diff --git a/sipXcommserverLib/bin/ssl-cert/gen-ssl-keys.sh.in b/sipXcommserverLib/bin/ssl-cert/gen-ssl-keys.sh.in
index 129f072..c750e95 100644
--- a/sipXcommserverLib/bin/ssl-cert/gen-ssl-keys.sh.in
+++ b/sipXcommserverLib/bin/ssl-cert/gen-ssl-keys.sh.in
@@ -34,8 +34,14 @@ openssl="@OPENSSL@"
 caName=ca.`hostname --domain`
 
 # if there is a file of saved default answers for the questions, read them
-Defaults=SSL_DEFAULTS
-test -f ${Defaults} && . ${Defaults}
+DefaultDefaults=SSL_DEFAULTS
+Defaults=""
+
+DefaultServer=`hostname --fqdn`
+
+CurrentWorkDir=`pwd`
+WorkDir=${CurrentWorkDir}
+
 ############################################################################################
 ## The variables that can be set from Defaults:
 ## Name                     Description                             Default Value
@@ -63,7 +69,7 @@ showUsage()
 
     - A self-signed certificate for a single system:
 
-      gen-ssl-keys.sh
+      gen-ssl-keys.sh [ {-s|--server} <server-name> ]
 
     - A private key and certificate request for use
       with a public or private certificate authority:
@@ -74,14 +80,32 @@ showUsage()
       certificates for multiple systems:
 
       gen-ssl-keys.sh --new-ca
-.
+
     - a certificate for your server signed by your own authority
       certificate:
 
       gen-ssl-keys.sh --sign <csr-file>
                       [ --ca <ca-name> ]
                       [ --ca-key <keyfile> ]
-.
+
+    All of the above accept the optional arguments:
+
+         {-wd|--workdir} <working-directory> 
+
+                 Specifies a directory where all files should be stored:
+                 defaults to the current directory.  If specified, then
+                 any other file name is relative to this directory.
+
+         {-p|--parameters} <parameter-file> 
+
+                 Specifies a file from which default answers should be read:
+                 defaults to ${DefaultDefaults}
+
+         {-d|--defaults}
+
+                 Forces the default values to be used with no 
+                 interactive prompting.
+
     See @SIPX_DOCDIR@/INSTALL.ssl for details on usage.
 
     Derived from cca.sh:
@@ -120,9 +144,9 @@ askfor () # variable, prompt, default, storeflag
 
     eval "$var=\"$value\""
 
-    if test "${store}" != "NOSTORE" && ! grep -q -e "^${var}=" ${Defaults} 2> /dev/null
+    if test "${store}" != "NOSTORE" && ! grep -q -e "^${var}=" "${Defaults}" 2> /dev/null
     then
-        cat >> ${Defaults} <<EOF
+        cat >> "${Defaults}" <<EOF
 ${var}="${value}"
 EOF
     fi
@@ -206,7 +230,7 @@ Identifying information for the server:
 EOF
 
     askfor sipDomainName "SIP domain name" `hostname --domain` 
-    askfor server        "Full DNS name for the server" `hostname --fqdn` NOSTORE
+    askfor server        "Full DNS name for the server" ${Server:-${DefaultServer}} NOSTORE
     while test $"{caName}" = ${server}
       do
       echo "" 1>&2
@@ -233,6 +257,25 @@ genCA()
 Generating private Certificate Authority (CA)
 ______________________________________________________________________
 
+EOF
+    if test -f "${caName}".key -a -f "${caName}".crt
+    then
+        cat <<EOF
+
+  Certificate files for CA '${caName}' already exist
+    ${caName}.key 
+    ${caName}.crt
+
+  Using the existing files.
+
+  To generate new CA certificate, delete the existing files and re-execute. 
+______________________________________________________________________
+EOF
+        return 0
+    fi
+
+    cat <<EOF
+
         Generating RSA private key for CA (${CAkeyBits} bit)
 
 EOF
@@ -306,6 +349,7 @@ EOT
         -in "${caName}.csr" \
         -out "${caName}.crt" \
         -text \
+        -certopt no_pubkey,no_sigdump \
         > /dev/null 2>&1
 
     if [ $? -ne 0 ]; then
@@ -347,7 +391,7 @@ genServerCSR()
         echo "${myName}:Error: Failed to generate RSA private key" 1>&2
         exit 1
     fi
-    chmod go= $server.key
+    chmod o=,g=r $server.key
 
     echo "______________________________________________________________________"
     echo ""
@@ -419,6 +463,7 @@ EOT
         -in ${server}.csr \
         -out ${server}.crt \
         -text \
+        -certopt no_pubkey,no_sigdump \
         > /dev/null 2>&1
 
     if [ $? -ne 0 ]; then
@@ -723,6 +768,52 @@ do
             AutoDefault=AUTODEFAULT
             ;;
 
+        -p|--parameters)
+            ##
+            ## Set the file from which default answers should be read
+            ##
+            if [ $# -lt 2 ]
+            then
+                echo "Must specify <parameter-file> with ${1}" 1>&2
+                Action=USAGE
+                break
+            else
+                Defaults=${2}
+                shift # consume the switch ( for n values, consume n-1 )
+            fi
+            ;;
+
+        -s|--server)
+            ##
+            ## Set the file from which default answers should be read
+            ##
+            if [ $# -lt 2 ]
+            then
+                echo "Must specify <server-name> with ${1}" 1>&2
+                Action=USAGE
+                break
+            else
+                Server=${2}
+                shift # consume the switch ( for n values, consume n-1 )
+            fi
+            ;;
+
+        -wd|--workdir)
+            ##
+            ## Set the directory where database files and outputs should be
+            ##
+            if [ $# -lt 2 ]
+            then
+                echo "Must specify <working-directory> with ${1}" 1>&2
+                Action=USAGE
+                break
+            else
+                WorkDir=${2}
+                shift # consume the switch ( for n values, consume n-1 )
+            fi
+            ;;
+
+
         *)
             ##
             ## unrecognized argument
@@ -735,6 +826,18 @@ do
     shift # always consume 1
 done
 
+if test -z "${Defaults}"
+then
+    Defaults=${DefaultDefaults}
+fi
+
+if test "${CurrentWorkDir}" != "${WorkDir}"
+then
+    cd "${WorkDir}" > /dev/null || exit 1
+fi
+
+test -r ${Defaults} && . ${Defaults}
+
 case ${Action} in
 
     DO_ALL)
diff --git a/sipXcommserverLib/bin/ssl-cert/install-cert.sh.in b/sipXcommserverLib/bin/ssl-cert/install-cert.sh.in
index 510cce0..dd9d4c6 100644
--- a/sipXcommserverLib/bin/ssl-cert/install-cert.sh.in
+++ b/sipXcommserverLib/bin/ssl-cert/install-cert.sh.in
@@ -41,6 +41,8 @@ remote_receive() {
   exit
 }
 
+CurrentWorkDir=`pwd`
+WorkDir=${CurrentWorkDir}
 
 Action=INSTALL
 Basename=""
@@ -56,6 +58,22 @@ do
         --remote-receive)
 	    Action=REMOTE_RECEIVE
             ;;
+
+        -wd|--workdir)
+            ##
+            ## Set the directory where database files and outputs should be
+            ##
+            if [ $# -lt 2 ]
+            then
+                echo "Must specify <working-directory> with ${1}" 1>&2
+                Action=USAGE
+                break
+            else
+                WorkDir=${2}
+                shift # consume the switch ( for n values, consume n-1 )
+            fi
+            ;;
+
         ##
         ## handle an unknown switch
         ##
@@ -91,6 +109,11 @@ then
   exit
 fi
 
+if test "${CurrentWorkDir}" != "${WorkDir}"
+then
+    cd "${WorkDir}" > /dev/null || exit 1
+fi
+
 if ! [ -f "${Basename}.crt" -a -f "${Basename}.key" ]
 then
     cat <<EOF 1>&2
@@ -106,15 +129,22 @@ if [ "${Action}" = "USAGE" ]
 then
     cat <<EOF
 Usage:
-   install-cert.sh [--remote] [ <server-name> ]
+   install-cert.sh [ {-wd|--workdir} <working-directory> ]
+                   [ <server-name> ]
 
    The server-name specifies the base name of the .key and .crt files
    generated by the gen-ssl-keys.sh script.  If not specified, it defaults
-   to the fully qualified host name of the system.
+   to the fully qualified host name of the current system.
+
+   --workdir    Specifies a directory where all files should be stored:
+                defaults to the current directory.  If specified, then
+                other names may be relative to this directory.
+
+   install-cert.sh [ {-wd|--workdir} <working-directory> ]
+                   --remote <server-name>
 
-   --remote will install the .key, .crt and CA certificate on the remote
-   machine <server-name>.  The remote machine has to have sipxpbx installed
-   of the same major version.
+   Installs the .key, .crt and CA certificate on the remote system <server-name>.  
+   The remote system must have sipxpbx installed of the same major version.
 
    The certificate is examined to find the issuer name; if a CA certificate
    is found in the same directory with that name (with a '.crt' suffix),
diff --git a/sipXcommserverLib/configure.ac b/sipXcommserverLib/configure.ac
index e53f5f9..277cddf 100644
--- a/sipXcommserverLib/configure.ac
+++ b/sipXcommserverLib/configure.ac
@@ -64,7 +64,6 @@ AC_CONFIG_FILES([
   src/Makefile 
   src/sipdb/Makefile 
   src/fastdb/Makefile 
-  src/sipdbtest/Makefile
   src/xsdvalid/Makefile
   src/test/Makefile 
   src/test/testlib/Makefile 
diff --git a/sipXcommserverLib/include/sipdb/SubscriptionDB.h b/sipXcommserverLib/include/sipdb/SubscriptionDB.h
index a7eca88..3126f67 100644
--- a/sipXcommserverLib/include/sipdb/SubscriptionDB.h
+++ b/sipXcommserverLib/include/sipdb/SubscriptionDB.h
@@ -111,6 +111,8 @@ public:
         const int& timeNow,
         ResultSet& rResultSet );
 
+    // Updates the XML version ('version') and NOTIFY cseq ('updatedNotifyCseq')
+    // in the subscription DB.
     // Does not have event and event-id parameters, because all subscriptions
     // in a dialog share the same CSeq value.
     void updateNotifyUnexpiredSubscription (
diff --git a/sipXcommserverLib/sipxcommserverlib.spec.in b/sipXcommserverLib/sipxcommserverlib.spec.in
old mode 100644
new mode 100755
index fbe8864..4d528a8
--- a/sipXcommserverLib/sipxcommserverlib.spec.in
+++ b/sipXcommserverLib/sipxcommserverlib.spec.in
@@ -99,17 +99,15 @@ rm -rf $RPM_BUILD_ROOT
 %files
 %defattr(644,root,root,755)
 %doc CONTRIBUTORS INSTALL README NEWS TODO ChangeLog %name.configlog
-%attr(755,root,root) %{_datadir}/doc/sipx/INSTALL.ssl
+%{_datadir}/doc/sipx/INSTALL.ssl
 %attr(755,root,root) %{_bindir}/configpp
 %attr(755,root,root) %{_bindir}/config-defs
 %attr(755,root,root) %{_bindir}/get_def_addr
 %attr(755,root,root) %{_bindir}/%name-config
 %attr(4755,root,root) %{_bindir}/sipx-sudo-restore
-%attr(755,root,root) %{_bindir}/sipdbtest
 %attr(755,root,root) %{_bindir}/pkg-upgrade
 %attr(755,root,root) %{_bindir}/configmerge
 %attr(755,root,root) %{_bindir}/configquery
-%attr(755,root,root) %{_bindir}/sipdbtest.sh
 %attr(755,root,root) %{_bindir}/xsdvalid
 %attr(755,root,root) %{_bindir}/sipx-validate-xml
 %attr(755,root,root) %{_bindir}/sipx-dns
@@ -121,24 +119,25 @@ rm -rf $RPM_BUILD_ROOT
 %attr(755,root,root) %{_libdir}/libsipXcommserver.la
 %attr(755,root,root) %{_libdir}/libsipXcommserver.so*
 %{_libexecdir}/sipx-utils.sh
-%attr(755,root,root) %{_datadir}/sipx/schema/xml.xsd
-%attr(755,root,root) %{_datadir}/sipx/schema/authrules.xsd
-%attr(755,root,root) %{_datadir}/sipx/schema/registration.xsd
-%attr(755,root,root) %{_datadir}/sipx/schema/urlmap.xsd
-%config(noreplace) %attr(644,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_sysconfdir}/sipxpbx/config.defs
+%attr(755,root,root) %{_libexecdir}/sipx-disable-on-distributed
+%{_datadir}/sipx/schema/xml.xsd
+%{_datadir}/sipx/schema/authrules.xsd
+%{_datadir}/sipx/schema/registration.xsd
+%{_datadir}/sipx/schema/urlmap.xsd
+%config(noreplace) %attr(644,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_sysconfdir}/sipxpbx/config.defs
 %attr(755,root,root) %{_sysconfdir}/sipxpbx/config.defs.map
 
 # These should match sipXlib.m4 or at least sent 
 # to configure script
-%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_sysconfdir}/sipxpbx
-%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_sysconfdir}/sipxpbx/ssl
-%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_sysconfdir}/sipxpbx/ssl/authorities
-%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_datadir}/sipxpbx
-%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_localstatedir}/log/sipxpbx
-%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_localstatedir}/run/sipxpbx
-%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_localstatedir}/sipxdata
-%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_localstatedir}/sipxdata/tmp
-%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXUSER@) %{_localstatedir}/sipxdata/sipdb
+%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_sysconfdir}/sipxpbx
+%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_sysconfdir}/sipxpbx/ssl
+%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_sysconfdir}/sipxpbx/ssl/authorities
+%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_datadir}/sipxpbx
+%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_localstatedir}/log/sipxpbx
+%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_localstatedir}/run/sipxpbx
+%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_localstatedir}/sipxdata
+%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_localstatedir}/sipxdata/tmp
+%dir %attr(755,@SIPXPBXUSER@,@SIPXPBXGROUP@) %{_localstatedir}/sipxdata/sipdb
 
 %{upgrade_archive_dir}/%{this_archive}
 %{upgrade_archive_dir}/%{name}-previous.tgz
@@ -186,6 +185,7 @@ sipx-upgrade -p sipxcommserverlib -c
 
 %post
 sipx-upgrade -p sipxcommserverlib -u --bdir %{_bindir}  --ddir %{_datadir} --cdir %{_sysconfdir} --sdir %{_localstatedir}  --ldir %{_libexecdir}
+rm -f %{_sysconfdir}/sipxpbx/process.d/keepalive.process.xml
 
 %define current_archive %{upgrade_archive_dir}/%{name}-current.tgz
 %define previous_archive %{upgrade_archive_dir}/%{name}-previous.tgz
diff --git a/sipXcommserverLib/src/Makefile.am b/sipXcommserverLib/src/Makefile.am
old mode 100644
new mode 100755
index b6af105..935404a
--- a/sipXcommserverLib/src/Makefile.am
+++ b/sipXcommserverLib/src/Makefile.am
@@ -1,11 +1,12 @@
 ## Process this file with automake to produce Makefile.in
 include $(top_srcdir)/config/subdir.am
 
-SUBDIRS = fastdb sipdb . sipdbtest xsdvalid test sipxrestorebinary 
+SUBDIRS = fastdb sipdb . xsdvalid test sipxrestorebinary 
 
 INCLUDES = -I$(top_srcdir)/include
 
 libexec_SCRIPTS = \
+	sipx-disable-on-distributed \
 	sipx-utils.sh
 
 EXTRA_DIST = \
diff --git a/sipXcommserverLib/src/persist/SipPersistentSubscriptionMgr.cpp b/sipXcommserverLib/src/persist/SipPersistentSubscriptionMgr.cpp
index 0eb05ff..6b33ef4 100644
--- a/sipXcommserverLib/src/persist/SipPersistentSubscriptionMgr.cpp
+++ b/sipXcommserverLib/src/persist/SipPersistentSubscriptionMgr.cpp
@@ -376,7 +376,7 @@ UtlBoolean SipPersistentSubscriptionMgr::getNotifyDialogInfo(
       SipDialog::parseHandle(subscribeDialogHandle.data(),
                              callId, localTag, remoteTag);
       // It's not clear why the localTag is the from-tag of the original SUBSCRIBE,
-      // but it is, and that's what we need to feed to updateFronAndTo.
+      // but it is, and that's what we need to feed to updateFromAndTo.
       OsSysLog::add(FAC_SIP, PRI_DEBUG,
                     "SipPersistentSubscriptionMgr::getNotifyDialogInfo "
                     "subscribeDialogHandle = '%s', localTag = '%s', from = '%s', to = '%s'",
diff --git a/sipXcommserverLib/src/sipXecsService/SipNonceDb.cpp b/sipXcommserverLib/src/sipXecsService/SipNonceDb.cpp
index a818825..3a5c5c3 100644
--- a/sipXcommserverLib/src/sipXecsService/SipNonceDb.cpp
+++ b/sipXcommserverLib/src/sipXecsService/SipNonceDb.cpp
@@ -131,20 +131,19 @@ UtlBoolean SipNonceDb::isNonceValid(const UtlString& nonce,
          else
          {
             OsSysLog::add(FAC_SIP,PRI_INFO,
-                          "SipNonceDB::isNonceValid expired nonce: created %d+%ld < %ld"
-                          ,nonceCreated, expiredTime, now
+                          "SipNonceDB::isNonceValid expired nonce '%s': created %d+%ld < %ld",
+                          nonce.data(), nonceCreated, expiredTime, now
                           );
          }
       }
       else
       {
          OsSysLog::add(FAC_SIP,PRI_ERR,
-                       "SipNonceDB::isNonceValid nonce signature check failed"
+                       "SipNonceDB::isNonceValid nonce signature check failed '%s'",
+                       nonce.data()
                        );
          OsSysLog::add(FAC_SIP,PRI_DEBUG,
-                       "SipNonceDB::isNonceValid\n"
-                       " rcvd signature '%s'\n"
-                       "  msg signature '%s'",
+                       "SipNonceDB::isNonceValid rcvd signature '%s' calculated signature '%s'",
                        rcvdSignature.data(), msgSignature.data()
                        );
       }
@@ -152,9 +151,9 @@ UtlBoolean SipNonceDb::isNonceValid(const UtlString& nonce,
    else
    {
       OsSysLog::add(FAC_SIP,PRI_ERR,
-                    "SipNonceDb::isNonceValid invalid nonce format \"%s\"\n"
-                    "  length %d expected %d",
-                    nonce.data(),nonce.length(),MD5_SIZE+HEX_TIMESTAMP_LENGTH);
+                    "SipNonceDb::isNonceValid invalid nonce format '%s'"
+                    " length %d expected %d",
+                    nonce.data(), nonce.length(), MD5_SIZE+HEX_TIMESTAMP_LENGTH);
    }
 
    return(valid);
@@ -176,17 +175,25 @@ UtlString SipNonceDb::nonceSignature(const UtlString& callId,
    UtlString signatureValue;
 
    OsSysLog::add(FAC_SIP, PRI_DEBUG,
-                 "nonceSignature: callId='%s' fromTag='%s' realm='%s' timestamp='%s'",
-                 callId.data(), fromTag.data(), realm.data(), timestamp
+                 "SipNonceDb::nonceSignature: callId='%s' fromTag='%s' realm='%s' "
+                 "timestamp='%s' secret='%s'",
+                 callId.data(), fromTag.data(), realm.data(),
+                 timestamp, mpNonceSignatureSecret->data()
                  );
     
-   // create the signature value by hashing the timestamp with
-   //   the callId, fromTag, the realm, and a secret
+   // Create the signature value by hashing the timestamp with
+   // the callId, fromTag, the realm, and a secret.
+   // Add separator commas between non-fixed-length components to
+   // ensure, e.g., callid 'ABC' and from-tag 'DEF' does not hash the
+   // same as callid 'ABCD' and from-tag 'EF'.
    NetMd5Codec md5;
    md5.hash(timestamp, HEX_TIMESTAMP_LENGTH);
    md5.hash(callId);
+   md5.hash(",");
    md5.hash(fromTag);
+   md5.hash(",");
    md5.hash(*mpNonceSignatureSecret);
+   md5.hash(",");
    md5.hash(realm);
 
    md5.appendHashValue(signatureValue);
diff --git a/sipXcommserverLib/src/sipdb/SubscriptionDB.cpp b/sipXcommserverLib/src/sipdb/SubscriptionDB.cpp
index 3be1954..127a990 100644
--- a/sipXcommserverLib/src/sipdb/SubscriptionDB.cpp
+++ b/sipXcommserverLib/src/sipdb/SubscriptionDB.cpp
@@ -473,6 +473,10 @@ SubscriptionDB::insertRow (
         }
         else
         {
+            OsSysLog::add(FAC_DB, PRI_DEBUG,
+                          "SubscriptionDB::insertRow inserting notifycseq for '%s' to: %d",
+                          callid.data(), notifyCseq);
+
             // Insert new row
             SubscriptionRow row;
             row.component = component;
@@ -894,7 +898,9 @@ SubscriptionDB::updateNotifyUnexpiredSubscription (
                    // Update the XML internal version number.
                    cursor->version = version;
                    cursor.update();
-                   OsSysLog::add(FAC_DB, PRI_DEBUG, "SubscriptionDB::updateNotifyUnexpiredSubscription updating notifycseq to: %d", updatedNotifyCseq);
+                   OsSysLog::add(FAC_DB, PRI_DEBUG,
+                                 "SubscriptionDB::updateNotifyUnexpiredSubscription updating notifycseq for '%s' to: %d",
+                                 callid.data(), updatedNotifyCseq);
                 }
 
                 // Next replaced with nextAvailable - better when 
diff --git a/sipXcommserverLib/src/sipdbtest/DEPRECATED b/sipXcommserverLib/src/sipdbtest/DEPRECATED
new file mode 100644
index 0000000..ba17a32
--- /dev/null
+++ b/sipXcommserverLib/src/sipdbtest/DEPRECATED
@@ -0,0 +1,7 @@
+This utility has been deprecated.  
+
+It is no longer built or installed by default.
+
+The source files will be removed entirely in a future release, 
+and XECS-1134 has been created to track this activity.
+
diff --git a/sipXcommserverLib/src/sipx-disable-on-distributed.in b/sipXcommserverLib/src/sipx-disable-on-distributed.in
new file mode 100644
index 0000000..160fb94
--- /dev/null
+++ b/sipXcommserverLib/src/sipx-disable-on-distributed.in
@@ -0,0 +1,62 @@
+#!@BASH@
+### -*- mode: shell-script;-*-
+###
+### sipx-disable-on-distributed
+###
+
+Action=DEFAULT
+Service=""
+
+while [ $# -ne 0 ]
+do
+    case ${1} in
+        ##
+        ## handle the 'end of options' marker
+        ##
+        --)
+            ;;
+
+        ##
+        ## handle an unknown switch
+        ##
+        -*)
+            Action=USAGE
+            break
+            ;;
+
+        *)
+            if [ -z "${Service}" ]
+            then
+                Service=${1}
+            else
+                echo "Too many arguments supplied: $@" 1>&2
+                Action=USAGE
+                break
+            fi
+            ;;
+    esac           
+
+    shift # always consume 1
+done
+
+if [ "${Action}" = "USAGE" -o -z "${Service}" ]
+then
+    cat <<USAGE
+
+Usage:
+    
+    sipx-disable-on-distributed <service-name>
+
+    Edits the sipX process definition file to disable the named service
+    if this system is not the master system of a sipXecs cluster.
+
+USAGE
+    exit
+fi
+
+libexecdir=${TEST_LIBEXECDIR:-@SIPX_LIBEXECDIR@}
+
+. ${libexecdir}/sipx-utils.sh || exit 1
+
+sipx_system_is_master && sipx_enable_service "${Service}" || sipx_disable_service "${Service}"
+
diff --git a/sipXcommserverLib/src/sipx-utils.sh.in b/sipXcommserverLib/src/sipx-utils.sh.in
index 0e2f344..181720a 100644
--- a/sipXcommserverLib/src/sipx-utils.sh.in
+++ b/sipXcommserverLib/src/sipx-utils.sh.in
@@ -3,8 +3,91 @@
 ### Utility script functions common to server startup scripts
 ###
 
+# sipx_services - prints the names of all installed sipX services (whether or not they are enabled)
 sipx_services() {
-    ls -1 @SIPX_PROCDIR@/*.process.xml | xargs @XARGS_REPLACE@% basename % .process.xml
+    ls -1 ${SIPX_CONFDIR:-@SIPX_CONFDIR@}/process.d/*.process.xml \
+    | xargs @XARGS_REPLACE@% basename % .process.xml
+}
+
+sipx_service_definition() {
+    local svc=$1
+    echo "${SIPX_CONFDIR:-@SIPX_CONFDIR@}/process.d/${svc}.process.xml"
+}
+
+sipx_service_is_installed() {
+    local svc=$1
+    local svc_def=`sipx_service_definition "${svc}"`
+    local installed
+    test -f "${svc_def}"
+    installed=$?
+    test ${installed} -ne 0 && echo "sipX service '${svc}' is not installed" 1>&2 
+    return ${installed}
+}
+
+# sipx_service_is_enabled( service-name ) - returns 0 (success) iff service is installed and enabled
+sipx_service_is_enabled() {
+    local svc=$1
+    sipx_service_is_installed "${svc}" || return 1
+    local svc_def=`sipx_service_definition "${svc}"`
+
+    local enabled
+    enabled=`perl -ne 'm|<watchdog-process +[^>]*\benable="(\w+)"| && print "$1"' ${svc_def} \
+        | tr A-Z a-z`
+    test "${enabled}" = "true"
+}
+
+# sipx_service_enable( service-name ) - edits process.d file to enable the service
+sipx_enable_service() {
+    local svc=$1
+    sipx_service_is_installed "${svc}" || return 1
+    sipx_service_is_enabled "${svc}"   && return 0
+
+    local svc_def=`sipx_service_definition "${svc}"`
+    if test -w "${svc_def}"
+    then
+        perl -pi -e 's|(<watchdog-process +[^>]*\benable=")\w+"|$1true"|' "${svc_def}"
+    else
+        echo "Process definition '${svc_def}' is not writable" 1>&2
+    fi
+    sipx_service_is_enabled "${svc}"
+}
+
+# sipx_service_disable( service-name ) - edits process.d file to enable the service
+sipx_disable_service() {
+    local svc=$1
+    sipx_service_is_installed "${svc}" 2> /dev/null || return 0
+    sipx_service_is_enabled "${svc}"                || return 0
+
+    local svc_def=`sipx_service_definition "${svc}"`
+    if test -w "${svc_def}"
+    then
+        perl -pi -e 's|(<watchdog-process +[^>]*\benable=")\w+"|$1false"|' ${svc_def}
+    else
+        echo "Process definition '${svc_def}' is not writable" 1>&2
+    fi
+    sipx_service_is_enabled "${svc}" 
+    test $? -ne 0
+}
+
+# sipx_system_is_master returns 1 (failure) if this system is known _not_ to be master
+sipx_system_is_master() {
+    if sipx_service_is_installed "sipxconfig" 2> /dev/null
+    then
+        if sipx_service_is_enabled "sipxconfig"
+        then
+            # this is the master
+            return 0
+        else
+            # installed but not enabled - not the master
+            return 1
+        fi
+    else
+        # sipxconfig not installed
+        # This is either not the master, or installation is not complete so it's ambiguous
+        # Because we don't want to disable services in the incomplete case, treat this as master;
+        # anyone who did a custom setup where this produces the wrong answer can cope with it.
+        return 0
+    fi
 }
 
 sipx_config_value() { # ( CONFIG-FILE, DIRECTIVE )
diff --git a/sipXcommserverLib/src/test/Makefile.am b/sipXcommserverLib/src/test/Makefile.am
index 2871ea7..7d655c7 100644
--- a/sipXcommserverLib/src/test/Makefile.am
+++ b/sipXcommserverLib/src/test/Makefile.am
@@ -19,7 +19,11 @@ endif
 
 ## All tests under this GNU variable should run relatively quickly
 ## and of course require no setup
-TESTS = testsuite sipx_config_value_test
+TESTS = \
+	testsuite \
+	sipx_config_value_test \
+	sipx_service_utils_test \
+	sipx-disable-on-distributed_test
 
 check_PROGRAMS = testsuite sandbox
 
@@ -59,6 +63,13 @@ EXTRA_DIST = \
 	mapdata/userpat.xml \
 	mapdata/vdigits.xml \
 	regdbdata/getMaxUpdate.xml \
+	sipx_service_utils/process.d/enabled_service.process.xml \
+	sipx_service_utils/process.d/disabled_service.process.xml \
+	sipx_service_utils/process.d/invalid_service.process.xml \
+	sipx-disable-on-distributed/master/process.d/sipxconfig.process.xml \
+	sipx-disable-on-distributed/master/process.d/master_only.process.xml \
+	sipx-disable-on-distributed/distributed/process.d/sipxconfig.process.xml \
+	sipx-disable-on-distributed/distributed/process.d/master_only.process.xml \
 	sipx_config_value/testdata
 
 # [DEBUG ASSISTANT] List a single unit test to isolate a unit test for
diff --git a/sipXcommserverLib/src/test/sipx-disable-on-distributed/distributed/process.d/master_only.process.xml b/sipXcommserverLib/src/test/sipx-disable-on-distributed/distributed/process.d/master_only.process.xml
new file mode 100644
index 0000000..cf76b46
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx-disable-on-distributed/distributed/process.d/master_only.process.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<watchdog-process enable="true" xmlns="http://www.sipfoundry.org/sipX/schema/xml/watchdogprocess-00-01">
+  <process_definitions>
+    <group name="CommServer" >
+        <process name="SIPRegistrar">
+            <dependentdelay wait="0" />
+            <stdout file="/dev/null" />
+            <stderr file="/dev/null" />
+            <stdin  file="" />
+
+            <start control="true">
+                <execute command="@bindir@/sipregistrar.sh"
+                         parameters=""
+                         defaultdir="@SIPX_LOGDIR@" />
+            </start>
+
+            <!-- If no execute, then kill -->
+            <stop control="true" />
+
+            <!-- If no execute, then stop-start -->
+            <restart control="true" />
+
+            <!-- <dependency>??</dependency> -->
+        </process>
+      </group>
+  </process_definitions>
+  <watchdog>
+   <monitor>
+      <monitor-process name="SIPRegistrar"
+         restart="enable" max_restarts="3" report="enable" max_reports="3">
+         <failure_contact method="email">@SIPXPBXUSER@@localhost</failure_contact>
+      </monitor-process>
+   </monitor>
+  </watchdog>
+</watchdog-process>
diff --git a/sipXcommserverLib/src/test/sipx-disable-on-distributed/distributed/process.d/sipxconfig.process.xml b/sipXcommserverLib/src/test/sipx-disable-on-distributed/distributed/process.d/sipxconfig.process.xml
new file mode 100644
index 0000000..45096c3
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx-disable-on-distributed/distributed/process.d/sipxconfig.process.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0"?>
+<watchdog-process enable="false" xmlns="http://www.sipfoundry.org/sipX/schema/xml/watchdogprocess-00-01">
+  <process_definitions>
+    <group name="ConfigServer">
+        <process name="ConfigServer">
+            <dependentdelay wait="0" />
+            <stdout file="/dev/null" />
+            <stderr file="/dev/null" />
+            <stdin  file="" />
+
+            <start control="true">
+                <execute command="/home/INST-SDL/xecs-HAsetup/bin/sipxconfig.sh"
+                         parameters=""
+                         defaultdir="/home/INST-SDL/xecs-HAsetup/var/log/sipxpbx" />
+            </start>
+            <stop control="true" />
+            <restart control="true" />
+        </process>
+    </group>
+  </process_definitions>
+  <watchdog>
+   <monitor>
+      <monitor-process name="ConfigServer" restart="enable" max_restarts="3" report="enable" max_reports="3">
+         <failure_contact method="email">lawrence@localhost</failure_contact>
+      </monitor-process>
+   </monitor>
+  </watchdog>
+</watchdog-process>
diff --git a/sipXcommserverLib/src/test/sipx-disable-on-distributed/incomplete/process.d/master_only.process.xml b/sipXcommserverLib/src/test/sipx-disable-on-distributed/incomplete/process.d/master_only.process.xml
new file mode 100644
index 0000000..cf76b46
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx-disable-on-distributed/incomplete/process.d/master_only.process.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<watchdog-process enable="true" xmlns="http://www.sipfoundry.org/sipX/schema/xml/watchdogprocess-00-01">
+  <process_definitions>
+    <group name="CommServer" >
+        <process name="SIPRegistrar">
+            <dependentdelay wait="0" />
+            <stdout file="/dev/null" />
+            <stderr file="/dev/null" />
+            <stdin  file="" />
+
+            <start control="true">
+                <execute command="@bindir@/sipregistrar.sh"
+                         parameters=""
+                         defaultdir="@SIPX_LOGDIR@" />
+            </start>
+
+            <!-- If no execute, then kill -->
+            <stop control="true" />
+
+            <!-- If no execute, then stop-start -->
+            <restart control="true" />
+
+            <!-- <dependency>??</dependency> -->
+        </process>
+      </group>
+  </process_definitions>
+  <watchdog>
+   <monitor>
+      <monitor-process name="SIPRegistrar"
+         restart="enable" max_restarts="3" report="enable" max_reports="3">
+         <failure_contact method="email">@SIPXPBXUSER@@localhost</failure_contact>
+      </monitor-process>
+   </monitor>
+  </watchdog>
+</watchdog-process>
diff --git a/sipXcommserverLib/src/test/sipx-disable-on-distributed/master/process.d/master_only.process.xml b/sipXcommserverLib/src/test/sipx-disable-on-distributed/master/process.d/master_only.process.xml
new file mode 100644
index 0000000..cf76b46
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx-disable-on-distributed/master/process.d/master_only.process.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<watchdog-process enable="true" xmlns="http://www.sipfoundry.org/sipX/schema/xml/watchdogprocess-00-01">
+  <process_definitions>
+    <group name="CommServer" >
+        <process name="SIPRegistrar">
+            <dependentdelay wait="0" />
+            <stdout file="/dev/null" />
+            <stderr file="/dev/null" />
+            <stdin  file="" />
+
+            <start control="true">
+                <execute command="@bindir@/sipregistrar.sh"
+                         parameters=""
+                         defaultdir="@SIPX_LOGDIR@" />
+            </start>
+
+            <!-- If no execute, then kill -->
+            <stop control="true" />
+
+            <!-- If no execute, then stop-start -->
+            <restart control="true" />
+
+            <!-- <dependency>??</dependency> -->
+        </process>
+      </group>
+  </process_definitions>
+  <watchdog>
+   <monitor>
+      <monitor-process name="SIPRegistrar"
+         restart="enable" max_restarts="3" report="enable" max_reports="3">
+         <failure_contact method="email">@SIPXPBXUSER@@localhost</failure_contact>
+      </monitor-process>
+   </monitor>
+  </watchdog>
+</watchdog-process>
diff --git a/sipXcommserverLib/src/test/sipx-disable-on-distributed/master/process.d/sipxconfig.process.xml b/sipXcommserverLib/src/test/sipx-disable-on-distributed/master/process.d/sipxconfig.process.xml
new file mode 100644
index 0000000..55d18eb
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx-disable-on-distributed/master/process.d/sipxconfig.process.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0"?>
+<watchdog-process enable="true" xmlns="http://www.sipfoundry.org/sipX/schema/xml/watchdogprocess-00-01">
+  <process_definitions>
+    <group name="ConfigServer">
+        <process name="ConfigServer">
+            <dependentdelay wait="0" />
+            <stdout file="/dev/null" />
+            <stderr file="/dev/null" />
+            <stdin  file="" />
+
+            <start control="true">
+                <execute command="/home/INST-SDL/xecs-HAsetup/bin/sipxconfig.sh"
+                         parameters=""
+                         defaultdir="/home/INST-SDL/xecs-HAsetup/var/log/sipxpbx" />
+            </start>
+            <stop control="true" />
+            <restart control="true" />
+        </process>
+    </group>
+  </process_definitions>
+  <watchdog>
+   <monitor>
+      <monitor-process name="ConfigServer" restart="enable" max_restarts="3" report="enable" max_reports="3">
+         <failure_contact method="email">lawrence@localhost</failure_contact>
+      </monitor-process>
+   </monitor>
+  </watchdog>
+</watchdog-process>
diff --git a/sipXcommserverLib/src/test/sipx-disable-on-distributed_test b/sipXcommserverLib/src/test/sipx-disable-on-distributed_test
new file mode 100755
index 0000000..4ee93a1
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx-disable-on-distributed_test
@@ -0,0 +1,49 @@
+#!/bin/sh
+
+fail() {
+    echo "$1" 1>&2
+    exit 1
+}
+
+. ../sipx-utils.sh || exit 1
+
+export SIPX_CONFDIR
+export TEST_LIBEXECDIR=..
+
+writabletestdata=./sipx-disable-on-distributed.writable
+
+reset_test_data() {
+
+    if [ -d ${writabletestdata}/process.d ]
+    then
+        rm -rf ${writabletestdata}/process.d/*
+    else
+        mkdir -p ${writabletestdata}/process.d 
+    fi
+    
+    cp "${1}"/*.process.xml ${writabletestdata}/process.d || exit 1
+}
+
+SIPX_CONFDIR=${writabletestdata}
+
+reset_test_data ${srcdir}/sipx-disable-on-distributed/master/process.d
+
+../sipx-disable-on-distributed master_only
+sipx_service_is_enabled master_only \
+|| fail "master_only not enabled on master" 
+
+reset_test_data ${srcdir}/sipx-disable-on-distributed/distributed/process.d
+
+../sipx-disable-on-distributed master_only
+sipx_service_is_enabled master_only \
+&& fail "master_only not disabled on distributed" 
+
+reset_test_data ${srcdir}/sipx-disable-on-distributed/incomplete/process.d
+
+../sipx-disable-on-distributed master_only
+sipx_service_is_enabled master_only \
+|| fail "master_only not enabled on incomplete" 
+
+rm -rf ${writabletestdata}
+
+exit 0
diff --git a/sipXcommserverLib/src/test/sipx_service_utils/process.d/disabled_service.process.xml b/sipXcommserverLib/src/test/sipx_service_utils/process.d/disabled_service.process.xml
new file mode 100644
index 0000000..9a69a6b
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx_service_utils/process.d/disabled_service.process.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<watchdog-process enable="false" xmlns="http://www.sipfoundry.org/sipX/schema/xml/watchdogprocess-00-01">
+  <process_definitions>
+    <group name="CommServer" >
+        <process name="SIPRegistrar">
+            <dependentdelay wait="0" />
+            <stdout file="/dev/null" />
+            <stderr file="/dev/null" />
+            <stdin  file="" />
+
+            <start control="true">
+                <execute command="@bindir@/sipregistrar.sh"
+                         parameters=""
+                         defaultdir="@SIPX_LOGDIR@" />
+            </start>
+
+            <!-- If no execute, then kill -->
+            <stop control="true" />
+
+            <!-- If no execute, then stop-start -->
+            <restart control="true" />
+
+            <!-- <dependency>??</dependency> -->
+        </process>
+      </group>
+  </process_definitions>
+  <watchdog>
+   <monitor>
+      <monitor-process name="SIPRegistrar"
+         restart="enable" max_restarts="3" report="enable" max_reports="3">
+         <failure_contact method="email">@SIPXPBXUSER@@localhost</failure_contact>
+      </monitor-process>
+   </monitor>
+  </watchdog>
+</watchdog-process>
diff --git a/sipXcommserverLib/src/test/sipx_service_utils/process.d/enabled_service.process.xml b/sipXcommserverLib/src/test/sipx_service_utils/process.d/enabled_service.process.xml
new file mode 100644
index 0000000..cf76b46
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx_service_utils/process.d/enabled_service.process.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<watchdog-process enable="true" xmlns="http://www.sipfoundry.org/sipX/schema/xml/watchdogprocess-00-01">
+  <process_definitions>
+    <group name="CommServer" >
+        <process name="SIPRegistrar">
+            <dependentdelay wait="0" />
+            <stdout file="/dev/null" />
+            <stderr file="/dev/null" />
+            <stdin  file="" />
+
+            <start control="true">
+                <execute command="@bindir@/sipregistrar.sh"
+                         parameters=""
+                         defaultdir="@SIPX_LOGDIR@" />
+            </start>
+
+            <!-- If no execute, then kill -->
+            <stop control="true" />
+
+            <!-- If no execute, then stop-start -->
+            <restart control="true" />
+
+            <!-- <dependency>??</dependency> -->
+        </process>
+      </group>
+  </process_definitions>
+  <watchdog>
+   <monitor>
+      <monitor-process name="SIPRegistrar"
+         restart="enable" max_restarts="3" report="enable" max_reports="3">
+         <failure_contact method="email">@SIPXPBXUSER@@localhost</failure_contact>
+      </monitor-process>
+   </monitor>
+  </watchdog>
+</watchdog-process>
diff --git a/sipXcommserverLib/src/test/sipx_service_utils/process.d/invalid_service.process.xml b/sipXcommserverLib/src/test/sipx_service_utils/process.d/invalid_service.process.xml
new file mode 100644
index 0000000..fb34d9b
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx_service_utils/process.d/invalid_service.process.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<not-a-watchdog-process enable="true" xmlns="http://www.sipfoundry.org/sipX/schema/xml/invalid">
+   <other/>
+</not-a-watchdog-process>
diff --git a/sipXcommserverLib/src/test/sipx_service_utils_test b/sipXcommserverLib/src/test/sipx_service_utils_test
new file mode 100755
index 0000000..f576410
--- /dev/null
+++ b/sipXcommserverLib/src/test/sipx_service_utils_test
@@ -0,0 +1,103 @@
+#!/bin/sh
+
+. ../sipx-utils.sh || exit 1
+
+fail() {
+    echo "$1" 1>&2
+    exit 1
+}
+
+export SIPX_CONFDIR
+
+testdatasrc=${srcdir}/sipx_service_utils
+SIPX_CONFDIR=${testdatasrc}
+
+correct_services=" disabled_service enabled_service invalid_service"
+services=""
+for svc in `sipx_services | sort`; do services="${services} ${svc}"; done
+
+test "${services}" = "${correct_services}" \
+|| fail "incorrect services list: '${services}' != '${correct_services}'" 
+
+correct_def="${srcdir}/sipx_service_utils/process.d/service.process.xml"
+svc_def=`sipx_service_definition service`
+
+test "${svc_def}" = "${correct_def}" \
+|| fail "incorrect service defintion file: '${svc_def}' != '${correct_def}'" 
+
+sipx_service_is_installed enabled_service \
+|| fail "installed service not detected for enabled_service" 
+
+sipx_service_is_installed nonexistent_service 2> /dev/null \
+&& fail "non-installed service returned installed for nonexistent_service" 
+
+sipx_service_is_enabled enabled_service \
+|| fail "enabled service not enabled" 
+
+sipx_service_is_enabled disabled_service \
+&& fail "disabled service is enabled" 
+
+sipx_service_is_enabled invalid_service \
+&& fail "invalid service is enabled" 
+
+sipx_service_is_enabled nonexistent_service 2> /dev/null \
+&& fail "nonexistent service is enabled" 
+
+writabletestdata=./sipx_service_utils.writable
+
+reset_test_data() {
+    test -d "${writabletestdata}" \
+        && rm -rf "${writabletestdata}"/* \
+        || mkdir -p "${writabletestdata}" 
+    cp -a "${testdatasrc}"/* "${writabletestdata}" || exit 1
+}
+
+SIPX_CONFDIR=${writabletestdata}
+
+reset_test_data
+
+sipx_enable_service enabled_service \
+|| fail "enabling enabled service failed" 
+
+sipx_service_is_enabled enabled_service \
+|| fail "did not enable enabled service" 
+
+
+sipx_enable_service disabled_service \
+|| fail "enabling disabled service failed" 
+
+sipx_service_is_enabled disabled_service \
+|| fail "did not disable disabled service" 
+
+
+sipx_enable_service invalid_service \
+&& fail "enabling invalid service succeeded" 
+
+sipx_service_is_enabled invalid_service \
+&& fail "invalid service was enabled" 
+
+reset_test_data
+
+sipx_disable_service enabled_service \
+|| fail "disabling enabled service failed" 
+
+sipx_service_is_enabled enabled_service \
+&& fail "disable enabled enabled service" 
+
+
+sipx_disable_service disabled_service \
+|| fail "disabling disabled service failed" 
+
+sipx_service_is_enabled disabled_service \
+&& fail "disable enabled disabled service" 
+
+
+sipx_disable_service invalid_service \
+|| fail "disabling invalid service failed" 
+
+sipx_service_is_enabled invalid_service \
+&& fail "disable enabled invalid service" 
+
+rm -rf ${writabletestdata}
+
+exit 0
diff --git a/sipXcommserverLib/src/xsdvalid/xsdvalid.cpp b/sipXcommserverLib/src/xsdvalid/xsdvalid.cpp
index 7d9dd2a..c8f16d9 100644
--- a/sipXcommserverLib/src/xsdvalid/xsdvalid.cpp
+++ b/sipXcommserverLib/src/xsdvalid/xsdvalid.cpp
@@ -228,7 +228,9 @@ int main(int argC, char* argV[])
            XERCES_STD_QUALIFIER cerr
               << "xsdvalid version " << SipXcommserverlibVersion
               << " build " << SipXcommserverlibBuildStamp
+              << "\n  xerces-c library version " << gXercesVersionStr
               << "\n" << XERCES_STD_QUALIFIER endl;
+              
            return 0;
         }
         else if (!strcmp(argV[argInd], "-l")