diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 67bdb963cca..6d1368c42b1 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -69,6 +69,27 @@ never took into account later changes, and so has not worked for a
 number of years.  Samba 4.21 and LDB 2.10 removes this unused and
 broken feature.
 
+Some Samba public libraries made private by default
+---------------------------------------------------
+
+The following Samba C libraries are currently made public due to their
+use by OpenChange or for historical reasons that are no longer clear.
+
+ dcerpc-samr, samba-policy, tevent-util, dcerpc, samba-hostconfig,
+ samba-credentials, dcerpc_server, samdb
+
+The libraries used by the OpenChange client now private, but can be
+made public (like ldb above) with:
+
+ ./configure --private-libraries='!dcerpc,!samba-hostconfig,!samba-credentials,!ldb'
+
+The C libraries without any known user or used only for the OpenChange
+server (a dead project) may be made private entirely in a future Samba
+version.
+
+If you use a Samba library in this list, please be in touch with the
+samba-technical mailing list.
+
 Using ldaps from 'winbindd' and 'net ads'
 -----------------------------------------
 
diff --git a/wscript b/wscript
index 2959b083d47..be4f3122af6 100644
--- a/wscript
+++ b/wscript
@@ -16,7 +16,25 @@ from waflib.Tools import bison
 samba_dist.DIST_DIRS('.')
 samba_dist.DIST_BLACKLIST('.gitignore .bzrignore source4/selftest/provisions')
 
-DEFAULT_PRIVATE_LIBS = ["ldb"]
+# A function so the variables are not in global scope
+def get_default_private_libs():
+    # LDB is used by sssd (was made private by default in Samba 4.21)
+    SSSD_LIBS=["ldb"]
+    # These following libs without ABI checking were made private by default in Samba 4.21
+    # Presumably unused (dcerpc-samr was probably a copy and paste error,
+    # and samba-policy has primary use via python bindings).  tevent-util
+    # was for openchange but was for PIDL output that is no longer
+    # generated
+    POSSIBLY_UNUSED_LIBS=["dcerpc-samr","samba-policy","tevent-util"]
+    # These were used by mapiproxy in OpenChange (also used LDB and
+    # the real public libs tdb, talloc, tevent)
+    OPENCHANGE_SERVER_LIBS = ["dcerpc_server","samdb"]
+    # These (plus LDB, ndr, talloc, tevent) are used by the OpenChange
+    # client, which is still in use (Fedora/Red Hat packages it)
+    OPENCHANGE_LIBS = ["dcerpc","samba-hostconfig","samba-credentials"]
+    return SSSD_LIBS + POSSIBLY_UNUSED_LIBS + OPENCHANGE_LIBS + OPENCHANGE_SERVER_LIBS
+
+DEFAULT_PRIVATE_LIBS = get_default_private_libs()
 
 # install in /usr/local/samba by default
 default_prefix = Options.default_prefix = '/usr/local/samba'