static int samldb_pwd_last_set_change(struct samldb_ctx *ac)
{
	struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
	NTTIME last_set = 0;
	struct ldb_message_element *el = NULL;
	struct ldb_message *tmp_msg = NULL;
	struct dom_sid *self_sid = NULL;
	int ret;
	struct ldb_result *res = NULL;
	const char * const attrs[] = {
		"objectSid",
		NULL
	};

	ret = dsdb_get_expected_new_values(ac,
					   ac->msg,
					   "pwdLastSet",
					   &el,
					   ac->req->operation);
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	if (el == NULL || el->num_values == 0) {
		ldb_asprintf_errstring(ldb,
			"%08X: samldb: 'pwdLastSet' can't be deleted!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}

	/* Create a temporary message for fetching the "userAccountControl" */
	tmp_msg = ldb_msg_new(ac->msg);
	if (tmp_msg == NULL) {
		return ldb_module_oom(ac->module);
	}
	ret = ldb_msg_add(tmp_msg, el, 0);
	if (ret != LDB_SUCCESS) {
		return ret;
	}
	last_set = samdb_result_nttime(tmp_msg, "pwdLastSet", 0);
	talloc_free(tmp_msg);

	/*
	 * Setting -1 (0xFFFFFFFFFFFFFFFF) requires the Unexpire-Password right
	 */
	if (last_set != UINT64_MAX) {
		return LDB_SUCCESS;
	}

	/* Fetch the "objectSid" */
	ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
				    DSDB_FLAG_NEXT_MODULE, ac->req);
	if (ret != LDB_SUCCESS) {
		return ret;
	}
	self_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
	if (self_sid == NULL) {
		return ldb_module_operr(ac->module);
	}

	ret = samldb_check_pwd_last_set_acl(ac, self_sid);
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	return LDB_SUCCESS;
}
static int samldb_pwd_last_set_change(struct samldb_ctx *ac)
{
	struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
	NTTIME last_set = 0;
	struct ldb_message_element *el = NULL;
	struct ldb_message *tmp_msg = NULL;
	struct dom_sid *self_sid = NULL;
	int ret;
	struct ldb_result *res = NULL;
	const char * const attrs[] = {
		"objectSid",
		NULL
	};

	ret = dsdb_get_expected_new_values(ac,
					   ac->msg,
					   "pwdLastSet",
					   &el,
					   ac->req->operation);
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	if (el == NULL || el->num_values == 0) {
		ldb_asprintf_errstring(ldb,
			"%08X: samldb: 'pwdLastSet' can't be deleted!",
			W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}

	 
	tmp_msg = ldb_msg_new(ac->msg);
	if (tmp_msg == NULL) {
		return ldb_module_oom(ac->module);
	}
	ret = ldb_msg_add(tmp_msg, el, 0);
	if (ret != LDB_SUCCESS) {
		return ret;
	}
	last_set = samdb_result_nttime(tmp_msg, "pwdLastSet", 0);
	talloc_free(tmp_msg);

	 
	if (last_set != UINT64_MAX) {
		return LDB_SUCCESS;
	}

	 
	ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
				    DSDB_FLAG_NEXT_MODULE, ac->req);
	if (ret != LDB_SUCCESS) {
		return ret;
	}
	self_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
	if (self_sid == NULL) {
		return ldb_module_operr(ac->module);
	}

	ret = samldb_check_pwd_last_set_acl(ac, self_sid);
	if (ret != LDB_SUCCESS) {
		return ret;
	}

	return LDB_SUCCESS;
}