--- samba-4.2.0~rc2.orig/source4/rpc_server/netlogon/dcerpc_netlogon.c	2014-10-01 11:17:32.000000000 +0200
+++ samba-4.2.0~rc2/source4/rpc_server/netlogon/dcerpc_netlogon.c	2015-01-12 22:38:42.499183000 +0100
@@ -170,17 +172,6 @@ static NTSTATUS dcesrv_netr_ServerAuthen
 		}
 	}
 
-	/*
-	 * At this point we can cleanup the cache entry,
-	 * if we fail the client needs to call netr_ServerReqChallenge
-	 * again.
-	 *
-	 * Note: this handles global_challenge_table == NULL
-	 * and also a non existing record just fine.
-	 */
-	memcache_delete(global_challenge_table,
-			SINGLETON_CACHE, challenge_key);
-
 	server_flags = NETLOGON_NEG_ACCOUNT_LOCKOUT |
 		       NETLOGON_NEG_PERSISTENT_SAMREPL |
 		       NETLOGON_NEG_ARCFOUR |
@@ -227,6 +218,17 @@ static NTSTATUS dcesrv_netr_ServerAuthen
 	}
 
 	/*
+	 * At this point we can cleanup the cache entry,
+	 * if we fail the client needs to call netr_ServerReqChallenge
+	 * again.
+	 *
+	 * Note: this handles global_challenge_table == NULL
+	 * and also a non existing record just fine.
+	 */
+	memcache_delete(global_challenge_table,
+			SINGLETON_CACHE, challenge_key);
+
+	/*
 	 * According to Microsoft (see bugid #6099)
 	 * Windows 7 looks at the negotiate_flags
 	 * returned in this structure *even if the