static NTSTATUS dcesrv_lsa_OpenAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
				struct lsa_OpenAccount *r)
{
	struct dcesrv_handle *h, *ah;
	struct lsa_policy_state *state;
	struct lsa_account_state *astate;

	ZERO_STRUCTP(r->out.acct_handle);

	DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);

	state = h->data;

	astate = talloc(dce_call->conn, struct lsa_account_state);
	if (astate == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	astate->account_sid = dom_sid_dup(astate, r->in.sid);
	if (astate->account_sid == NULL) {
		talloc_free(astate);
		return NT_STATUS_NO_MEMORY;
	}

	astate->policy = talloc_reference(astate, state);
	astate->access_mask = r->in.access_mask;

	/*
	 * For now we grant all requested access.
	 *
	 * We will fail at the ldb layer later.
	 */
	if (astate->access_mask & SEC_FLAG_MAXIMUM_ALLOWED) {
		astate->access_mask &= ~SEC_FLAG_MAXIMUM_ALLOWED;
		astate->access_mask |= LSA_ACCOUNT_ALL_ACCESS;
	}
	se_map_generic(&astate->access_mask, &dcesrv_lsa_account_mapping);

	DEBUG(10,("%s: %s access desired[0x%08X] granted[0x%08X] - success.\n",
		  __func__, dom_sid_string(mem_ctx, astate->account_sid),
		 (unsigned)r->in.access_mask,
		 (unsigned)astate->access_mask));

	ah = dcesrv_handle_create(dce_call, LSA_HANDLE_ACCOUNT);
	if (!ah) {
		talloc_free(astate);
		return NT_STATUS_NO_MEMORY;
	}

	ah->data = talloc_steal(ah, astate);

	*r->out.acct_handle = ah->wire_handle;

	return NT_STATUS_OK;
}
static NTSTATUS dcesrv_lsa_OpenAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
				struct lsa_OpenAccount *r)
{
	struct dcesrv_handle *h, *ah;
	struct lsa_policy_state *state;
	struct lsa_account_state *astate;

	ZERO_STRUCTP(r->out.acct_handle);

	DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);

	state = h->data;

	astate = talloc(dce_call->conn, struct lsa_account_state);
	if (astate == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	astate->account_sid = dom_sid_dup(astate, r->in.sid);
	if (astate->account_sid == NULL) {
		talloc_free(astate);
		return NT_STATUS_NO_MEMORY;
	}

	astate->policy = talloc_reference(astate, state);
	astate->access_mask = r->in.access_mask;

	 
	if (astate->access_mask & SEC_FLAG_MAXIMUM_ALLOWED) {
		astate->access_mask &= ~SEC_FLAG_MAXIMUM_ALLOWED;
		astate->access_mask |= LSA_ACCOUNT_ALL_ACCESS;
	}
	se_map_generic(&astate->access_mask, &dcesrv_lsa_account_mapping);

	DEBUG(10,("%s: %s access desired[0x%08X] granted[0x%08X] - success.\n",
		  __func__, dom_sid_string(mem_ctx, astate->account_sid),
		 (unsigned)r->in.access_mask,
		 (unsigned)astate->access_mask));

	ah = dcesrv_handle_create(dce_call, LSA_HANDLE_ACCOUNT);
	if (!ah) {
		talloc_free(astate);
		return NT_STATUS_NO_MEMORY;
	}

	ah->data = talloc_steal(ah, astate);

	*r->out.acct_handle = ah->wire_handle;

	return NT_STATUS_OK;
}