build
+++ b/source4/auth/kerberos/wscript_build
@@ -16,7 +16,7 @@ bld.SAMBA_LIBRARY('authkrb5',
 bld.SAMBA_SUBSYSTEM('KERBEROS_UTIL',
 	autoproto='kerberos_util.h',
 	source='kerberos_util.c',
-	deps='authkrb5 com_err CREDENTIALS_KRB5',
+	deps='authkrb5 krb5samba com_err CREDENTIALS_KRB5',
 	)
 
 bld.SAMBA_SUBSYSTEM('KERBEROS_SRV_KEYTAB',
diff --git a/source4/dns_server/wscript_build b/source4/dns_server/wscript_build
index afd1d9cfea1..960aefc3cb2 100644
--- a/source4/dns_server/wscript_build
+++ b/source4/dns_server/wscript_build
@@ -7,6 +7,7 @@ bld.SAMBA_MODULE('service_dns',
         deps='samba-hostconfig LIBTSOCKET LIBSAMBA_TSOCKET ldbsamba LIBCLI_DNS',
         local_include=False,
         internal_module=False,
+        enabled=bld.AD_DC_BUILD_IS_ENABLED()
         )
 
 # a bind9 dlz module giving access to the Samba DNS SAM
@@ -17,7 +18,8 @@ bld.SAMBA_LIBRARY('dlz_bind9',
                   link_name='modules/bind9/dlz_bind9.so',
                   realname='dlz_bind9.so',
                   install_path='${MODULESDIR}/bind9',
-                  deps='samba-hostconfig samdb-common gensec popt')
+                  deps='samba-hostconfig samdb-common gensec popt',
+                  enabled=bld.AD_DC_BUILD_IS_ENABLED())
 
 bld.SAMBA_LIBRARY('dlz_bind9_9',
                   source='dlz_bind9.c',
@@ -26,4 +28,5 @@ bld.SAMBA_LIBRARY('dlz_bind9_9',
                   link_name='modules/bind9/dlz_bind9_9.so',
                   realname='dlz_bind9_9.so',
                   install_path='${MODULESDIR}/bind9',
-                  deps='samba-hostconfig samdb-common gensec popt')
+                  deps='samba-hostconfig samdb-common gensec popt',
+                  enabled=bld.AD_DC_BUILD_IS_ENABLED())
diff --git a/source4/dsdb/samdb/cracknames.c b/source4/dsdb/samdb/cracknames.c
index 0c0fb82de15..bac592cead7 100644
--- a/source4/dsdb/samdb/cracknames.c
+++ b/source4/dsdb/samdb/cracknames.c
@@ -24,7 +24,6 @@
 #include "includes.h"
 #include "librpc/gen_ndr/drsuapi.h"
 #include "lib/events/events.h"
-#include "rpc_server/common/common.h"
 #include <ldb.h>
 #include <ldb_errors.h>
 #include "auth/kerberos/kerberos.h"
diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build b/source4/dsdb/samdb/ldb_modules/wscript_build
index ab9ba13097d..98651e5750c 100755
--- a/source4/dsdb/samdb/ldb_modules/wscript_build
+++ b/source4/dsdb/samdb/ldb_modules/wscript_build
@@ -18,358 +18,5 @@ bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPER_RIDALLOC',
 	deps='MESSAGING',
 	)
 
-bld.SAMBA_MODULE('ldb_samba_dsdb',
-	source='samba_dsdb.c',
-	subsystem='ldb',
-	init_function='ldb_samba_dsdb_module_init',
-	module_init_name='ldb_init_module',
-	deps='samdb talloc ndr DSDB_MODULE_HELPERS',
-	internal_module=False,
-	)
-
-
-bld.SAMBA_MODULE('ldb_samba_secrets',
-	source='samba_secrets.c',
-	subsystem='ldb',
-	init_function='ldb_samba_secrets_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='samdb talloc ndr'
-	)
-
-
-bld.SAMBA_MODULE('ldb_objectguid',
-	source='objectguid.c',
-	subsystem='ldb',
-	init_function='ldb_objectguid_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='samdb talloc ndr DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_repl_meta_data',
-	source='repl_meta_data.c',
-	subsystem='ldb',
-	init_function='ldb_repl_meta_data_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='samdb talloc ndr NDR_DRSUAPI NDR_DRSBLOBS ndr DSDB_MODULE_HELPERS security'
-	)
-
-
-bld.SAMBA_MODULE('ldb_schema_load',
-	source='schema_load.c',
-	subsystem='ldb',
-	init_function='ldb_schema_load_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='samdb talloc DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_schema_data',
-	source='schema_data.c',
-	subsystem='ldb',
-	init_function='ldb_schema_data_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='samdb talloc DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_samldb',
-	source='samldb.c',
-	subsystem='ldb',
-	init_function='ldb_samldb_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samdb DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_RIDALLOC'
-	)
-
-
-bld.SAMBA_MODULE('ldb_samba3sam',
-	source='samba3sam.c',
-	subsystem='ldb',
-	init_function='ldb_samba3sam_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc ldb smbpasswdparser security NDR_SECURITY'
-	)
-
-
-bld.SAMBA_MODULE('ldb_samba3sid',
-	source='samba3sid.c',
-	subsystem='ldb',
-	init_function='ldb_samba3sid_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc ldb security NDR_SECURITY ldbsamba DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_simple_ldap_map',
-	source='simple_ldap_map.c',
-	subsystem='ldb',
-	init_function='ldb_simple_ldap_map_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc ldb ndr ldbsamba samdb-common'
-	)
-
-
-bld.SAMBA_MODULE('ldb_rootdse',
-	source='rootdse.c',
-	subsystem='ldb',
-	init_function='ldb_rootdse_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samdb MESSAGING security DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_password_hash',
-	source='password_hash.c',
-	subsystem='ldb',
-	init_function='ldb_password_hash_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_local_password',
-	source='local_password.c',
-	subsystem='ldb',
-	init_function='ldb_local_password_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc ndr samdb'
-	)
-
-bld.SAMBA_MODULE('ldb_extended_dn_in',
-	source='extended_dn_in.c',
-	subsystem='ldb',
-	init_function='ldb_extended_dn_in_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='ldb talloc samba-util DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_extended_dn_out',
-	source='extended_dn_out.c',
-	init_function='ldb_extended_dn_out_module_init',
-	module_init_name='ldb_init_module',
-	subsystem='ldb',
-	deps='talloc ndr samba-util samdb DSDB_MODULE_HELPERS',
-	internal_module=False,
-	)
-
-
-bld.SAMBA_MODULE('ldb_extended_dn_store',
-	source='extended_dn_store.c',
-	subsystem='ldb',
-	init_function='ldb_extended_dn_store_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samba-util samdb DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_show_deleted',
-	source='show_deleted.c',
-	subsystem='ldb',
-	init_function='ldb_show_deleted_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samba-util DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_partition',
-	source='partition.c partition_init.c partition_metadata.c',
-	autoproto='partition_proto.h',
-	subsystem='ldb',
-	init_function='ldb_partition_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samdb DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_new_partition',
-	source='new_partition.c',
-	subsystem='ldb',
-	init_function='ldb_new_partition_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samdb DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_update_keytab',
-	source='update_keytab.c',
-	subsystem='ldb',
-	init_function='ldb_update_keytab_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samba-credentials ldb com_err KERBEROS_SRV_KEYTAB SECRETS DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_objectclass',
-	source='objectclass.c',
-	subsystem='ldb',
-	init_function='ldb_objectclass_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samdb DSDB_MODULE_HELPERS samba-util'
-	)
-
-
-bld.SAMBA_MODULE('ldb_objectclass_attrs',
-	source='objectclass_attrs.c',
-	subsystem='ldb',
-	init_function='ldb_objectclass_attrs_module_init',
-	module_init_name='ldb_init_module',
-	deps='talloc samdb samba-util',
-	internal_module=False,
-	)
-
-
-bld.SAMBA_MODULE('ldb_subtree_rename',
-	source='subtree_rename.c',
-	subsystem='ldb',
-	init_function='ldb_subtree_rename_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samba-util ldb samdb-common'
-	)
-
-
-bld.SAMBA_MODULE('ldb_subtree_delete',
-	source='subtree_delete.c',
-	subsystem='ldb',
-	init_function='ldb_subtree_delete_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samba-util DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_linked_attributes',
-	source='linked_attributes.c',
-	subsystem='ldb',
-	init_function='ldb_linked_attributes_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samdb DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_ranged_results',
-	source='ranged_results.c',
-	subsystem='ldb',
-	init_function='ldb_ranged_results_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samba-util ldb'
-	)
-
-
-bld.SAMBA_MODULE('ldb_anr',
-	source='anr.c',
-	subsystem='ldb',
-	init_function='ldb_anr_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samba-util samdb'
-	)
-
-
-bld.SAMBA_MODULE('ldb_instancetype',
-	source='instancetype.c',
-	subsystem='ldb',
-	init_function='ldb_instancetype_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samba-util samdb DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_operational',
-	source='operational.c',
-	subsystem='ldb',
-	init_function='ldb_operational_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc samba-util samdb-common DSDB_MODULE_HELPERS samdb'
-	)
-
-
-bld.SAMBA_MODULE('ldb_descriptor',
-	source='descriptor.c',
-	subsystem='ldb',
-	init_function='ldb_descriptor_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc security NDR_SECURITY samdb DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_resolve_oids',
-	source='resolve_oids.c',
-	subsystem='ldb',
-	init_function='ldb_resolve_oids_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='samdb talloc ndr'
-	)
-
-
-bld.SAMBA_MODULE('ldb_acl',
-	source='acl.c',
-	subsystem='ldb',
-	init_function='ldb_acl_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc security samdb DSDB_MODULE_HELPERS'
-	)
-
-
-bld.SAMBA_MODULE('ldb_lazy_commit',
-	source='lazy_commit.c',
-	subsystem='ldb',
-	internal_module=False,
-	module_init_name='ldb_init_module',
-	init_function='ldb_lazy_commit_module_init',
-	deps='samdb DSDB_MODULE_HELPERS'
-	)
-
-bld.SAMBA_MODULE('ldb_aclread',
-	source='acl_read.c',
-	subsystem='ldb',
-	init_function='ldb_aclread_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc security samdb DSDB_MODULE_HELPERS',
-	)
-
-bld.SAMBA_MODULE('ldb_simple_dn',
-	source='simple_dn.c',
-	subsystem='ldb',
-	init_function='ldb_simple_dn_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc DSDB_MODULE_HELPERS'
-	)
-
-bld.SAMBA_MODULE('ldb_dirsync',
-	source='dirsync.c',
-	subsystem='ldb',
-	init_function='ldb_dirsync_module_init',
-	module_init_name='ldb_init_module',
-	internal_module=False,
-	deps='talloc security samdb DSDB_MODULE_HELPERS'
-	)
+if bld.AD_DC_BUILD_IS_ENABLED():
+    bld.PROCESS_SEPARATE_RULE("server")
diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server
new file mode 100755
index 00000000000..ae184dc71e5
--- /dev/null
+++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server
@@ -0,0 +1,357 @@
+#!/usr/bin/env python
+
+bld.SAMBA_MODULE('ldb_samba_dsdb',
+	source='samba_dsdb.c',
+	subsystem='ldb',
+	init_function='ldb_samba_dsdb_module_init',
+	module_init_name='ldb_init_module',
+	deps='samdb talloc ndr DSDB_MODULE_HELPERS',
+	internal_module=False,
+	)
+
+
+bld.SAMBA_MODULE('ldb_samba_secrets',
+	source='samba_secrets.c',
+	subsystem='ldb',
+	init_function='ldb_samba_secrets_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='samdb talloc ndr'
+	)
+
+
+bld.SAMBA_MODULE('ldb_objectguid',
+	source='objectguid.c',
+	subsystem='ldb',
+	init_function='ldb_objectguid_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='samdb talloc ndr DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_repl_meta_data',
+	source='repl_meta_data.c',
+	subsystem='ldb',
+	init_function='ldb_repl_meta_data_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='samdb talloc ndr NDR_DRSUAPI NDR_DRSBLOBS ndr DSDB_MODULE_HELPERS security'
+	)
+
+
+bld.SAMBA_MODULE('ldb_schema_load',
+	source='schema_load.c',
+	subsystem='ldb',
+	init_function='ldb_schema_load_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='samdb talloc DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_schema_data',
+	source='schema_data.c',
+	subsystem='ldb',
+	init_function='ldb_schema_data_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='samdb talloc DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_samldb',
+	source='samldb.c',
+	subsystem='ldb',
+	init_function='ldb_samldb_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samdb DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_RIDALLOC'
+	)
+
+
+bld.SAMBA_MODULE('ldb_samba3sam',
+	source='samba3sam.c',
+	subsystem='ldb',
+	init_function='ldb_samba3sam_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc ldb smbpasswdparser security NDR_SECURITY'
+	)
+
+
+bld.SAMBA_MODULE('ldb_samba3sid',
+	source='samba3sid.c',
+	subsystem='ldb',
+	init_function='ldb_samba3sid_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc ldb security NDR_SECURITY ldbsamba DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_simple_ldap_map',
+	source='simple_ldap_map.c',
+	subsystem='ldb',
+	init_function='ldb_simple_ldap_map_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc ldb ndr ldbsamba samdb-common'
+	)
+
+
+bld.SAMBA_MODULE('ldb_rootdse',
+	source='rootdse.c',
+	subsystem='ldb',
+	init_function='ldb_rootdse_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samdb MESSAGING security DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_password_hash',
+	source='password_hash.c',
+	subsystem='ldb',
+	init_function='ldb_password_hash_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_local_password',
+	source='local_password.c',
+	subsystem='ldb',
+	init_function='ldb_local_password_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc ndr samdb'
+	)
+
+bld.SAMBA_MODULE('ldb_extended_dn_in',
+	source='extended_dn_in.c',
+	subsystem='ldb',
+	init_function='ldb_extended_dn_in_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='ldb talloc samba-util DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_extended_dn_out',
+	source='extended_dn_out.c',
+	init_function='ldb_extended_dn_out_module_init',
+	module_init_name='ldb_init_module',
+	subsystem='ldb',
+	deps='talloc ndr samba-util samdb DSDB_MODULE_HELPERS',
+	internal_module=False,
+	)
+
+
+bld.SAMBA_MODULE('ldb_extended_dn_store',
+	source='extended_dn_store.c',
+	subsystem='ldb',
+	init_function='ldb_extended_dn_store_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samba-util samdb DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_show_deleted',
+	source='show_deleted.c',
+	subsystem='ldb',
+	init_function='ldb_show_deleted_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samba-util DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_partition',
+	source='partition.c partition_init.c partition_metadata.c',
+	autoproto='partition_proto.h',
+	subsystem='ldb',
+	init_function='ldb_partition_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samdb DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_new_partition',
+	source='new_partition.c',
+	subsystem='ldb',
+	init_function='ldb_new_partition_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samdb DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_update_keytab',
+	source='update_keytab.c',
+	subsystem='ldb',
+	init_function='ldb_update_keytab_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samba-credentials ldb com_err KERBEROS_SRV_KEYTAB SECRETS DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_objectclass',
+	source='objectclass.c',
+	subsystem='ldb',
+	init_function='ldb_objectclass_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samdb DSDB_MODULE_HELPERS samba-util'
+	)
+
+
+bld.SAMBA_MODULE('ldb_objectclass_attrs',
+	source='objectclass_attrs.c',
+	subsystem='ldb',
+	init_function='ldb_objectclass_attrs_module_init',
+	module_init_name='ldb_init_module',
+	deps='talloc samdb samba-util',
+	internal_module=False,
+	)
+
+
+bld.SAMBA_MODULE('ldb_subtree_rename',
+	source='subtree_rename.c',
+	subsystem='ldb',
+	init_function='ldb_subtree_rename_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samba-util ldb samdb-common'
+	)
+
+
+bld.SAMBA_MODULE('ldb_subtree_delete',
+	source='subtree_delete.c',
+	subsystem='ldb',
+	init_function='ldb_subtree_delete_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samba-util DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_linked_attributes',
+	source='linked_attributes.c',
+	subsystem='ldb',
+	init_function='ldb_linked_attributes_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samdb DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_ranged_results',
+	source='ranged_results.c',
+	subsystem='ldb',
+	init_function='ldb_ranged_results_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samba-util ldb'
+	)
+
+
+bld.SAMBA_MODULE('ldb_anr',
+	source='anr.c',
+	subsystem='ldb',
+	init_function='ldb_anr_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samba-util samdb'
+	)
+
+
+bld.SAMBA_MODULE('ldb_instancetype',
+	source='instancetype.c',
+	subsystem='ldb',
+	init_function='ldb_instancetype_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samba-util samdb DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_operational',
+	source='operational.c',
+	subsystem='ldb',
+	init_function='ldb_operational_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc samba-util samdb-common DSDB_MODULE_HELPERS samdb'
+	)
+
+
+bld.SAMBA_MODULE('ldb_descriptor',
+	source='descriptor.c',
+	subsystem='ldb',
+	init_function='ldb_descriptor_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc security NDR_SECURITY samdb DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_resolve_oids',
+	source='resolve_oids.c',
+	subsystem='ldb',
+	init_function='ldb_resolve_oids_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='samdb talloc ndr'
+	)
+
+
+bld.SAMBA_MODULE('ldb_acl',
+	source='acl.c',
+	subsystem='ldb',
+	init_function='ldb_acl_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc security samdb DSDB_MODULE_HELPERS'
+	)
+
+
+bld.SAMBA_MODULE('ldb_lazy_commit',
+	source='lazy_commit.c',
+	subsystem='ldb',
+	internal_module=False,
+	module_init_name='ldb_init_module',
+	init_function='ldb_lazy_commit_module_init',
+	deps='samdb DSDB_MODULE_HELPERS'
+	)
+
+bld.SAMBA_MODULE('ldb_aclread',
+	source='acl_read.c',
+	subsystem='ldb',
+	init_function='ldb_aclread_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc security samdb DSDB_MODULE_HELPERS',
+	)
+
+bld.SAMBA_MODULE('ldb_simple_dn',
+	source='simple_dn.c',
+	subsystem='ldb',
+	init_function='ldb_simple_dn_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc DSDB_MODULE_HELPERS'
+	)
+
+bld.SAMBA_MODULE('ldb_dirsync',
+	source='dirsync.c',
+	subsystem='ldb',
+	init_function='ldb_dirsync_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc security samdb DSDB_MODULE_HELPERS'
+	)
diff --git a/source4/dsdb/wscript_build b/source4/dsdb/wscript_build
index af0defdb284..a80c45cc5e3 100755
--- a/source4/dsdb/wscript_build
+++ b/source4/dsdb/wscript_build
@@ -12,7 +12,6 @@ bld.SAMBA_LIBRARY('samdb',
 	deps='ndr NDR_DRSUAPI NDR_DRSBLOBS auth_system_session LIBCLI_AUTH ndr SAMDB_SCHEMA ldbsamba samdb-common LIBCLI_DRSUAPI cli-ldap-common samba-util com_err authkrb5 samba-credentials ldbwrap errors krb5samba',
 	)
 
-
 bld.SAMBA_LIBRARY('samdb-common',
 	source='common/util.c common/util_groups.c common/util_samr.c common/dsdb_dn.c common/dsdb_access.c',
 	autoproto='common/proto.h',
@@ -35,6 +34,7 @@ bld.SAMBA_MODULE('service_drepl',
 	init_function='server_service_drepl_init',
 	deps='samdb process_model RPC_NDR_DRSUAPI',
 	internal_module=False,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
@@ -45,6 +45,7 @@ bld.SAMBA_MODULE('service_kcc',
 	init_function='server_service_kcc_init',
 	deps='samdb process_model RPC_NDR_IRPC RPC_NDR_DRSUAPI UTIL_RUNCMD',
 	internal_module=False,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
@@ -53,7 +54,8 @@ bld.SAMBA_MODULE('service_dns_update',
 	subsystem='service',
 	init_function='server_service_dnsupdate_init',
 	deps='samdb UTIL_RUNCMD samba-util ldb samdb-common errors talloc auth_system_session samba-hostconfig',
-	internal_module=False
+	internal_module=False,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 bld.SAMBA_PYTHON('python_dsdb',
diff --git a/source4/echo_server/wscript_build b/source4/echo_server/wscript_build
index 660baf4d182..8c40ec8c418 100644
--- a/source4/echo_server/wscript_build
+++ b/source4/echo_server/wscript_build
@@ -5,5 +5,6 @@ bld.SAMBA_MODULE('ECHO',
         subsystem='service',
         init_function='server_service_echo_init',
         deps='samba-hostconfig LIBTSOCKET LIBSAMBA_TSOCKET',
-        local_include=False
+        local_include=False,
+        enabled=bld.AD_DC_BUILD_IS_ENABLED()
         )
diff --git a/source4/heimdal_build/wscript_configure b/source4/heimdal_build/wscript_configure
index 0b6ae88a352..31e0c5c23e0 100755
--- a/source4/heimdal_build/wscript_configure
+++ b/source4/heimdal_build/wscript_configure
@@ -89,7 +89,7 @@ conf.define('HAVE_GSSKRB5_GET_SUBKEY', 1)
 conf.define('HAVE_GSS_KRB5_EXPORT_LUCID_SEC_CONTEXT', 1)
 conf.define('HAVE_GSS_IMPORT_CRED', 1)
 conf.define('HAVE_GSS_EXPORT_CRED', 1)
-conf.define('HAVE_LIBGSSAPI', 1)
+conf.define('HAVE_GSSAPI', 1)
 conf.define('HAVE_ADDR_TYPE_IN_KRB5_ADDRESS', 1)
 conf.define('HAVE_CHECKSUM_IN_KRB5_CHECKSUM', 1)
 conf.define('HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE', 0)
diff --git a/source4/ldap_server/wscript_build b/source4/ldap_server/wscript_build
index 743facc34ad..32a77c79c91 100644
--- a/source4/ldap_server/wscript_build
+++ b/source4/ldap_server/wscript_build
@@ -8,5 +8,6 @@ bld.SAMBA_MODULE('service_ldap',
 	init_function='server_service_ldap_init',
 	deps='samba-credentials cli-ldap samdb process_model gensec samba-hostconfig samba_server_gensec',
 	internal_module=False,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
diff --git a/source4/libnet/wscript_build b/source4/libnet/wscript_build
index 57e3160c8b2..55fedcde053 100644
--- a/source4/libnet/wscript_build
+++ b/source4/libnet/wscript_build
@@ -17,5 +17,6 @@ bld.SAMBA_PYTHON('python_net',
 bld.SAMBA_PYTHON('python_dckeytab',
 	source='py_net_dckeytab.c libnet_export_keytab.c',
 	deps='pyrpc_util HDB_SAMBA4 com_err',
-	realname='samba/dckeytab.so'
+	realname='samba/dckeytab.so',
+        enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
diff --git a/source4/nbt_server/wscript_build b/source4/nbt_server/wscript_build
index 252a9b81233..665ccd46c2e 100644
--- a/source4/nbt_server/wscript_build
+++ b/source4/nbt_server/wscript_build
@@ -3,7 +3,8 @@
 bld.SAMBA_SUBSYSTEM('WINSDB',
 	source='wins/winsdb.c wins/wins_hook.c',
 	autoproto='wins/winsdb_proto.h',
-	public_deps='ldb ldbsamba'
+	public_deps='ldb ldbsamba',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
@@ -14,27 +15,31 @@ bld.SAMBA_MODULE('ldb_wins_ldb',
         module_init_name='ldb_init_module',
 	deps='ldb netif samba-hostconfig samba-util',
 	internal_module=False,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
 bld.SAMBA_SUBSYSTEM('NBTD_WINS',
 	source='wins/winsserver.c wins/winsclient.c wins/winswack.c wins/wins_dns_proxy.c',
 	autoproto='wins/winsserver_proto.h',
-	deps='cli-nbt WINSDB'
+	deps='cli-nbt WINSDB',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
 bld.SAMBA_SUBSYSTEM('NBTD_DGRAM',
 	source='dgram/request.c dgram/netlogon.c dgram/browse.c',
 	autoproto='dgram/proto.h',
-	deps='LIBCLI_DGRAM CLDAPD'
+	deps='LIBCLI_DGRAM CLDAPD',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
 bld.SAMBA_SUBSYSTEM('NBT_SERVER',
 	source='interfaces.c register.c query.c nodestatus.c defense.c packet.c irpc.c',
 	autoproto='nbt_server_proto.h',
-	deps='cli-nbt NBTD_WINS NBTD_DGRAM'
+	deps='cli-nbt NBTD_WINS NBTD_DGRAM service',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
@@ -44,5 +49,6 @@ bld.SAMBA_MODULE('service_nbtd',
 	init_function='server_service_nbtd_init',
 	deps='NBT_SERVER process_model',
 	internal_module=False,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
diff --git a/source4/ntp_signd/wscript_build b/source4/ntp_signd/wscript_build
index ad129257125..a7f925df7a0 100644
--- a/source4/ntp_signd/wscript_build
+++ b/source4/ntp_signd/wscript_build
@@ -6,5 +6,6 @@ bld.SAMBA_MODULE('service_ntp_signd',
 	init_function='server_service_ntp_signd_init',
 	deps='samdb NDR_NTP_SIGND LIBTSOCKET LIBSAMBA_TSOCKET',
 	internal_module=False,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
diff --git a/source4/ntptr/wscript_build b/source4/ntptr/wscript_build
index ce858ae2d53..32c46fad4e0 100644
--- a/source4/ntptr/wscript_build
+++ b/source4/ntptr/wscript_build
@@ -4,13 +4,15 @@ bld.SAMBA_MODULE('ntptr_simple_ldb',
 	source='simple_ldb/ntptr_simple_ldb.c',
 	subsystem='ntptr',
 	init_function='ntptr_simple_ldb_init',
-	deps='ldb NDR_SPOOLSS DCERPC_COMMON ldbsamba'
+	deps='ldb NDR_SPOOLSS DCERPC_COMMON ldbsamba',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
 bld.SAMBA_SUBSYSTEM('ntptr',
 	source='ntptr_base.c ntptr_interface.c',
 	autoproto='ntptr_proto.h',
-	public_deps='DCERPC_COMMON'
+	public_deps='DCERPC_COMMON',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
diff --git a/source4/ntvfs/posix/wscript_build b/source4/ntvfs/posix/wscript_build
index 2a6a3dc2771..6ac22e1e84c 100644
--- a/source4/ntvfs/posix/wscript_build
+++ b/source4/ntvfs/posix/wscript_build
@@ -50,7 +50,7 @@ bld.SAMBA_LIBRARY('posix_eadb',
                   source='posix_eadb.c',
                   deps='tdb tdb-wrap',
                   autoproto='posix_eadb_proto.h',
-                private_library=True)
+                  private_library=True)
 
 bld.SAMBA_PYTHON('python_posix_eadb',
 	source='python/pyposix_eadb.c',
diff --git a/source4/ntvfs/wscript_build b/source4/ntvfs/wscript_build
index 455e7f0b8b8..6e3ee6da723 100644
--- a/source4/ntvfs/wscript_build
+++ b/source4/ntvfs/wscript_build
@@ -1,9 +1,18 @@
 #!/usr/bin/env python
 
-bld.RECURSE('posix')
-bld.RECURSE('common')
-bld.RECURSE('unixuid')
-bld.RECURSE('sysdep')
+bld.SAMBA_LIBRARY('ntvfs',
+                  source='ntvfs_base.c ntvfs_generic.c ntvfs_interface.c ntvfs_util.c',
+                  autoproto='ntvfs_proto.h',
+                  deps='tevent samba-modules',
+                  private_library=True,
+                  enabled=bld.AD_DC_BUILD_IS_ENABLED()
+                  )
+
+if bld.AD_DC_BUILD_IS_ENABLED():
+    bld.RECURSE('posix')
+    bld.RECURSE('common')
+    bld.RECURSE('unixuid')
+    bld.RECURSE('sysdep')
 
 bld.SAMBA_MODULE('ntvfs_cifs',
 	source='cifs/vfs_cifs.c',
@@ -64,10 +73,3 @@ bld.SAMBA_MODULE('ntvfs_nbench',
 	)
 
 
-bld.SAMBA_LIBRARY('ntvfs',
-                  source='ntvfs_base.c ntvfs_generic.c ntvfs_interface.c ntvfs_util.c',
-                  autoproto='ntvfs_proto.h',
-                  deps='tevent samba-modules',
-                  private_library=True
-                  )
-
diff --git a/source4/param/loadparm.c b/source4/param/loadparm.c
index b1c3db6e7e1..3fbf8528997 100644
--- a/source4/param/loadparm.c
+++ b/source4/param/loadparm.c
@@ -29,7 +29,6 @@
 #include "includes.h"
 #include "lib/param/param.h"
 #include "libcli/raw/libcliraw.h"
-#include "rpc_server/common/common.h"
 
 void lpcfg_smbcli_options(struct loadparm_context *lp_ctx,
 			 struct smbcli_options *options)
@@ -54,15 +53,3 @@ void lpcfg_smbcli_session_options(struct loadparm_context *lp_ctx,
 	options->plaintext_auth = lpcfg_client_plaintext_auth(lp_ctx);
 }
 
-_PUBLIC_ struct dcerpc_server_info *lpcfg_dcerpc_server_info(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
-{
-	struct dcerpc_server_info *ret = talloc_zero(mem_ctx, struct dcerpc_server_info);
-
-	ret->domain_name = talloc_reference(mem_ctx, lpcfg_workgroup(lp_ctx));
-	ret->version_major = lpcfg_parm_int(lp_ctx, NULL, "server_info", "version_major", 5);
-	ret->version_minor = lpcfg_parm_int(lp_ctx, NULL, "server_info", "version_minor", 2);
-	ret->version_build = lpcfg_parm_int(lp_ctx, NULL, "server_info", "version_build", 3790);
-
-	return ret;
-}
-
diff --git a/source4/rpc_server/common/loadparm.c b/source4/rpc_server/common/loadparm.c
new file mode 100644
index 00000000000..174063e4802
--- /dev/null
+++ b/source4/rpc_server/common/loadparm.c
@@ -0,0 +1,45 @@
+/*
+   Unix SMB/CIFS implementation.
+   DCERPC server info param function
+   Moved into rpc_server/common to break dependencies to rpc_server from param
+   Copyright (C) Karl Auer 1993-1998
+
+   Largely re-written by Andrew Tridgell, September 1994
+
+   Copyright (C) Simo Sorce 2001
+   Copyright (C) Alexander Bokovoy 2002
+   Copyright (C) Stefan (metze) Metzmacher 2002
+   Copyright (C) Jim McDonough (jmcd@us.ibm.com)  2003.
+   Copyright (C) James Myers 2003 <myersjj@samba.org>
+   Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "lib/param/param.h"
+#include "rpc_server/common/common.h"
+
+_PUBLIC_ struct dcerpc_server_info *lpcfg_dcerpc_server_info(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+{
+	struct dcerpc_server_info *ret = talloc_zero(mem_ctx, struct dcerpc_server_info);
+
+	ret->domain_name = talloc_reference(mem_ctx, lpcfg_workgroup(lp_ctx));
+	ret->version_major = lpcfg_parm_int(lp_ctx, NULL, "server_info", "version_major", 5);
+	ret->version_minor = lpcfg_parm_int(lp_ctx, NULL, "server_info", "version_minor", 2);
+	ret->version_build = lpcfg_parm_int(lp_ctx, NULL, "server_info", "version_build", 3790);
+
+	return ret;
+}
+
diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build
index c684c05ca85..e3a863af497 100755
--- a/source4/rpc_server/wscript_build
+++ b/source4/rpc_server/wscript_build
@@ -3,15 +3,27 @@
 bld.SAMBA_SUBSYSTEM('DCERPC_SHARE',
 	source='common/server_info.c common/share_info.c',
 	autoproto='common/share.h',
-	deps='ldb'
+	deps='ldb',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 bld.SAMBA_SUBSYSTEM('DCERPC_COMMON',
-	source='common/forward.c common/reply.c dcesrv_auth.c',
+	source='common/forward.c common/reply.c dcesrv_auth.c common/loadparm.c',
 	autoproto='common/proto.h',
-	deps='ldb DCERPC_SHARE samba_server_gensec'
+	deps='ldb DCERPC_SHARE samba_server_gensec',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
+bld.SAMBA_LIBRARY('dcerpc_server',
+	source='dcerpc_server.c dcesrv_mgmt.c handles.c',
+	pc_files='dcerpc_server.pc',
+	deps='LIBCLI_AUTH ndr samba_server_gensec dcerpc_remote service',
+	public_deps='dcerpc',
+	autoproto='dcerpc_server_proto.h',
+	public_headers='dcerpc_server.h',
+	vnum='0.0.1',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
+	)
 
 bld.SAMBA_MODULE('dcerpc_rpcecho',
 	source='echo/rpc_echo.c',
@@ -144,15 +156,6 @@ bld.SAMBA_MODULE('dcerpc_dnsserver',
     deps='DCERPC_COMMON'
     )
 
-bld.SAMBA_LIBRARY('dcerpc_server',
-	source='dcerpc_server.c dcesrv_mgmt.c handles.c',
-	pc_files='dcerpc_server.pc',
-	deps='LIBCLI_AUTH ndr samba_server_gensec dcerpc_remote service',
-	public_deps='dcerpc',
-	autoproto='dcerpc_server_proto.h',
-	public_headers='dcerpc_server.h',
-	vnum='0.0.1'
-	)
 
 bld.SAMBA_MODULE('service_dcerpc',
 	source='service_rpc.c',
diff --git a/source4/scripting/bin/wscript_build b/source4/scripting/bin/wscript_build
index 459b917d01d..200562b1265 100644
--- a/source4/scripting/bin/wscript_build
+++ b/source4/scripting/bin/wscript_build
@@ -1,8 +1,7 @@
 #!/usr/bin/env python
 
-bld.SAMBA_SCRIPT('samba_dnsupdate', pattern='samba_dnsupdate', installdir='.')
-bld.SAMBA_SCRIPT('samba_spnupdate', pattern='samba_spnupdate', installdir='.')
-bld.SAMBA_SCRIPT('samba_kcc', pattern='samba_kcc', installdir='.')
-bld.SAMBA_SCRIPT('upgradeprovision', pattern='upgradeprovision', installdir='.')
+if bld.CONFIG_SET('AD_DC_BUILD_IS_ENABLED'):
+    for script in ['samba_dnsupdate', 'samba_spnupdate', 'samba_kcc', 'upgradeprovision', 'samba_upgradedns']:
+        bld.SAMBA_SCRIPT(script, pattern=script, installdir='.')
+
 bld.SAMBA_SCRIPT('samba-tool', pattern='samba-tool', installdir='.')
-bld.SAMBA_SCRIPT('samba_upgradedns', pattern='samba_upgradedns', installdir='.')
diff --git a/source4/scripting/wscript_build b/source4/scripting/wscript_build
index 1cd024160db..221f03086f4 100644
--- a/source4/scripting/wscript_build
+++ b/source4/scripting/wscript_build
@@ -2,12 +2,19 @@
 
 from samba_utils import MODE_755
 
-bld.INSTALL_FILES('${SBINDIR}',
-                  'bin/upgradeprovision bin/samba_dnsupdate bin/samba_spnupdate bin/samba_upgradedns',
-                  chmod=MODE_755, python_fixup=True, flat=True)
+sbin_files = None
+bin_files = 'bin/samba-tool'
+if bld.CONFIG_SET('AD_DC_BUILD_IS_ENABLED'):
+    sbin_files = 'bin/upgradeprovision bin/samba_dnsupdate bin/samba_spnupdate bin/samba_upgradedns'
+    bin_files = bin_files + ' bin/samba_kcc'
+
+if sbin_files:
+    bld.INSTALL_FILES('${SBINDIR}',
+                      'bin/upgradeprovision bin/samba_dnsupdate bin/samba_spnupdate bin/samba_upgradedns',
+                      chmod=MODE_755, python_fixup=True, flat=True)
 
 bld.INSTALL_FILES('${BINDIR}',
-                  'bin/samba-tool bin/samba_kcc',
+                  bin_files,
                   chmod=MODE_755, python_fixup=True, flat=True)
 
 bld.RECURSE('bin')
diff --git a/source4/smb_server/smb/wscript_build b/source4/smb_server/smb/wscript_build
index 5c717a36010..a17de06e637 100644
--- a/source4/smb_server/smb/wscript_build
+++ b/source4/smb_server/smb/wscript_build
@@ -4,6 +4,7 @@ bld.SAMBA_SUBSYSTEM('SMB_PROTOCOL',
 	source='receive.c negprot.c nttrans.c reply.c request.c search.c service.c sesssetup.c srvtime.c trans2.c signing.c',
 	autoproto='smb_proto.h',
 	deps='dfs_server_ad',
-	public_deps='ntvfs LIBPACKET samba-credentials samba_server_gensec'
+	public_deps='ntvfs LIBPACKET samba-credentials samba_server_gensec',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
diff --git a/source4/smb_server/smb2/wscript_build b/source4/smb_server/smb2/wscript_build
index fd140eb8e2d..18a2b29b9f0 100644
--- a/source4/smb_server/smb2/wscript_build
+++ b/source4/smb_server/smb2/wscript_build
@@ -3,6 +3,7 @@
 bld.SAMBA_SUBSYSTEM('SMB2_PROTOCOL',
 	source='receive.c negprot.c sesssetup.c tcon.c fileio.c fileinfo.c find.c keepalive.c',
 	autoproto='smb2_proto.h',
-	public_deps='ntvfs LIBPACKET LIBCLI_SMB2 samba_server_gensec NDR_DFSBLOBS'
+	public_deps='ntvfs LIBPACKET LIBCLI_SMB2 samba_server_gensec NDR_DFSBLOBS',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
diff --git a/source4/smb_server/wscript_build b/source4/smb_server/wscript_build
index 5bf004a76f2..bfeba0e468a 100644
--- a/source4/smb_server/wscript_build
+++ b/source4/smb_server/wscript_build
@@ -7,12 +7,14 @@ bld.SAMBA_MODULE('service_smb',
 	init_function='server_service_smb_init',
 	deps='SMB_SERVER netif shares samba-hostconfig',
 	internal_module=False,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 bld.SAMBA_SUBSYSTEM('SMB_SERVER',
 	source='handle.c tcon.c session.c blob.c management.c smb_server.c',
 	autoproto='smb_server_proto.h',
-	public_deps='share LIBPACKET SMB_PROTOCOL SMB2_PROTOCOL'
+	public_deps='share LIBPACKET SMB_PROTOCOL SMB2_PROTOCOL',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 bld.RECURSE('smb')
diff --git a/source4/smbd/wscript_build b/source4/smbd/wscript_build
index ab92e3c9209..97877fc54b0 100644
--- a/source4/smbd/wscript_build
+++ b/source4/smbd/wscript_build
@@ -4,7 +4,8 @@ bld.SAMBA_LIBRARY('service',
 	source='service.c service_stream.c service_named_pipe.c service_task.c',
 	autoproto='service_proto.h',
 	deps='tevent MESSAGING samba_socket RPC_NDR_IRPC NDR_NAMED_PIPE_AUTH npa_tstream gssapi samba-credentials LIBTSOCKET LIBSAMBA_TSOCKET process_model',
-	private_library=True
+	private_library=True,
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
 
@@ -14,6 +15,13 @@ bld.SAMBA_SUBSYSTEM('PIDFILE',
 	autoproto='pidfile.h'
 	)
 
+bld.SAMBA_LIBRARY('process_model',
+                  source='process_model.c',
+                  autoproto='process_model_proto.h',
+                  deps='samba-util samba-hostconfig samba-modules',
+                  private_library=True,
+                  enabled=bld.AD_DC_BUILD_IS_ENABLED()
+                  )
 
 bld.SAMBA_BINARY('samba',
 	source='server.c',
@@ -22,12 +30,10 @@ bld.SAMBA_BINARY('samba',
 	deps='''events process_model service samba-hostconfig samba-util POPT_SAMBA PIDFILE
                 popt gensec registry ntptr ntvfs share cluster COMMON_SCHANNEL SECRETS''',
 	pyembed=True,
-	install_path='${SBINDIR}'
+	install_path='${SBINDIR}',
+	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
 
-
-
-
 bld.SAMBA_MODULE('process_model_single',
                  source='process_single.c',
                  subsystem='process_model',
@@ -73,10 +79,3 @@ bld.SAMBA_MODULE('process_model_onefork',
                  )
 
 
-bld.SAMBA_LIBRARY('process_model',
-                  source='process_model.c',
-                  autoproto='process_model_proto.h',
-                  deps='samba-util samba-hostconfig samba-modules',
-                  private_library=True
-                  )
-
diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
index 0e70cab7706..75e94182478 100644
--- a/source4/torture/rpc/remote_pac.c
+++ b/source4/torture/rpc/remote_pac.c
@@ -437,6 +437,8 @@ static bool test_PACVerify_workstation_des(struct torture_context *tctx,
 	struct samr_SetUserInfo r;
 	union samr_UserInfo user_info;
 	struct dcerpc_pipe *samr_pipe = torture_join_samr_pipe(join_ctx);
+
+#ifdef AD_DC_BUILD_IS_ENABLED
 	struct smb_krb5_context *smb_krb5_context;
 	krb5_error_code ret;
 
@@ -448,6 +450,9 @@ static bool test_PACVerify_workstation_des(struct torture_context *tctx,
 					 "allow_weak_crypto", NULL) == FALSE) {
 		torture_skip(tctx, "Cannot test DES without [libdefaults] allow_weak_crypto = yes");
 	}
+#else
+	torture_skip(tctx, "Skipping DES test in non-AD DC build");
+#endif
 
 	/* Mark this workstation with DES-only */
 	user_info.info16.acct_flags = ACB_USE_DES_KEY_ONLY | ACB_WSTRUST;
diff --git a/source4/torture/rpc/rpc.c b/source4/torture/rpc/rpc.c
index f33ba792e20..37ff085ed96 100644
--- a/source4/torture/rpc/rpc.c
+++ b/source4/torture/rpc/rpc.c
@@ -478,8 +478,10 @@ NTSTATUS torture_rpc_init(void)
 	torture_suite_add_suite(suite, torture_rpc_object_uuid(suite));
 	torture_suite_add_suite(suite, torture_rpc_winreg(suite));
 	torture_suite_add_suite(suite, torture_rpc_spoolss(suite));
+#ifdef AD_DC_BUILD_IS_ENABLED
 	torture_suite_add_suite(suite, torture_rpc_spoolss_notify(suite));
 	torture_suite_add_suite(suite, torture_rpc_spoolss_win(suite));
+#endif
 	torture_suite_add_suite(suite, torture_rpc_spoolss_driver(suite));
 	torture_suite_add_suite(suite, torture_rpc_spoolss_access(suite));
 	torture_suite_add_simple_test(suite, "samr", torture_rpc_samr);
diff --git a/source4/torture/wscript_build b/source4/torture/wscript_build
index c59c2eafb70..c0f003dec53 100755
--- a/source4/torture/wscript_build
+++ b/source4/torture/wscript_build
@@ -37,7 +37,8 @@ heimdal_specific['ndr'] = ('','')
 heimdal_specific['rpc'] = ('','')
 if bld.CONFIG_SET('SAMBA4_USES_HEIMDAL'):
 	heimdal_specific['ndr'] = (' ndr/backupkey.c','')
-	heimdal_specific['rpc'] = (' rpc/backupkey.c',' RPC_NDR_BACKUPKEY')
+	heimdal_specific['rpc'] = (' rpc/backupkey.c rpc/spoolss_notify.c rpc/spoolss_win.c',
+				    ' RPC_NDR_BACKUPKEY SMB_SERVER dcerpc_server ntvfs')
 
 bld.SAMBA_SUBSYSTEM('TORTURE_NDR',
 	source='ndr/ndr.c ndr/winreg.c ndr/atsvc.c ndr/lsa.c ndr/epmap.c ndr/dfs.c ndr/netlogon.c ndr/drsuapi.c ndr/spoolss.c ndr/samr.c ndr/dfsblob.c ndr/drsblobs.c ndr/nbt.c ndr/ntlmssp.c ndr/string.c'+heimdal_specific['ndr'][0],
@@ -47,11 +48,11 @@ bld.SAMBA_SUBSYSTEM('TORTURE_NDR',
 
 
 bld.SAMBA_MODULE('torture_rpc',
-	source='rpc/join.c rpc/lsa.c rpc/forest_trust.c rpc/lsa_lookup.c rpc/session_key.c rpc/echo.c rpc/dfs.c rpc/drsuapi.c rpc/drsuapi_cracknames.c rpc/dsgetinfo.c rpc/spoolss.c rpc/spoolss_notify.c rpc/spoolss_win.c rpc/spoolss_access.c rpc/unixinfo.c rpc/samr.c rpc/samr_accessmask.c rpc/samr_priv.c rpc/wkssvc.c rpc/srvsvc.c rpc/svcctl.c rpc/atsvc.c rpc/eventlog.c rpc/epmapper.c rpc/winreg.c rpc/initshutdown.c rpc/oxidresolve.c rpc/remact.c rpc/mgmt.c rpc/scanner.c rpc/autoidl.c rpc/countcalls.c rpc/testjoin.c rpc/schannel.c rpc/netlogon.c rpc/remote_pac.c rpc/samlogon.c rpc/samsync.c rpc/multi_bind.c rpc/dssetup.c rpc/alter_context.c rpc/bench.c rpc/samba3rpc.c rpc/rpc.c rpc/async_bind.c rpc/handles.c rpc/frsapi.c rpc/object_uuid.c rpc/ntsvcs.c rpc/browser.c rpc/bind.c '+heimdal_specific['rpc'][0],
+	source='rpc/join.c rpc/lsa.c rpc/forest_trust.c rpc/lsa_lookup.c rpc/session_key.c rpc/echo.c rpc/dfs.c rpc/drsuapi.c rpc/drsuapi_cracknames.c rpc/dsgetinfo.c rpc/spoolss.c rpc/spoolss_access.c rpc/unixinfo.c rpc/samr.c rpc/samr_accessmask.c rpc/samr_priv.c rpc/wkssvc.c rpc/srvsvc.c rpc/svcctl.c rpc/atsvc.c rpc/eventlog.c rpc/epmapper.c rpc/winreg.c rpc/initshutdown.c rpc/oxidresolve.c rpc/remact.c rpc/mgmt.c rpc/scanner.c rpc/autoidl.c rpc/countcalls.c rpc/testjoin.c rpc/schannel.c rpc/netlogon.c rpc/remote_pac.c rpc/samlogon.c rpc/samsync.c rpc/multi_bind.c rpc/dssetup.c rpc/alter_context.c rpc/bench.c rpc/samba3rpc.c rpc/rpc.c rpc/async_bind.c rpc/handles.c rpc/frsapi.c rpc/object_uuid.c rpc/ntsvcs.c rpc/browser.c rpc/bind.c '+heimdal_specific['rpc'][0],
 	autoproto='rpc/proto.h',
 	subsystem='smbtorture',
 	init_function='torture_rpc_init',
-	deps='ndr-table RPC_NDR_UNIXINFO dcerpc-samr RPC_NDR_WINREG RPC_NDR_INITSHUTDOWN RPC_NDR_OXIDRESOLVER RPC_NDR_EVENTLOG RPC_NDR_ECHO RPC_NDR_SVCCTL RPC_NDR_NETLOGON dcerpc-atsvc RPC_NDR_DRSUAPI RPC_NDR_LSA RPC_NDR_EPMAPPER RPC_NDR_DFS RPC_NDR_FRSAPI RPC_NDR_SPOOLSS RPC_NDR_SRVSVC RPC_NDR_WKSSVC RPC_NDR_ROT RPC_NDR_DSSETUP RPC_NDR_REMACT RPC_NDR_OXIDRESOLVER RPC_NDR_NTSVCS WB_HELPER samba-net LIBCLI_AUTH POPT_CREDENTIALS TORTURE_LDAP TORTURE_UTIL TORTURE_RAP dcerpc_server service process_model ntvfs RPC_NDR_BROWSER LIBCLI_DRSUAPI TORTURE_DFS SMB_SERVER'+heimdal_specific['rpc'][1],
+	deps='ndr-table RPC_NDR_UNIXINFO dcerpc-samr RPC_NDR_WINREG RPC_NDR_INITSHUTDOWN RPC_NDR_OXIDRESOLVER RPC_NDR_EVENTLOG RPC_NDR_ECHO RPC_NDR_SVCCTL RPC_NDR_NETLOGON dcerpc-atsvc RPC_NDR_DRSUAPI RPC_NDR_LSA RPC_NDR_EPMAPPER RPC_NDR_DFS RPC_NDR_FRSAPI RPC_NDR_SPOOLSS RPC_NDR_SRVSVC RPC_NDR_WKSSVC RPC_NDR_ROT RPC_NDR_DSSETUP RPC_NDR_REMACT RPC_NDR_OXIDRESOLVER RPC_NDR_NTSVCS WB_HELPER samba-net LIBCLI_AUTH POPT_CREDENTIALS TORTURE_LDAP TORTURE_UTIL TORTURE_RAP service process_model RPC_NDR_BROWSER LIBCLI_DRSUAPI TORTURE_DFS'+heimdal_specific['rpc'][1],
 	internal_module=True
 	)
 
diff --git a/source4/web_server/wscript_build b/source4/web_server/wscript_build
index bf7e86b309b..b845067d994 100644
--- a/source4/web_server/wscript_build
+++ b/source4/web_server/wscript_build
@@ -5,6 +5,7 @@ bld.SAMBA_SUBSYSTEM('WEB_WSGI',
 		source='wsgi.c',
 		pyext=True,
 		deps='talloc LIBTSOCKET',
+		enabled=bld.AD_DC_BUILD_IS_ENABLED()
 		)
 
 
@@ -15,4 +16,5 @@ bld.SAMBA_MODULE('service_web',
 		deps='LIBTLS process_model LIBPYTHON WEB_WSGI',
 		pyembed=True,
 		internal_module=False,
+		enabled=bld.AD_DC_BUILD_IS_ENABLED()
 		)
diff --git a/wscript b/wscript
index 15ac7f57c7c..26a5c8611ce 100755
--- a/wscript
+++ b/wscript
@@ -32,6 +32,14 @@ def set_options(opt):
     opt.RECURSE('source3')
     opt.RECURSE('lib/util')
 
+    opt.add_option('--with-system-mitkrb5',
+                   help='enable system MIT krb5 build (includes Samba 4 client and Samba 3 code base)',
+                   action='store_true', dest='with_system_mitkrb5', default=False)
+
+    opt.add_option('--without-ad-dc',
+                   help='disable AD DC functionality (enables Samba 4 client and Samba 3 code base). Requires system MIT krb5',
+                   action='store_true', dest='with_system_mitkrb5', default=False)
+
     gr = opt.option_group('developer options')
     gr.add_option('--enable-build-farm',
                    help='enable special build farm options',
@@ -84,8 +92,11 @@ def configure(conf):
 
     conf.RECURSE('dynconfig')
     conf.RECURSE('lib/ldb')
-    if Options.options.with_mit_krb5_checks:
-        conf.PROCESS_SEPARATE_RULE('krb5')
+
+    if Options.options.with_system_mitkrb5:
+        conf.PROCESS_SEPARATE_RULE('system_mitkrb5')
+    else:
+        conf.DEFINE('AD_DC_BUILD_IS_ENABLED', 1)
     # Only process heimdal_build for non-MIT KRB5 builds
     # When MIT KRB5 checks are done as above, conf.env.KRB5_VENDOR will be set
     # to the lowcased output of 'krb5-config --vendor'.
diff --git a/wscript_build b/wscript_build
index ddec5798a56..f136ac15a1b 100755
--- a/wscript_build
+++ b/wscript_build
@@ -124,7 +124,8 @@ else:
 
 bld.RECURSE('libcli/smbreadline')
 bld.RECURSE('codepages')
-bld.RECURSE('source4/setup')
+if bld.AD_DC_BUILD_IS_ENABLED():
+    bld.RECURSE('source4/setup')
 bld.RECURSE('source4/scripting')
 bld.RECURSE('pidl')
 bld.RECURSE('lib')
diff --git a/wscript_configure_krb5 b/wscript_configure_system_mitkrb5
index ba7ecf3c16b..7523103556b 100644
--- a/wscript_configure_krb5
+++ b/wscript_configure_system_mitkrb5
@@ -3,24 +3,40 @@ import Logs, Options
 # Check for kerberos
 have_gssapi=False
 
-conf.check_cfg(args="--cflags --libs", package="com_err", uselib_store="com_err")
-conf.CHECK_FUNCS_IN('_et_list', 'com_err')
-conf.CHECK_HEADERS('com_err.h', lib='com_err')
+def krb5_define_syslib(conf, lib, deps):
+    found = 'FOUND_SYSTEMLIB_' + lib
+    if found in conf.env:
+        return
+    conf.SET_TARGET_TYPE(lib, 'SYSLIB')
+    conf.SET_SYSLIB_DEPS(lib, deps)
+    conf.env[found] = True
 
 Logs.info("Looking for kerberos features")
 conf.find_program('krb5-config.heimdal', var='HEIMDAL_KRB5_CONFIG')
 conf.find_program('krb5-config', var='KRB5_CONFIG')
 if conf.env.KRB5_CONFIG:
     conf.check_cfg(path="krb5-config", args="--cflags --libs",
-               package="gssapi", uselib_store="KRB5")
+               package="", uselib_store="KRB5")
+    krb5_define_syslib(conf, "krb5", conf.env['LIB_KRB5'])
+    for lib in conf.env['LIB_KRB5']:
+        krb5_define_syslib(conf, lib, lib)
+
+    conf.check_cfg(path="krb5-config", args="--cflags --libs",
+               package="gssapi", uselib_store="GSSAPI")
+    krb5_define_syslib(conf, "gssapi", conf.env['LIB_GSSAPI'])
+
     vendor = conf.cmd_and_log("%(path)s --vendor" % dict(path=conf.env.KRB5_CONFIG), dict())
     conf.env.KRB5_VENDOR = vendor.strip().lower()
     if conf.env.KRB5_VENDOR != 'heimdal':
         conf.define('USING_SYSTEM_KRB5', 1)
         del conf.env.HEIMDAL_KRB5_CONFIG
 
+conf.check_cfg(args="--cflags --libs", package="com_err", uselib_store="com_err")
+conf.CHECK_FUNCS_IN('_et_list', 'com_err')
+conf.CHECK_HEADERS('com_err.h', lib='com_err')
+
 conf.CHECK_HEADERS('krb5.h krb5/locate_plugin.h', lib='krb5')
-conf.CHECK_HEADERS('gssapi.h gssapi/gssapi_generic.h gssapi/gssapi.h gssapi/gssapi_ext.h gssapi/gssapi_krb5.h', lib='krb5')
+conf.CHECK_HEADERS('gssapi.h gssapi/gssapi_generic.h gssapi/gssapi.h gssapi/gssapi_ext.h gssapi/gssapi_krb5.h', lib='gssapi')
 
 conf.CHECK_FUNCS_IN('krb5_encrypt_data', 'k5crypto')
 conf.CHECK_FUNCS_IN('des_set_key','crypto')