diff --git a/kdc/hpropd.c b/kdc/hpropd.c
index f71aabe0b..ad2b6f57d 100644
--- a/kdc/hpropd.c
+++ b/kdc/hpropd.c
@@ -137,6 +137,12 @@ int main(int argc, char **argv)
     if(version_flag)
 	krb5_errx(context, 0, "%s (%s)\n", __progname, heimdal_version);
     
+    argc -= optind;
+    argv += optind;
+
+    if (argc != 0)
+	usage(1);
+
     if(from_stdin)
 	fd = STDIN_FILENO;
     else{
diff --git a/kdc/string2key.c b/kdc/string2key.c
index 793e1c2c1..6d9265671 100644
--- a/kdc/string2key.c
+++ b/kdc/string2key.c
@@ -94,6 +94,13 @@ int main(int argc, char **argv)
 	fprintf(stderr, "string2key (%s-%s)\n", PACKAGE, VERSION);
 	exit(0);
     }
+
+    argc -= optind;
+    argv += optind;
+
+    if (argc > 1)
+	usage(1);
+
     if(version5 && principal == NULL){
 	printf("Kerberos v5 principal: ");
 	fgets(buf, sizeof(buf), stdin);
diff --git a/kpasswd/kpasswd.c b/kpasswd/kpasswd.c
index d628602c5..a2c009fe8 100644
--- a/kpasswd/kpasswd.c
+++ b/kpasswd/kpasswd.c
@@ -91,6 +91,9 @@ main (int argc, char **argv)
     argc -= optind;
     argv += optind;
 
+    if (argc > 1)
+	usage(1);
+
     ret = krb5_init_context (&context);
     if (ret)
 	errx (1, "krb5_init_context: %s", krb5_get_err_text(context, ret));
diff --git a/kuser/kdestroy.c b/kuser/kdestroy.c
index e93ca099b..582f64176 100644
--- a/kuser/kdestroy.c
+++ b/kuser/kdestroy.c
@@ -79,6 +79,12 @@ main (int argc, char **argv)
 	exit(0);
     }
   
+    argc -= optind;
+    argv += optind;
+
+    if (argc != 0)
+	usage (1);
+
     ret = krb5_init_context (&context);
     if (ret)
 	errx (1, "krb5_init_context: %s", krb5_get_err_text(context, ret));
diff --git a/kuser/kinit.c b/kuser/kinit.c
index b8cc05493..f87ec9e0d 100644
--- a/kuser/kinit.c
+++ b/kuser/kinit.c
@@ -112,6 +112,9 @@ main (int argc, char **argv)
     argc -= optind;
     argv += optind;
 
+    if (argc > 1)
+	usage (1);
+
     ret = krb5_cc_default (context, &ccache);
     if (ret)
 	krb5_err (context, 1, ret, "krb5_cc_default");