--- /tmp/samba-4.2.7/source3/wscript	2015-07-14 12:54:24.000000000 +0200
+++ source3/wscript	2016-01-05 22:48:50.669250837 +0100
@@ -853,11 +853,11 @@
         if not conf.CHECK_FUNCS_IN('iconv_open', 'iconv', headers='iconv.h'):
             conf.env.with_iconv = False
         if conf.env.with_iconv:
             conf.DEFINE('HAVE_ICONV', 1)
 
-    if Options.options.with_pam:
+    if Options.options.with_pam != False:
         use_pam=True
         conf.CHECK_HEADERS('security/pam_appl.h pam/pam_appl.h')
         if not conf.CONFIG_SET('HAVE_SECURITY_PAM_APPL_H') and not conf.CONFIG_SET('HAVE_PAM_PAM_APPL_H'):
             Logs.warn("--with-pam=yes but pam_appl.h not found")
             use_pam=False
@@ -926,10 +926,20 @@
             msg="Checking whether PAM_RADIO_TYPE is available");
         if use_pam:
             conf.DEFINE('WITH_PAM', 1)
             conf.DEFINE('WITH_PAM_MODULES', 1)
 
+    else:
+        Logs.warn("PAM disabled")
+        use_pam=False
+        conf.undefine('WITH_PAM')
+        conf.undefine('WITH_PAM_MODULES')
+        conf.undefine('HAVE_SECURITY_PAM_APPL_H')
+        conf.undefine('PAM_RHOST')
+        conf.undefine('PAM_TTY')
+        conf.undefine('HAVE_PAM_PAM_APPL_H')
+
     if Options.options.with_pam_smbpass:
         conf.env.with_pam_smbpass = True
 
     seteuid = False