diff --git a/packages/NTMakefile b/packages/NTMakefile
index 68fd8c0d8..5d1949851 100644
--- a/packages/NTMakefile
+++ b/packages/NTMakefile
@@ -1,20 +1,20 @@
 ########################################################################
 #
-# Copyright (c) 2009, Secure Endpoints Inc.
+# Copyright (c) 2010, Secure Endpoints Inc.
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
 # are met:
-# 
+#
 # - Redistributions of source code must retain the above copyright
 #   notice, this list of conditions and the following disclaimer.
-# 
+#
 # - Redistributions in binary form must reproduce the above copyright
 #   notice, this list of conditions and the following disclaimer in
 #   the documentation and/or other materials provided with the
 #   distribution.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
@@ -27,9 +27,10 @@
 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
 # ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 # POSSIBILITY OF SUCH DAMAGE.
-# 
+#
 
-RELDIR=packages 
+RELDIR=packages
+SUBDIRS=windows
 
-!include ../windows/NTMakefile.w32 
+!include ../windows/NTMakefile.w32
 
diff --git a/packages/windows/NTMakefile b/packages/windows/NTMakefile
new file mode 100644
index 000000000..d4ed8d2d5
--- /dev/null
+++ b/packages/windows/NTMakefile
@@ -0,0 +1,36 @@
+########################################################################
+#
+# Copyright (c) 2009, Secure Endpoints Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# - Redistributions of source code must retain the above copyright
+#   notice, this list of conditions and the following disclaimer.
+#
+# - Redistributions in binary form must reproduce the above copyright
+#   notice, this list of conditions and the following disclaimer in
+#   the documentation and/or other materials provided with the
+#   distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+#
+
+RELDIR=packages\windows
+SUBDIRS=assembly
+
+!include ../../windows/NTMakefile.w32
+
diff --git a/packages/windows/assembly/Heimdal.GSSAPI.manifest.in b/packages/windows/assembly/Heimdal.GSSAPI.manifest.in
new file mode 100644
index 000000000..dc024b60e
--- /dev/null
+++ b/packages/windows/assembly/Heimdal.GSSAPI.manifest.in
@@ -0,0 +1,16 @@
+<?xml version="1" encoding="UTF-8" standalone="yes" ?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1">
+  <assemblyIdentity type="win32" name="@name@"
+		    processorArchitecture="@cpu@"
+		    version="@version@"
+		    publicKeyToken="@pkt@" />
+  <file name="libgssapi.dll" />
+  <dependency>
+    <dependentAssembly>
+      <assemblyIdentity type="win32" name="@krbname@"
+			processorArchitecture="@cpu@"
+			version="@krbversion@"
+			publickeytoken="@pkt@" />
+    </dependentAssembly>
+  </dependency>
+</assembly>
diff --git a/packages/windows/assembly/Heimdal.Kerberos.manifest.in b/packages/windows/assembly/Heimdal.Kerberos.manifest.in
new file mode 100644
index 000000000..83466a2fd
--- /dev/null
+++ b/packages/windows/assembly/Heimdal.Kerberos.manifest.in
@@ -0,0 +1,9 @@
+<?xml version="1" encoding="UTF-8" standalone="yes" ?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1">
+  <assemblyIdentity type="win32" name="@name@"
+		    processorArchitecture="@cpu@"
+		    version="@version@"
+		    publicKeyToken="@pkt@" />
+  <file name="heimdal.dll" />
+  <file name="com_err.dll" />
+</assembly>
diff --git a/packages/windows/assembly/NTMakefile b/packages/windows/assembly/NTMakefile
new file mode 100644
index 000000000..6314438e5
--- /dev/null
+++ b/packages/windows/assembly/NTMakefile
@@ -0,0 +1,150 @@
+########################################################################
+#
+# Copyright (c) 2010, Secure Endpoints Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# - Redistributions of source code must retain the above copyright
+#   notice, this list of conditions and the following disclaimer.
+#
+# - Redistributions in binary form must reproduce the above copyright
+#   notice, this list of conditions and the following disclaimer in
+#   the documentation and/or other materials provided with the
+#   distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+#
+
+RELDIR=packages\windows\assembly
+
+!include ../../../windows/NTMakefile.w32
+
+# CODESIGN_PKT should be set to the public key token of the code
+# signing certificate in use.  You can use :
+#
+# pktextract <path to certificate>
+#
+# ..to derive the public key token.
+#
+!ifndef CODESIGN_PKT
+!  error CODESIGN_PKT should be set to the public key token for codesigning certificate
+!endif
+
+prep:: mk-asm-dirs
+
+# ----------------------------------------------------------------------
+# Heimdal.Kerberos Assembly
+
+ASMKRBDIR=$(ASMDIR)\Heimdal.Kerberos
+ASMKRBVER=$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR).$(VER_PRODUCT_AUX).$(VER_PRODUCT_PATCH)
+ASMKRBMAN=$(ASMKRBNAME).manifest
+
+ASMKRBBINS=$(ASMKRBDIR)\heimdal.dll $(ASMKRBDIR)\com_err.dll
+
+$(ASMKRBDIR)\$(ASMKRBMAN).nohash: Heimdal.Kerberos.manifest.in
+	$(SED)  -e "s,[@]name[@],$(ASMKRBNAME),g" \
+		-e "s,[@]cpu[@],$(MCPU),g" \
+		-e "s,[@]version[@],$(ASMKRBVER),g" \
+		-e "s,[@]pkt[@],$(CODESIGN_PKT),g" < $** > $@
+
+$(ASMKRBDIR)\$(ASMKRBMAN) $(ASMKRBDIR)\$(ASMKRBMAN).cdf: \
+		$(ASMKRBDIR)\$(ASMKRBMAN).nohash $(ASMKRBBINS)
+	$(MT) -manifest $(ASMKRBDIR)\$(ASMKRBMAN).nohash -out:$@ -hashupdate -makecdfs
+
+$(ASMKRBDIR)\$(ASMKRBNAME).cat: $(ASMKRBDIR)\$(ASMKRBMAN).cdf
+	cd $(ASMKRBDIR)
+	$(MAKECAT) $**
+	$(_CODESIGN)
+#	$(RM) $(ASMKRBMAN).cdf
+#	$(RM) $(ASMKRBMAN).nohash
+	cd $(SRCDIR)
+
+asm-krb: \
+	$(ASMKRBBINS) \
+	$(ASMKRBDIR)\$(ASMKRBMAN) \
+	$(ASMKRBDIR)\$(ASMKRBNAME).cat
+
+all:: asm-krb
+
+clean::
+	$(RM) $(ASMKRBDIR)\*.*
+
+{$(BINDIR)}.dll{$(ASMKRBDIR)}.dll:
+	$(CP) $< $@
+
+# ----------------------------------------------------------------------
+# Heimdal.GSSAPI Assembly
+
+ASMGSSDIR=$(ASMDIR)\Heimdal.GSSAPI
+ASMGSSVER=$(VER_PRODUCT_MAJOR).$(VER_PRODUCT_MINOR).$(VER_PRODUCT_AUX).$(VER_PRODUCT_PATCH)
+ASMGSSMAN=$(ASMGSSNAME).manifest
+
+ASMGSSBINS=$(ASMGSSDIR)\libgssapi.dll
+
+$(ASMGSSDIR)\$(ASMGSSMAN).nohash: Heimdal.GSSAPI.manifest.in
+	$(SED)  -e "s,[@]name[@],$(ASMGSSNAME),g" \
+		-e "s,[@]version[@],$(ASMGSSVER),g" \
+		-e "s,[@]krbname[@],$(ASMKRBNAME),g" \
+		-e "s,[@]krbversion[@],$(ASMKRBVER),g" \
+		-e "s,[@]cpu[@],$(MCPU),g" \
+		-e "s,[@]pkt[@],$(CODESIGN_PKT),g" < $** > $@
+
+$(ASMGSSDIR)\$(ASMGSSMAN) $(ASMGSSDIR)\$(ASMGSSMAN).cdf: \
+		$(ASMGSSDIR)\$(ASMGSSMAN).nohash $(ASMGSSBINS)
+	$(MT) -manifest $(ASMGSSDIR)\$(ASMGSSMAN).nohash -out:$@ -hashupdate -makecdfs
+
+$(ASMGSSDIR)\$(ASMGSSNAME).cat: $(ASMGSSDIR)\$(ASMGSSMAN).cdf
+	cd $(ASMGSSDIR)
+	$(MAKECAT) $**
+	$(_CODESIGN)
+#	$(RM) $(ASMGSSMAN).cdf
+#	$(RM) $(ASMGSSMAN).nohash
+	cd $(SRCDIR)
+
+asm-gss: \
+	$(ASMGSSBINS) \
+	$(ASMGSSDIR)\$(ASMGSSMAN) \
+	$(ASMGSSDIR)\$(ASMGSSNAME).cat
+
+all:: asm-gss
+
+clean::
+	$(RM) $(ASMGSSDIR)\*.*
+
+{$(BINDIR)}.dll{$(ASMGSSDIR)}.dll:
+	$(CP) $< $@
+
+# ----------------------------------------------------------------------
+
+.SUFFIXES: .dll
+
+mk-asm-dirs:
+!  if !exist($(ASMKRBDIR))
+	$(MKDIR) $(ASMKRBDIR)
+!  endif
+!  if !exist($(ASMGSSDIR))
+	$(MKDIR) $(ASMGSSDIR)
+!  endif
+
+!  if "$(CPU)"=="i386" || "$(CPU)"=="x86"
+MCPU=x86
+!  elseif "$(CPU)"=="AMD64"
+MCPU=amd64
+!  else
+!    error Unknown CPU
+!  endif
+
diff --git a/windows/NTMakefile.w32 b/windows/NTMakefile.w32
index 197d8bf80..20f62097f 100644
--- a/windows/NTMakefile.w32
+++ b/windows/NTMakefile.w32
@@ -72,6 +72,7 @@ LIBDIR =$(DESTDIR)\lib
 BINDIR =$(DESTDIR)\bin
 SBINDIR=$(BINDIR)
 LIBEXECDIR=$(BINDIR)
+ASMDIR=$(BINDIR)\asm
 
 !ifdef RELDIR
 SRCDIR =$(SRC)\$(RELDIR)
@@ -95,38 +96,18 @@ RM=del /q
 ECHO=echo
 RC=rc
 
-!ifndef AWK
 AWK=gawk.exe
-!endif
-
-!ifndef YACC
 YACC=bison.exe -y
-!endif
-
-!ifndef LEX
 LEX=flex.exe
-!endif
-
-!ifndef PYTHON
 PYTHON=python.exe
-!endif
-
-!ifndef PERL
 PERL=perl.exe
-!endif
-
-!ifndef CMP
 CMP=cmp.exe
-!endif
+SIGNTOOL=signtool.exe
+MAKECAT=makecat.exe
 
 # Only used for tests
-!ifndef SH
 SH=sh.exe
-!endif
-
-!ifndef SED
 SED=sed.exe
-!endif
 
 #----------------------------------------------------------------
 # External dependencies
@@ -220,7 +201,7 @@ RC2RES = $(RC2RES_C) -fo $@ $**
 !ifndef RECURSE
 
 check-utils:
-	@for %%g in ( "$(AWK)" "$(YACC)" "$(LEX)" "$(PYTHON)" "$(PERL)" "$(CMP)" ) do @( \
+	@for %%g in ( "$(AWK)" "$(YACC)" "$(LEX)" "$(PYTHON)" "$(PERL)" "$(CMP)" "$(SED)" "$(SIGNTOOL)" "$(MAKECAT)" ) do @( \
 	for /f %%f in ( "%%g" ) do @( \
 		if exist %%f @( \
 			echo Found %%f \
@@ -232,7 +213,7 @@ check-utils:
 		) \
 	) \
 	)
-	@for %%g in ( "$(SH)" "$(SED)" ) do @( \
+	@for %%g in ( "$(SH)" ) do @( \
 	for /f %%f in ( "%%g" ) do @( \
 		if exist %%f @( \
 			echo Found %%f \
@@ -265,7 +246,7 @@ show-cmds:
 
 prep:: show-cmds
 
-!endif
+!endif				# RECURSE
 
 {}.c{$(OBJ)}.obj::
 	$(C2OBJ_C) /Fd$(OBJ)\ /Fo$(OBJ)\ /MP @<<
@@ -350,6 +331,9 @@ mkdirs:
 !  if !exist($(BINDIR))
 	$(MKDIR) $(BINDIR)
 !  endif
+!  if !exist($(ASMDIR))
+	$(MKDIR) $(ASMDIR)
+!  endif
 !  if !exist($(INCDIR))
 	$(MKDIR) $(INCDIR)
 !  endif
@@ -418,10 +402,10 @@ clean::
 MT=mt.exe -nologo
 
 _VC_MANIFEST_EMBED_EXE= \
-if exist $@.manifest $(MT) -outputresource:$@;1 -manifest $@.manifest
+( if exist $@.manifest $(MT) -outputresource:$@;1 -manifest $@.manifest )
 
 _VC_MANIFEST_EMBED_DLL= \
-if exist $@.manifest $(MT) -outputresource:$@;2 -manifest $@.manifest
+( if exist $@.manifest $(MT) -outputresource:$@;2 -manifest $@.manifest )
 
 # Note that if you are merging manifests, then the VS generated
 # manifest should be cleaned up after calling _VC_MANIFEST_EMBED_???.
@@ -430,15 +414,35 @@ if exist $@.manifest $(MT) -outputresource:$@;2 -manifest $@.manifest
 # be used.
 
 _VC_MANIFEST_CLEAN= \
-if exist $@.manifest $(RM) $@.manifest
+( if exist $@.manifest $(RM) $@.manifest )
 
 # End of manifest handling
 
-# Code signing
+#----------------------------------------------------------------------
+# Code and assembly signing
+#
+# SIGNTOOL_C is any set of options required for certificate/private
+# key selection for code signging.
+#
+# SIGNTOOL_O is any set of additional options to signtool.exe
+#
+# SIGNTOOL_T is the timestamp option
+
 !ifdef CODESIGN
-_CODESIGN=$(CODESIGN) $@
+_CODESIGN=( $(CODESIGN) $@ )
 !else
-_CODESIGN=
+
+!ifdef SIGNTOOL_C
+
+!ifndef SIGNTOOL_T
+SIGNTOOL_T=/t http://timestamp.verisign.com/scripts/timstamp.dll
+!endif
+
+_CODESIGN=( $(SIGNTOOL) sign $(SIGNTOOL_O) $(SIGNTOOL_T) $(SIGNTOOL_C) /v $@ )
+!else
+_CODESIGN=( echo Skipping code sign )
+!endif
+
 !endif
 
 #----------------------------------------------------------------------
@@ -448,25 +452,19 @@ _CODESIGN=
 # prepare binaries.
 
 EXEPREP=\
-$(_VC_MANIFEST_EMBED_EXE)^
-$(_VC_MANIFEST_CLEAN)^
-$(_CODESIGN)
+( $(_VC_MANIFEST_EMBED_EXE) && $(_VC_MANIFEST_CLEAN) && $(_CODESIGN) ) || $(RM) $@
 
 EXEPREP_NODIST=\
-$(_VC_MANIFEST_EMBED_EXE)^
-$(_VC_MANIFEST_CLEAN)
+( $(_VC_MANIFEST_EMBED_EXE) && $(_VC_MANIFEST_CLEAN) ) || $(RM) $@
 
 DLLPREP=\
-$(_VC_MANIFEST_EMBED_DLL)^
-$(_VC_MANIFEST_CLEAN)^
-$(_CODESIGN)
+( $(_VC_MANIFEST_EMBED_DLL) && $(_VC_MANIFEST_CLEAN) && $(_CODESIGN) ) || $(RM) $@
 
 DLLPREP_NODIST=\
-$(_VC_MANIFEST_EMBED_DLL)^
-$(_VC_MANIFEST_CLEAN)
+( $(_VC_MANIFEST_EMBED_DLL) && $(_VC_MANIFEST_CLEAN) ) || $(RM) $@
 
 #----------------------------------------------------------------------
-# Convenience macros for import libraries
+# Convenience macros for import libraries and assemblies
 #
 
 LIBASN1	    =$(LIBDIR)\libasn1.lib
@@ -490,3 +488,6 @@ LIBSL	    =$(LIBDIR)\libsl.lib
 LIBSQLITE   =$(LIBDIR)\libsqlite.lib
 LIBVERS	    =$(LIBDIR)\libvers.lib
 LIBWIND	    =$(LIBDIR)\libwind.lib
+
+ASMKRBNAME  =Heimdal.Kerberos
+ASMGSSNAME  =Heimdal.GSSAPI