diff --git a/.gitignore b/.gitignore
index 166fed8d4..4b52ce5c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,6 +49,7 @@ asn1_*.[cx]
 /libtool
 /ltmain.sh
 /missing
+/setupbuild.cmd
 /ylwrap
 
 # Files in subdirectories.
@@ -255,6 +256,7 @@ asn1_*.[cx]
 /lib/wind/normalize_table.h
 /lib/wind/punycode_examples.c
 /lib/wind/punycode_examples.h
+/out
 /po/gen-po.sh
 /scripts
 /tests/bin/setup-env
diff --git a/include/NTMakefile b/include/NTMakefile
index 01b805a8c..c4aa663e7 100644
--- a/include/NTMakefile
+++ b/include/NTMakefile
@@ -111,5 +111,5 @@ const char *heimdal_version = "$(VER_PACKAGE_NAME) $(VER_PACKAGE_VERSION)";
 all:: $(INCFILES)
 
 clean::
-	$(RM) $(INCFILES)
+	-$(RM) $(INCFILES)
 
diff --git a/include/bits.c b/include/bits.c
index f2ee2b9fa..8a64102e9 100644
--- a/include/bits.c
+++ b/include/bits.c
@@ -49,7 +49,7 @@ RCSID("$Id$");
     char tmp[128], tmp2[128];					\
     while(x){ x <<= 1; b++; if(x < zero) pre=""; }		\
     if(b >= len){						\
-        int tabs;						\
+        size_t tabs;						\
 	sprintf(tmp, "%sint%d_t" , pre, len);			\
 	sprintf(tmp2, "typedef %s %s;", #TYPE, tmp);		\
 	tabs = 5 - strlen(tmp2) / 8;				\
diff --git a/include/config.h.w32 b/include/config.h.w32
index b89859415..8fa5b45ad 100644
--- a/include/config.h.w32
+++ b/include/config.h.w32
@@ -1224,6 +1224,9 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Defined if we have WinSock */
 #define HAVE_WINSOCK 1
 
+/* Defined if we have WinDNS */
+#define HAVE_WINDNS 1
+
 /* define if struct winsize has ws_xpixel */
 /* #define HAVE_WS_XPIXEL 1 */
 
@@ -1404,6 +1407,9 @@ static const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg }
 /* Define if a socket is not a file descriptor */
 #define SOCKET_IS_NOT_AN_FD 1
 
+/* Define if FD_SETSIZE check does not apply to this platform */
+#define NO_LIMIT_FD_SETSIZE 1
+
 /* Define to 1 if you have the ANSI C header files. */
 #define STDC_HEADERS 1
 
diff --git a/lib/hcrypto/NTMakefile b/lib/hcrypto/NTMakefile
index 7f1a6fc72..89b002cf0 100644
--- a/lib/hcrypto/NTMakefile
+++ b/lib/hcrypto/NTMakefile
@@ -29,12 +29,22 @@
 # POSSIBILITY OF SUCH DAMAGE.
 # 
 
+SUBDIRS=tomsfastmath
+
 RELDIR=lib\hcrypto
 
 AUXCFLAGS=$(AUXCFLAGS) -DKRB5 -I$(HCRYPTOINCLUDEDIR)
 
 !include ../../windows/NTMakefile.w32
 
+# Do dependencies first
+
+all:: subdirs
+
+clean:: clean-subdirs
+
+test:: test-subdirs
+
 # Include files
 
 HCRYPTOINCLUDEDIR=$(INCDIR)\hcrypto
@@ -108,6 +118,7 @@ libhcrypto_OBJs = \
 	$(OBJ)\rsa.obj		\
 	$(OBJ)\rsa-gmp.obj	\
 	$(OBJ)\rsa-imath.obj	\
+	$(OBJ)\rsa-tfm.obj	\
 	$(OBJ)\sha.obj		\
 	$(OBJ)\sha256.obj	\
 	$(OBJ)\ui.obj
@@ -116,7 +127,7 @@ libhcrypto_OBJs = \
 
 $(LIBHCRYPTO): $(BINDIR)\libhcrypto.dll
 
-$(BINDIR)\libhcrypto.dll: $(libhcrypto_OBJs) $(LIBROKEN) $(LIBASN1)
+$(BINDIR)\libhcrypto.dll: $(libhcrypto_OBJs) $(LIBROKEN) $(LIBASN1) $(LIBTFM)
 	$(DLLGUILINK) -def:libhcrypto-exports.def -implib:$(LIBHCRYPTO)
 	$(DLLPREP)
 
@@ -258,3 +269,4 @@ test-run:
 	cd $(SRCDIR)
 
 test:: $(TESTLIB) test-binaries test-run
+
diff --git a/lib/hcrypto/rand-w32.c b/lib/hcrypto/rand-w32.c
index a5792d95c..e4d8442f8 100644
--- a/lib/hcrypto/rand-w32.c
+++ b/lib/hcrypto/rand-w32.c
@@ -48,25 +48,25 @@ volatile static HCRYPTPROV g_cryptprovider = 0;
 static HCRYPTPROV
 _hc_CryptProvider(void)
 {
-    BOOL res;
+    BOOL rv;
     HCRYPTPROV cryptprovider = 0;
 
     if (g_cryptprovider != 0)
 	return g_cryptprovider;
 
-    res = CryptAcquireContext(&cryptprovider, NULL,
+    rv = CryptAcquireContext(&cryptprovider, NULL,
 			      MS_ENHANCED_PROV, PROV_RSA_FULL,
 			      0);
 
     if (GetLastError() == NTE_BAD_KEYSET) {
-        if(!res)
-            res = CryptAcquireContext(&cryptprovider, NULL,
+        if(!rv)
+            rv = CryptAcquireContext(&cryptprovider, NULL,
                                       MS_ENHANCED_PROV, PROV_RSA_FULL,
                                       CRYPT_NEWKEYSET);
     }
 
-    if (res &&
-        InterlockedCompareExchange(&g_cryptprovider, cryptprovider, 0) != 0) {
+    if (rv &&
+        InterlockedCompareExchangePointer(&g_cryptprovider, cryptprovider, 0) != 0) {
 
         CryptReleaseContext(cryptprovider, 0);
         cryptprovider = g_cryptprovider;
@@ -90,8 +90,8 @@ static int
 w32crypto_bytes(unsigned char *outdata, int size)
 {
     if (CryptGenRandom(_hc_CryptProvider(), size, outdata))
-	return 0;
-    return 1;
+	return 1;
+    return 0;
 }
 
 static void
diff --git a/lib/hcrypto/tomsfastmath/NTMakefile b/lib/hcrypto/tomsfastmath/NTMakefile
new file mode 100644
index 000000000..fc75b6c23
--- /dev/null
+++ b/lib/hcrypto/tomsfastmath/NTMakefile
@@ -0,0 +1,162 @@
+########################################################################
+#
+# Copyright (c) 2009, Secure Endpoints Inc.
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 
+# - Redistributions of source code must retain the above copyright
+#   notice, this list of conditions and the following disclaimer.
+# 
+# - Redistributions in binary form must reproduce the above copyright
+#   notice, this list of conditions and the following disclaimer in
+#   the documentation and/or other materials provided with the
+#   distribution.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+# 
+
+RELDIR=lib\hcrypto\tomsfastmath
+
+!include ../../../windows/NTMakefile.w32
+
+INCFILES=$(INCDIR)\tfm.h
+
+libtfm_OBJs=	\
+	$(OBJ)\fp_add.obj	\
+	$(OBJ)\fp_add_d.obj	\
+	$(OBJ)\fp_addmod.obj	\
+	$(OBJ)\fp_cmp.obj	\
+	$(OBJ)\fp_cmp_d.obj	\
+	$(OBJ)\fp_cmp_mag.obj	\
+	$(OBJ)\fp_sub.obj	\
+	$(OBJ)\fp_sub_d.obj	\
+	$(OBJ)\fp_submod.obj	\
+	$(OBJ)\s_fp_add.obj	\
+	$(OBJ)\s_fp_sub.obj	\
+	$(OBJ)\fp_radix_size.obj	\
+	$(OBJ)\fp_read_radix.obj	\
+	$(OBJ)\fp_read_signed_bin.obj	\
+	$(OBJ)\fp_read_unsigned_bin.obj	\
+	$(OBJ)\fp_reverse.obj	\
+	$(OBJ)\fp_s_rmap.obj	\
+	$(OBJ)\fp_signed_bin_size.obj	\
+	$(OBJ)\fp_to_signed_bin.obj	\
+	$(OBJ)\fp_to_unsigned_bin.obj	\
+	$(OBJ)\fp_toradix.obj	\
+	$(OBJ)\fp_unsigned_bin_size.obj	\
+	$(OBJ)\fp_cnt_lsb.obj	\
+	$(OBJ)\fp_count_bits.obj	\
+	$(OBJ)\fp_div_2.obj	\
+	$(OBJ)\fp_div_2d.obj	\
+	$(OBJ)\fp_lshd.obj	\
+	$(OBJ)\fp_mod_2d.obj	\
+	$(OBJ)\fp_rshd.obj	\
+	$(OBJ)\fp_div.obj	\
+	$(OBJ)\fp_div_d.obj	\
+	$(OBJ)\fp_mod.obj	\
+	$(OBJ)\fp_mod_d.obj	\
+	$(OBJ)\fp_2expt.obj	\
+	$(OBJ)\fp_exptmod.obj	\
+	$(OBJ)\fp_ident.obj	\
+	$(OBJ)\fp_set.obj	\
+	$(OBJ)\fp_montgomery_calc_normalization.obj	\
+	$(OBJ)\fp_montgomery_reduce.obj	\
+	$(OBJ)\fp_montgomery_setup.obj	\
+	$(OBJ)\fp_mul.obj	\
+	$(OBJ)\fp_mul_2.obj	\
+	$(OBJ)\fp_mul_2d.obj	\
+	$(OBJ)\fp_mul_comba.obj	\
+	$(OBJ)\fp_mul_comba_12.obj	\
+	$(OBJ)\fp_mul_comba_17.obj	\
+	$(OBJ)\fp_mul_comba_20.obj	\
+	$(OBJ)\fp_mul_comba_24.obj	\
+	$(OBJ)\fp_mul_comba_28.obj	\
+	$(OBJ)\fp_mul_comba_3.obj	\
+	$(OBJ)\fp_mul_comba_32.obj	\
+	$(OBJ)\fp_mul_comba_4.obj	\
+	$(OBJ)\fp_mul_comba_48.obj	\
+	$(OBJ)\fp_mul_comba_6.obj	\
+	$(OBJ)\fp_mul_comba_64.obj	\
+	$(OBJ)\fp_mul_comba_7.obj	\
+	$(OBJ)\fp_mul_comba_8.obj	\
+	$(OBJ)\fp_mul_comba_9.obj	\
+	$(OBJ)\fp_mul_comba_small_set.obj	\
+	$(OBJ)\fp_mul_d.obj	\
+	$(OBJ)\fp_mulmod.obj	\
+	$(OBJ)\fp_gcd.obj	\
+	$(OBJ)\fp_invmod.obj	\
+	$(OBJ)\fp_isprime.obj	\
+	$(OBJ)\fp_lcm.obj	\
+	$(OBJ)\fp_prime_miller_rabin.obj	\
+	$(OBJ)\fp_prime_random_ex.obj	\
+	$(OBJ)\fp_sqr.obj	\
+	$(OBJ)\fp_sqr_comba.obj	\
+	$(OBJ)\fp_sqr_comba_12.obj	\
+	$(OBJ)\fp_sqr_comba_17.obj	\
+	$(OBJ)\fp_sqr_comba_20.obj	\
+	$(OBJ)\fp_sqr_comba_24.obj	\
+	$(OBJ)\fp_sqr_comba_28.obj	\
+	$(OBJ)\fp_sqr_comba_3.obj	\
+	$(OBJ)\fp_sqr_comba_32.obj	\
+	$(OBJ)\fp_sqr_comba_4.obj	\
+	$(OBJ)\fp_sqr_comba_48.obj	\
+	$(OBJ)\fp_sqr_comba_6.obj	\
+	$(OBJ)\fp_sqr_comba_64.obj	\
+	$(OBJ)\fp_sqr_comba_7.obj	\
+	$(OBJ)\fp_sqr_comba_8.obj	\
+	$(OBJ)\fp_sqr_comba_9.obj	\
+	$(OBJ)\fp_sqr_comba_generic.obj	\
+	$(OBJ)\fp_sqr_comba_small_set.obj	\
+	$(OBJ)\fp_sqrmod.obj
+
+{src\addsub}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\bin}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\bit}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\divide}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\exptmod}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\misc}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\mont}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\mul}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\numtheory}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\sqr}.c{$(OBJ)}.obj:
+	$(C2OBJ)
+
+{src\headers}.h{$(INCDIR)}.h:
+	$(CP) $** $@
+
+$(LIBTFM): $(libtfm_OBJs)
+	$(LIBCON)
+
+all:: $(INCFILES) $(LIBTFM)
diff --git a/lib/hcrypto/ui.c b/lib/hcrypto/ui.c
index f6f8a1ffe..e32bb9a0b 100644
--- a/lib/hcrypto/ui.c
+++ b/lib/hcrypto/ui.c
@@ -77,7 +77,7 @@ read_string(const char *preprompt, const char *prompt,
     p = buf;
     while(intr_flag == 0){
 	c = ((echo)? _getche(): _getch());
-	if(c == '\n')
+	if(c == '\n' || c == '\r')
 	    break;
 	if(of == 0)
 	    *p++ = c;
diff --git a/lib/krb5/NTMakefile b/lib/krb5/NTMakefile
index 613029421..8059e7f96 100644
--- a/lib/krb5/NTMakefile
+++ b/lib/krb5/NTMakefile
@@ -317,7 +317,8 @@ DLLDEPS= \
 DLLSDKDEPS= \
 	$(PTHREAD_LIB)	\
 	secur32.lib	\
-	shell32.lib
+	shell32.lib	\
+	dnsapi.lib
 
 $(LIBKRB5): $(BINDIR)\libkrb5.dll
 
diff --git a/lib/krb5/acache.c b/lib/krb5/acache.c
index 19a599745..1be8fd93b 100644
--- a/lib/krb5/acache.c
+++ b/lib/krb5/acache.c
@@ -106,6 +106,8 @@ init_ccapi(krb5_context context)
     if (lib == NULL) {
 #ifdef __APPLE__
 	lib = "/System/Library/Frameworks/Kerberos.framework/Kerberos";
+#elif defined(KRB5_USE_PATH_TOKENS) && defined(_WIN32)
+	lib = "%{LIBDIR}/libkrb5_cc.dll";
 #else
 	lib = "/usr/lib/libkrb5_cc.so";
 #endif
@@ -120,7 +122,18 @@ init_ccapi(krb5_context context)
 #define RTLD_LOCAL 0
 #endif
 
+#ifdef KRB5_USE_PATH_TOKENS
+    {
+      char * explib = NULL;
+      if (_krb5_expand_path_tokens(context, lib, &explib) == 0) {
+	cc_handle = dlopen(explib, RTLD_LAZY|RTLD_LOCAL);
+	free(explib);
+      }
+    }
+#else
     cc_handle = dlopen(lib, RTLD_LAZY|RTLD_LOCAL);
+#endif
+
     if (cc_handle == NULL) {
 	HEIMDAL_MUTEX_unlock(&acc_mutex);
 	if (context)
diff --git a/lib/krb5/config_file.c b/lib/krb5/config_file.c
index 4eb4e12fa..f6f157063 100644
--- a/lib/krb5/config_file.c
+++ b/lib/krb5/config_file.c
@@ -447,7 +447,7 @@ krb5_config_parse_file_multi (krb5_context context,
 	    fname = newfname;
 	}
 #else  /* KRB5_USE_PATH_TOKENS */
-	asprintf(&newfname, "%%{USERCONFIG}/%s", &fname[1]);
+	asprintf(&newfname, "%%{USERCONFIG}%s", &fname[1]);
 	if (newfname == NULL) {
 	    krb5_set_error_message(context, ENOMEM,
 				   N_("malloc: out of memory", ""));
diff --git a/lib/krb5/expand_path_w32.c b/lib/krb5/expand_path_w32.c
index 784ce64fe..0c4287c32 100644
--- a/lib/krb5/expand_path_w32.c
+++ b/lib/krb5/expand_path_w32.c
@@ -479,6 +479,14 @@ _krb5_expand_path_tokens(krb5_context context,
 	}
     }
 
+    /* Also deal with slashes */
+    if (*ppath_out) {
+	char * c;
+	for (c = *ppath_out; *c; c++)
+	    if (*c == '/')
+		*c = '\\';
+    }
+
     return 0;
 }
 
diff --git a/lib/krb5/fcache.c b/lib/krb5/fcache.c
index 67c4c7444..854ee35ac 100644
--- a/lib/krb5/fcache.c
+++ b/lib/krb5/fcache.c
@@ -990,11 +990,12 @@ fcc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
     {
 	krb5_storage *sp;
 	int fd;
-	ret = init_fcc (context, to, &sp, &fd, NULL);
-	if (sp)
-	    krb5_storage_free(sp);
-	fcc_unlock(context, fd);
-	close(fd);
+	if ((ret = init_fcc (context, to, &sp, &fd, NULL)) == 0) {
+	    if (sp)
+		krb5_storage_free(sp);
+	    fcc_unlock(context, fd);
+	    close(fd);
+	}
     }
 
     fcc_close(context, from);
@@ -1041,7 +1042,7 @@ static krb5_error_code
 fcc_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *kdc_offset)
 {
     krb5_error_code ret;
-    krb5_storage *sp;
+    krb5_storage *sp = NULL;
     int fd;
     ret = init_fcc(context, id, &sp, &fd, kdc_offset);
     if (sp)
diff --git a/lib/krb5/kuserok.c b/lib/krb5/kuserok.c
index 4cc9be203..2129100b9 100644
--- a/lib/krb5/kuserok.c
+++ b/lib/krb5/kuserok.c
@@ -34,6 +34,8 @@
 #include "krb5_locl.h"
 #include <dirent.h>
 
+#ifndef _WIN32
+
 /* see if principal is mentioned in the filename access file, return
    TRUE (in result) if so, FALSE otherwise */
 
@@ -65,7 +67,6 @@ check_one_file(krb5_context context,
 	fclose (f);
 	return EISDIR;
     }
-#ifndef _WIN32
     if (st.st_uid != pwd->pw_uid && st.st_uid != 0) {
 	fclose (f);
 	return EACCES;
@@ -74,7 +75,6 @@ check_one_file(krb5_context context,
 	fclose (f);
 	return EACCES;
     }
-#endif
 
     while (fgets (buf, sizeof(buf), f) != NULL) {
 	krb5_principal tmp;
@@ -126,12 +126,10 @@ check_directory(krb5_context context,
     if (!S_ISDIR(st.st_mode))
 	return ENOTDIR;
 
-#ifndef _WIN32
     if (st.st_uid != pwd->pw_uid && st.st_uid != 0)
 	return EACCES;
     if ((st.st_mode & (S_IWGRP | S_IWOTH)) != 0)
 	return EACCES;
-#endif
 
     if((d = opendir(dirname)) == NULL)
 	return errno;
@@ -167,6 +165,8 @@ check_directory(krb5_context context,
     return ret;
 }
 
+#endif  /* !_WIN32 */
+
 static krb5_boolean
 match_local_principals(krb5_context context,
 		       krb5_principal principal,
diff --git a/lib/krb5/plugin.c b/lib/krb5/plugin.c
index aa71e29b3..8db3c5a70 100644
--- a/lib/krb5/plugin.c
+++ b/lib/krb5/plugin.c
@@ -201,8 +201,19 @@ load_plugins(krb5_context context)
 	dirs = rk_UNCONST(sysplugin_dirs);
 
     for (di = dirs; *di != NULL; di++) {
+#ifdef KRB5_USE_PATH_TOKENS
+	{
+	    char * dir = NULL;
 
-	d = opendir(*di);
+	    if (_krb5_expand_path_tokens(context, *di, &dir))
+		continue;
+	    d = opendir(dir);
+
+	    free(dir);
+	}
+#else
+	d = opendir(*id);
+#endif
 	if (d == NULL)
 	    continue;
 	rk_cloexec_dir(d);
diff --git a/lib/roken/net_read.c b/lib/roken/net_read.c
index b57dda3dd..1f959db95 100644
--- a/lib/roken/net_read.c
+++ b/lib/roken/net_read.c
@@ -73,8 +73,27 @@ net_read(rk_socket_t sock, void *buf, size_t nbytes)
     ssize_t count;
     size_t rem = nbytes;
 
+#ifdef SOCKET_IS_NOT_AN_FD
+    int use_read = 0;
+#endif
+
     while (rem > 0) {
+#ifdef SOCKET_IS_NOT_AN_FD
+	if (use_read)
+	    count = _read (sock, cbuf, rem);
+	else
+	    count = recv (sock, cbuf, rem, 0);
+
+	if (use_read == 0 &&
+	    rk_IS_SOCKET_ERROR(count) &&
+	    rk_SOCK_ERRNO == WSAENOTSOCK) {
+	    use_read = 1;
+
+	    count = _read (sock, cbuf, rem);
+	}
+#else
 	count = recv (sock, cbuf, rem, 0);
+#endif
 	if (count < 0) {
 
 	    /* With WinSock, the error EINTR (WSAEINTR), is used to
diff --git a/lib/roken/net_write.c b/lib/roken/net_write.c
index 94c9df1c3..402e20915 100644
--- a/lib/roken/net_write.c
+++ b/lib/roken/net_write.c
@@ -70,9 +70,27 @@ net_write(rk_socket_t sock, const void *buf, size_t nbytes)
     const char *cbuf = (const char *)buf;
     ssize_t count;
     size_t rem = nbytes;
+#ifdef SOCKET_IS_NOT_AN_FD
+    int use_write = 0;
+#endif
 
     while (rem > 0) {
+#ifdef SOCKET_IS_NOT_AN_FD
+	if (use_write)
+	    count = _write (sock, cbuf, rem);
+	else
+	    count = send (sock, cbuf, rem, 0);
+
+	if (use_write == 0 &&
+	    rk_IS_SOCKET_ERROR(count) &&
+	    rk_SOCK_ERRNO == WSAENOTSOCK) {
+	    use_write = 1;
+
+	    count = _write (sock, cbuf, rem);
+	}
+#else
 	count = send (sock, cbuf, rem, 0);
+#endif
 	if (count < 0) {
 	    if (errno == EINTR)
 		continue;
diff --git a/lib/roken/resolve.c b/lib/roken/resolve.c
index e112274a6..a8be75af1 100644
--- a/lib/roken/resolve.c
+++ b/lib/roken/resolve.c
@@ -98,7 +98,7 @@ rk_dns_type_to_string(int type)
     return NULL;
 }
 
-#if (defined(HAVE_RES_SEARCH) || defined(HAVE_RES_NSEARCH)) && defined(HAVE_DN_EXPAND)
+#if ((defined(HAVE_RES_SEARCH) || defined(HAVE_RES_NSEARCH)) && defined(HAVE_DN_EXPAND)) || defined(HAVE_WINDNS)
 
 static void
 dns_free_rr(struct rk_resource_record *rr)
@@ -124,6 +124,8 @@ rk_dns_free_data(struct rk_dns_reply *r)
     free (r);
 }
 
+#ifndef HAVE_WINDNS
+
 static int
 parse_record(const unsigned char *data, const unsigned char *end_data,
 	     const unsigned char **pp, struct rk_resource_record **ret_rr)
@@ -605,6 +607,8 @@ rk_dns_lookup(const char *domain, const char *type_name)
     return dns_lookup_int(domain, rk_ns_c_in, type);
 }
 
+#endif	/* !HAVE_WINDNS */
+
 static int
 compare_srv(const void *a, const void *b)
 {
@@ -708,6 +712,216 @@ rk_dns_srv_order(struct rk_dns_reply *r)
     return;
 }
 
+#ifdef HAVE_WINDNS
+
+#include <WinDNS.h>
+
+static struct rk_resource_record *
+parse_dns_record(PDNS_RECORD pRec)
+{
+    struct rk_resource_record * rr;
+
+    if (pRec == NULL)
+	return NULL;
+
+    rr = calloc(1, sizeof(*rr));
+
+    rr->domain = strdup(pRec->pName);
+    rr->type = pRec->wType;
+    rr->class = 0;
+    rr->ttl = pRec->dwTtl;
+    rr->size = 0;
+
+    switch (rr->type) {
+    case rk_ns_t_ns:
+    case rk_ns_t_cname:
+    case rk_ns_t_ptr:
+	rr->u.txt = strdup(pRec->Data.NS.pNameHost);
+	if(rr->u.txt == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+	break;
+
+    case rk_ns_t_mx:
+    case rk_ns_t_afsdb:{
+	size_t hostlen = strnlen(pRec->Data.MX.pNameExchange, DNS_MAX_NAME_LENGTH);
+
+	rr->u.mx = (struct mx_record *)malloc(sizeof(struct mx_record) +
+					      hostlen);
+	if (rr->u.mx == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	strcpy_s(rr->u.mx->domain, hostlen + 1, pRec->Data.MX.pNameExchange);
+	rr->u.mx->preference = pRec->Data.MX.wPreference;
+	break;
+    }
+
+    case rk_ns_t_srv:{
+	size_t hostlen = strnlen(pRec->Data.SRV.pNameTarget, DNS_MAX_NAME_LENGTH);
+
+	rr->u.srv =
+	    (struct srv_record*)malloc(sizeof(struct srv_record) +
+				       hostlen);
+	if(rr->u.srv == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	rr->u.srv->priority = pRec->Data.SRV.wPriority;
+	rr->u.srv->weight = pRec->Data.SRV.wWeight;
+	rr->u.srv->port = pRec->Data.SRV.wPort;
+	strcpy_s(rr->u.srv->target, hostlen + 1, pRec->Data.SRV.pNameTarget);
+
+	break;
+    }
+
+    case rk_ns_t_txt:{
+	size_t len;
+
+	if (pRec->Data.TXT.dwStringCount == 0) {
+	    rr->u.txt = strdup("");
+	    break;
+	}
+
+	len = strnlen(pRec->Data.TXT.pStringArray[0], DNS_MAX_TEXT_STRING_LENGTH);
+
+	rr->u.txt = (char *)malloc(len + 1);
+	strcpy_s(rr->u.txt, len + 1, pRec->Data.TXT.pStringArray[0]);
+
+	break;
+    }
+
+    case rk_ns_t_key : {
+	size_t key_len;
+
+	if (pRec->wDataLength < 4) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	key_len = pRec->wDataLength - 4;
+	rr->u.key = malloc (sizeof(*rr->u.key) + key_len - 1);
+	if (rr->u.key == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	rr->u.key->flags     = pRec->Data.KEY.wFlags;
+	rr->u.key->protocol  = pRec->Data.KEY.chProtocol;
+	rr->u.key->algorithm = pRec->Data.KEY.chAlgorithm;
+	rr->u.key->key_len   = key_len;
+	memcpy_s (rr->u.key->key_data, key_len,
+		  pRec->Data.KEY.Key, key_len);
+	break;
+    }
+
+    case rk_ns_t_sig : {
+	size_t sig_len, hostlen;
+
+	if(pRec->wDataLength <= 18) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	sig_len = pRec->wDataLength;
+
+	hostlen = strnlen(pRec->Data.SIG.pNameSigner, DNS_MAX_NAME_LENGTH);
+
+	rr->u.sig = malloc(sizeof(*rr->u.sig)
+			      + hostlen + sig_len);
+	if (rr->u.sig == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+	rr->u.sig->type           = pRec->Data.SIG.wTypeCovered;
+	rr->u.sig->algorithm      = pRec->Data.SIG.chAlgorithm;
+	rr->u.sig->labels         = pRec->Data.SIG.chLabelCount;
+	rr->u.sig->orig_ttl       = pRec->Data.SIG.dwOriginalTtl;
+	rr->u.sig->sig_expiration = pRec->Data.SIG.dwExpiration;
+	rr->u.sig->sig_inception  = pRec->Data.SIG.dwTimeSigned;
+	rr->u.sig->key_tag        = pRec->Data.SIG.wKeyTag;
+	rr->u.sig->sig_len        = sig_len;
+	memcpy_s (rr->u.sig->sig_data, sig_len,
+		  pRec->Data.SIG.Signature, sig_len);
+	rr->u.sig->signer         = &rr->u.sig->sig_data[sig_len];
+	strcpy_s(rr->u.sig->signer, hostlen + 1, pRec->Data.SIG.pNameSigner);
+	break;
+    }
+
+    case rk_ns_t_ds: {
+	rr->u.ds = malloc (sizeof(*rr->u.ds) + pRec->Data.DS.wDigestLength - 1);
+	if (rr->u.ds == NULL) {
+	    dns_free_rr(rr);
+	    return NULL;
+	}
+
+	rr->u.ds->key_tag     = pRec->Data.DS.wKeyTag;
+	rr->u.ds->algorithm   = pRec->Data.DS.chAlgorithm;
+	rr->u.ds->digest_type = pRec->Data.DS.chDigestType;
+	rr->u.ds->digest_len  = pRec->Data.DS.wDigestLength;
+	memcpy_s (rr->u.ds->digest_data, pRec->Data.DS.wDigestLength,
+		  pRec->Data.DS.Digest, pRec->Data.DS.wDigestLength);
+	break;
+    }
+
+    default:
+	dns_free_rr(rr);
+	return NULL;
+    }
+
+    rr->next = parse_dns_record(pRec->pNext);
+    return rr;
+}
+
+ROKEN_LIB_FUNCTION struct rk_dns_reply * ROKEN_LIB_CALL
+rk_dns_lookup(const char *domain, const char *type_name)
+{
+    DNS_STATUS status;
+    int type;
+    PDNS_RECORD pRec = NULL;
+    struct rk_dns_reply * r = NULL;
+
+    __try {
+
+	type = rk_dns_string_to_type(type_name);
+	if(type == -1) {
+	    if(_resolve_debug)
+		fprintf(stderr, "dns_lookup: unknown resource type: `%s'\n",
+			type_name);
+	    return NULL;
+	}
+
+	status = DnsQuery_UTF8(domain, type, DNS_QUERY_STANDARD, NULL,
+			       &pRec, NULL);
+	if (status != ERROR_SUCCESS)
+	    return NULL;
+
+	r = calloc(1, sizeof(*r));
+	r->q.domain = strdup(domain);
+	r->q.type = type;
+	r->q.class = 0;
+
+	r->head = parse_dns_record(pRec);
+
+	if (r->head == NULL) {
+	    rk_dns_free_data(r);
+	    return NULL;
+	} else {
+	    return r;
+	}
+
+    } __finally {
+
+	if (pRec)
+	    DnsRecordListFree(pRec, DnsFreeRecordList);
+
+    }
+}
+#endif	/* HAVE_WINDNS */
+
 #else /* NOT defined(HAVE_RES_SEARCH) && defined(HAVE_DN_EXPAND) */
 
 ROKEN_LIB_FUNCTION struct rk_dns_reply * ROKEN_LIB_CALL
diff --git a/windows/NTMakefile.w32 b/windows/NTMakefile.w32
index 3da293f7f..8391afae6 100644
--- a/windows/NTMakefile.w32
+++ b/windows/NTMakefile.w32
@@ -53,6 +53,8 @@ SRC=$(MAKEDIR)
 SRC=$(MAKEDIR)\..
 !elseif exist($(MAKEDIR)\..\..\windows\NTMakefile.w32)
 SRC=$(MAKEDIR)\..\..
+!elseif exist($(MAKEDIR)\..\..\..\windows\NTMakefile.w32)
+SRC=$(MAKEDIR)\..\..\..
 !else
 !  error Cant determine source directory
 !endif
@@ -62,8 +64,8 @@ SRC=$(MAKEDIR)\..\..
 #----------------------------------------------------------------
 # Directory macros
 
-DESTDIR=$(SRC)\out32\dest_$(OUTDIR)
-OBJDIR =$(SRC)\out32\obj_$(OUTDIR)
+DESTDIR=$(SRC)\out\dest_$(OUTDIR)
+OBJDIR =$(SRC)\out\obj_$(OUTDIR)
 
 INCDIR =$(DESTDIR)\inc
 LIBDIR =$(DESTDIR)\lib
@@ -146,7 +148,7 @@ pthreadinc= -I$(PTHREAD_INC)
 
 cincdirs=$(cincdirs) -I$(INCDIR) -I$(INCDIR)\krb5 $(pthreadinc)
 cdefines=$(cdefines) -DHAVE_CONFIG_H
-cwarn=$(cwarn) -D_CRT_SECURE_NO_WARNINGS -wd4996
+cwarn=$(cwarn) -D_CRT_SECURE_NO_WARNINGS -wd4996 -wd4127 -wd4244 -wd4100
 
 !if "$(CPU)"=="i386"
 libmach=/machine:X86
@@ -454,3 +456,4 @@ LIBHDB	    =$(LIBDIR)\libhdb.lib
 LIBKADM5SRV =$(LIBDIR)\libkadm5srv.lib
 LIBKADM5CLNT=$(LIBDIR)\libkadm5clnt.lib
 LIBKDC	    =$(LIBDIR)\libkdc.lib
+LIBTFM	    =$(LIBDIR)\libtfm.lib