diff --git a/cf/w32-check-exported-symbols.pl b/cf/w32-check-exported-symbols.pl
new file mode 100644
index 000000000..cfe014ff2
--- /dev/null
+++ b/cf/w32-check-exported-symbols.pl
@@ -0,0 +1,98 @@
+use Getopt::Long;
+use Pod::Usage;
+use feature "switch";
+
+my $def_name = '';
+my $vs_name = '';
+my $show_help = 0;
+
+my %syms;
+
+my $def_only = 0;
+my $vs_only = 0;
+
+GetOptions ("def=s" => \$def_name,
+	    "vs=s" => \$vs_name,
+	    "help|?" => \$show_help) or pod2usage( -exitval => 2,
+						   -verbose => 3 );
+pod2usage( -exitval => 1,
+	   -verbose => 3 ) if $show_help or !$def_name or !$vs_name;
+
+open (my $def, '<', $def_name) or die $!;
+open (my $vs, '<', $vs_name) or die $!;
+
+# First go through the version-script
+
+my $global = 0;
+
+while(<$vs>)
+{
+    next unless m/^([^#]+)/;
+
+    @a = split(/\s+|({|})/,$1);
+
+    for $f (@a) {
+	given ($f) {
+	    when (/global\:/) { $global = 1; }
+	    when (/{|}|.*\:/) { $global = 0; }
+	    when (/(.*)\;/ and $global == 1) {
+		$syms{$1} = 1;
+	    }
+	}
+    }
+}
+
+while(<$def>)
+{
+    next if m/^#/;
+    next unless m/^;!([^;]+)/ or m/^([^;]+);?(!?)/;
+
+    @a = split(/\s+/, $1);
+
+    for $f (@a) {
+	next if $f =~ /EXPORTS/ or $f =~ /DATA/ or not $f;
+
+	if (not exists $syms{$f} and not $2) {
+	    print "$f: Only in DEF\n";
+	    ++$def_only;
+	}
+	delete $syms{$f};
+    }
+}
+
+#while (($k,$v) = each %syms) {
+for $k (sort keys %syms) {
+    print "$k: Only in VS\n";
+    ++$vs_only;
+}
+
+close($def);
+close($vs);
+
+if ($def_only or $vs_only) {
+    print "\nMismatches found.\n";
+    exit(1);
+}
+
+__END__
+
+=head1 NAME
+
+w32-sync-exported-symbols.pl - Synchronize Windows .def with version-script
+
+=head1 SYNOPSIS
+
+w32-sync-exported-symbols.pl {options}
+
+  Options:
+    --def        Name of .def file
+    --vs         Name of version-script file
+
+=head1 DESCRIPTION
+
+Verifies that all the symbols exported by the version-script is also
+accounted for in the .def file.  Also checks that no extra symbols are
+exported by the .def file unless they are marked as safe.
+
+=cut
+
diff --git a/lib/com_err/NTMakefile b/lib/com_err/NTMakefile
index f6a221590..7e7f38222 100644
--- a/lib/com_err/NTMakefile
+++ b/lib/com_err/NTMakefile
@@ -82,3 +82,7 @@ clean::
 	-$(RM) $(INCFILES)
 	-$(RM) $(COMERRDLL)
 
+test-exports:
+	$(PERL) ..\..\cf\w32-check-exported-symbols.pl --vs version-script.map --def libcom_err-exports.def
+
+test:: test-exports
diff --git a/lib/gssapi/NTMakefile b/lib/gssapi/NTMakefile
index c909b929f..040699b30 100644
--- a/lib/gssapi/NTMakefile
+++ b/lib/gssapi/NTMakefile
@@ -531,3 +531,8 @@ clean::
                             "\t$(gssapi_files:.x=.obj)")
                     "krb5src" "mechsrc" "spnegosrc" "ntlmsrc")
 !endif
+
+test-exports:
+	$(PERL) ..\..\cf\w32-check-exported-symbols.pl --vs version-script.map --def libgssapi-exports.def
+
+test:: test-exports
diff --git a/lib/hcrypto/NTMakefile b/lib/hcrypto/NTMakefile
index c7081331d..2826b40be 100644
--- a/lib/hcrypto/NTMakefile
+++ b/lib/hcrypto/NTMakefile
@@ -244,3 +244,7 @@ test-run:
 
 test:: $(TESTLIB) test-binaries test-run
 
+test-exports:
+	$(PERL) ..\..\cf\w32-check-exported-symbols.pl --vs version-script.map --def libhcrypto-exports.def
+
+test:: test-exports
diff --git a/lib/hdb/NTMakefile b/lib/hdb/NTMakefile
index 73c2e6992..4b1acea84 100644
--- a/lib/hdb/NTMakefile
+++ b/lib/hdb/NTMakefile
@@ -193,3 +193,7 @@ hdb_cflags=$(openldap_inc_flag) -I$(OBJ)
 {$(OBJ)}.c{$(OBJ)}.obj::
 	$(C2OBJ_P) $(hdb_cflags)
 
+test-exports:
+	$(PERL) ..\..\cf\w32-check-exported-symbols.pl --vs version-script.map --def libhdb-exports.def
+
+test:: test-exports
diff --git a/lib/kadm5/NTMakefile b/lib/kadm5/NTMakefile
index 45db74298..3ec50ff9b 100644
--- a/lib/kadm5/NTMakefile
+++ b/lib/kadm5/NTMakefile
@@ -254,4 +254,9 @@ test-run:
 	$(CP) $< $@
 
 {}.c{$(OBJ)}.obj::
-	$(C2OBJ_P) -I$(OBJ) -I$(KADM5INCDIR)
\ No newline at end of file
+	$(C2OBJ_P) -I$(OBJ) -I$(KADM5INCDIR)
+
+test-exports:
+	$(PERL) ..\..\cf\w32-check-exported-symbols.pl --vs version-script.map --def libkadm5srv-exports.def
+
+test:: test-exports
diff --git a/lib/krb5/NTMakefile b/lib/krb5/NTMakefile
index dc01e4648..cf9ceec01 100644
--- a/lib/krb5/NTMakefile
+++ b/lib/krb5/NTMakefile
@@ -399,3 +399,8 @@ $(test_binaries): $$(@R).obj
 
 $(test_binaries:.exe=.obj): $$(@B).c
 	$(C2OBJ_C) -Fo$@ -Fd$(@D)\ $** -DBlah
+
+test-exports:
+	$(PERL) ..\..\cf\w32-check-exported-symbols.pl --vs version-script.map --def libkrb5-exports.def.in
+
+test:: test-exports
diff --git a/lib/ntlm/NTMakefile b/lib/ntlm/NTMakefile
index 55f6c738a..dad338c43 100644
--- a/lib/ntlm/NTMakefile
+++ b/lib/ntlm/NTMakefile
@@ -74,3 +74,8 @@ $(OBJ)\test_ntlm.exe: $(OBJ)\test_ntlm.obj $(LIBHEIMNTLM) $(LIBHEIMDAL) $(LIBVER
 	$(EXEPREP_NODIST)
 
 test:: test-binaries test-run
+
+test-exports:
+	$(PERL) ..\..\cf\w32-check-exported-symbols.pl --vs version-script.map --def libheimntlm-exports.def
+
+test:: test-exports
diff --git a/lib/wind/NTMakefile b/lib/wind/NTMakefile
index 3f39696c5..a7a32e671 100644
--- a/lib/wind/NTMakefile
+++ b/lib/wind/NTMakefile
@@ -152,3 +152,8 @@ clean::
 	-$(RM) $(INCFILES)
 
 test:: test-binaries test-run
+
+test-exports:
+	$(PERL) ..\..\cf\w32-check-exported-symbols.pl --vs version-script.map --def libwind-exports.def
+
+test:: test-exports