diff --git a/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c b/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c
index a3dcf08..2d7e042 100644
--- a/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c
+++ b/daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c
@@ -74,8 +74,8 @@ static char *ipaenrollment_name_list[] = {
 
 static void *ipaenrollment_plugin_id;
 
-static char *realm;
-static const char *ipa_realm_dn;
+static char *realm = NULL;
+static char *ipa_realm_dn = NULL;
 
 static int
 ipaenrollement_secure(Slapi_PBlock *pb, char **errMesg)
@@ -428,6 +428,15 @@ done:
     return ret;
 }
 
+static int
+ipaenrollment_close(Slapi_PBlock *pb)
+{
+    slapi_ch_free_string(&realm);
+    slapi_ch_free_string(&ipa_realm_dn);
+
+    return 0;
+}
+
 int
 ipaenrollment_init(Slapi_PBlock *pb)
 {
@@ -451,6 +460,7 @@ ipaenrollment_init(Slapi_PBlock *pb)
        plug-in function. */
     ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01);
     if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN, (void *)ipaenrollment_start);
+    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN, (void *)ipaenrollment_close);
     if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&pdesc);
     if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_OIDLIST, ipaenrollment_oid_list);
     if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_NAMELIST, ipaenrollment_name_list);
diff --git a/daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_extop.c b/daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_extop.c
index 708d0e4..725966f 100644
--- a/daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_extop.c
+++ b/daemons/ipa-slapi-plugins/ipa-extdom-extop/ipa_extdom_extop.c
@@ -206,6 +206,7 @@ static int ipa_extdom_init_ctx(Slapi_PBlock *pb, struct ipa_extdom_ctx **_ctx)
 
 done:
     if (ret) {
+       slapi_ch_free_string(ctx->base_dn);
         free(ctx);
     } else {
         *_ctx = ctx;
@@ -213,6 +214,19 @@ done:
     return ret;
 }
 
+/* plugin close function - free what we allocated */
+static int ipa_extdom_close(Slapi_PBlock *pb)
+{
+    struct ipa_extdom_ctx *extdom_ctx;
+
+    if (slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &extdom_ctx) == 0 &&
+        extdom_ctx) {
+       slapi_ch_free_string(extdom_ctx->base_dn);
+       free(extdom_ctx);
+    }
+    return 0;
+}
+
 int ipa_extdom_init(Slapi_PBlock *pb)
 {
     int ret;
@@ -235,6 +249,10 @@ int ipa_extdom_init(Slapi_PBlock *pb)
                                (void *)ipa_extdom_start);
     }
     if (!ret) {
+        ret = slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN,
+                               (void *)ipa_extdom_close);
+    }
+    if (!ret) {
         ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_OIDLIST,
                                ipa_extdom_oid_list);
     }
diff --git a/daemons/ipa-slapi-plugins/ipa-lockout/ipa_lockout.c b/daemons/ipa-slapi-plugins/ipa-lockout/ipa_lockout.c
index a8095cc..126b536 100644
--- a/daemons/ipa-slapi-plugins/ipa-lockout/ipa_lockout.c
+++ b/daemons/ipa-slapi-plugins/ipa-lockout/ipa_lockout.c
@@ -409,6 +409,8 @@ ipalockout_close(Slapi_PBlock * pb)
     LOG_TRACE( "--in-->\n");
 
     slapi_ch_free_string(&ipa_global_policy);
+    free(global_ipactx);
+    g_plugin_started = 0;
 
     LOG_TRACE("<--out--\n");
 
diff --git a/daemons/ipa-slapi-plugins/ipa-modrdn/ipa_modrdn.c b/daemons/ipa-slapi-plugins/ipa-modrdn/ipa_modrdn.c
index 6cec5f2..3412579 100644
--- a/daemons/ipa-slapi-plugins/ipa-modrdn/ipa_modrdn.c
+++ b/daemons/ipa-slapi-plugins/ipa-modrdn/ipa_modrdn.c
@@ -327,8 +327,8 @@ ipamodrdn_close(Slapi_PBlock * pb)
     LOG_TRACE( "--in-->\n");
 
     ipamodrdn_delete_config();
-
     slapi_ch_free((void **)&ipamodrdn_global_config);
+    g_plugin_started = 0;
 
     LOG_TRACE("<--out--\n");
 
diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
index 09c877f..5ce3a96 100644
--- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
+++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
@@ -72,12 +72,12 @@
 
 
 /* base DN of IPA realm tree */
-const char *ipa_realm_tree;
+char *ipa_realm_tree = NULL;
 /* dn of Kerberos realm entry */
-const char *ipa_realm_dn;
-const char *ipa_pwd_config_dn;
-const char *ipa_etc_config_dn;
-const char *ipa_changepw_principal_dn;
+char *ipa_realm_dn = NULL;
+char *ipa_pwd_config_dn = NULL;
+char *ipa_etc_config_dn = NULL;
+char *ipa_changepw_principal_dn = NULL;
 
 Slapi_PluginDesc ipapwd_plugin_desc = {
     IPAPWD_FEATURE_DESC,
@@ -1876,6 +1876,18 @@ done:
     return ret;
 }
 
+static int ipapwd_close( Slapi_PBlock *pb )
+{
+    slapi_ch_free_string(&ipa_realm_tree);
+    slapi_ch_free_string(&ipa_realm_dn);
+    slapi_ch_free_string(&ipa_pwd_config_dn);
+    slapi_ch_free_string(&ipa_etc_config_dn);
+    slapi_ch_free_string(&ipa_changepw_principal_dn);
+    otp_config_fini(&otp_config);
+
+    return 0;
+}
+
 static char *ipapwd_oid_list[] = {
        EXOP_PASSWD_OID,
        KEYTAB_SET_OID,
@@ -1924,6 +1936,7 @@ int ipapwd_init( Slapi_PBlock *pb )
      * plug-in */
     ret = slapi_pblock_set(pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_03);
     if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN, (void *)ipapwd_start);
+    if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN, (void *)ipapwd_close);
     if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&ipapwd_plugin_desc);
     if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_OIDLIST, ipapwd_oid_list);
     if (!ret) ret = slapi_pblock_set(pb, SLAPI_PLUGIN_EXT_OP_NAMELIST, ipapwd_name_list);
diff --git a/daemons/ipa-slapi-plugins/ipa-range-check/ipa_range_check.c b/daemons/ipa-slapi-plugins/ipa-range-check/ipa_range_check.c
index 5b53a2f..ce62f58 100644
--- a/daemons/ipa-slapi-plugins/ipa-range-check/ipa_range_check.c
+++ b/daemons/ipa-slapi-plugins/ipa-range-check/ipa_range_check.c
@@ -469,6 +469,12 @@ static int ipa_range_check_start(Slapi_PBlock *pb)
 
 static int ipa_range_check_close(Slapi_PBlock *pb)
 {
+    struct ipa_range_check_ctx *ctx = NULL;
+
+    if (slapi_pblock_get(pb, SLAPI_PLUGIN_PRIVATE, &ctx) == 0 && ctx) {
+        slapi_ch_free_string(&ctx->base_dn);
+        free(ctx);
+    }
     return 0;
 }
 
@@ -752,6 +758,7 @@ static int ipa_range_check_init_ctx(Slapi_PBlock *pb,
 
 done:
     if (ret != 0) {
+        slapi_ch_free_string(&ctx->base_dn);
         free(ctx);
     } else {
         *_ctx = ctx;
diff --git a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c
index 9e474e8..5b77bc7 100644
--- a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c
+++ b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_task.c
@@ -319,7 +319,16 @@ static int sigden_task_start(Slapi_PBlock *pb)
 {
     int ret = 0;
 
-    ret = slapi_task_register_handler("ipa-sidgen-task", sidgen_task_add);
+    ret = slapi_plugin_task_register_handler("ipa-sidgen-task", sidgen_task_add, pb);
+
+    return ret;
+}
+
+static int sigden_task_close(Slapi_PBlock *pb)
+{
+    int ret = 0;
+
+    ret = slapi_plugin_task_unregister_handler("ipa-sidgen-task", sidgen_task_add);
 
     return ret;
 }
@@ -342,6 +351,9 @@ int sidgen_task_init(Slapi_PBlock *pb)
     ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_START_FN,
                             (void *) sigden_task_start);
 
+    ret |= slapi_pblock_set(pb, SLAPI_PLUGIN_CLOSE_FN,
+                                (void *) sigden_task_close);
+
 done:
     if (ret != 0) {
         LOG_FATAL("Failed to initialize plug-in\n" );
diff --git a/daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c b/daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c
index ffade14..7b83e2e 100644
--- a/daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c
+++ b/daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c
@@ -380,8 +380,8 @@ ipauuid_close(Slapi_PBlock * pb)
     LOG_TRACE( "--in-->\n");
 
     ipauuid_delete_config();
-
     slapi_ch_free((void **)&ipauuid_global_config);
+    g_plugin_started = 0;
 
     LOG_TRACE("<--out--\n");
 
@@ -1137,8 +1137,7 @@ static int ipauuid_pre_op(Slapi_PBlock *pb, int modtype)
                     slapi_entry_set_sdn(e, sdn);
 
                     /* reset the target DN since we've changed it. */
-                    if (slapi_pblock_set(pb, SLAPI_ADD_TARGET,
-                                             (char*)slapi_sdn_get_ndn(slapi_entry_get_sdn_const(e)))) {
+                    if ( slapi_pblock_set(pb, SLAPI_ADD_TARGET_SDN, slapi_entry_get_sdn_const(e)) ) {
                         LOG_FATAL("slapi_block_set failed!\n");
                         ret = LDAP_OPERATIONS_ERROR;
                         slapi_rdn_free(&rdn);
diff --git a/daemons/ipa-slapi-plugins/libotp/otp_config.c b/daemons/ipa-slapi-plugins/libotp/otp_config.c
index 685b2d9..7a38293 100644
--- a/daemons/ipa-slapi-plugins/libotp/otp_config.c
+++ b/daemons/ipa-slapi-plugins/libotp/otp_config.c
@@ -183,6 +183,10 @@ static uint32_t find_value(const struct otp_config *cfg,
 static void update(const struct otp_config *cfg, Slapi_DN *src,
                    Slapi_Entry *entry)
 {
+    if (!cfg) {
+        return;
+    }
+
     Slapi_DN *dst = entry == NULL ? NULL : slapi_entry_get_sdn(entry);
 
     for (struct record *rec = cfg->records; rec != NULL; rec = rec->next) {


