diff --git a/python/samba/netcmd/domain/models/__init__.py b/python/samba/netcmd/domain/models/__init__.py
index e65331fdf78..3ca6c898197 100644
--- a/python/samba/netcmd/domain/models/__init__.py
+++ b/python/samba/netcmd/domain/models/__init__.py
@@ -30,6 +30,6 @@ from .model import MODELS
 from .schema import AttributeSchema, ClassSchema
 from .site import Site
 from .subnet import Subnet
-from .types import AccountType
+from .types import AccountType, SystemFlags
 from .user import User
 from .value_type import ValueType
diff --git a/python/samba/netcmd/domain/models/group.py b/python/samba/netcmd/domain/models/group.py
index 947312783c0..ab10654ad16 100644
--- a/python/samba/netcmd/domain/models/group.py
+++ b/python/samba/netcmd/domain/models/group.py
@@ -20,8 +20,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 
-from .fields import BooleanField, DnField, IntegerField, SIDField, StringField
+from .fields import (BooleanField, DnField, EnumField, IntegerField, SIDField,
+                     StringField)
 from .model import Model
+from .types import SystemFlags
 
 
 class Group(Model):
@@ -31,7 +33,7 @@ class Group(Model):
                                              default=False, readonly=True)
     member = DnField("member", many=True)
     object_sid = SIDField("objectSid")
-    system_flags = IntegerField("systemFlags")
+    system_flags = EnumField("systemFlags", SystemFlags)
 
     @staticmethod
     def get_object_class():
diff --git a/python/samba/netcmd/domain/models/types.py b/python/samba/netcmd/domain/models/types.py
index 83af9327940..146c7f26fc7 100644
--- a/python/samba/netcmd/domain/models/types.py
+++ b/python/samba/netcmd/domain/models/types.py
@@ -22,13 +22,26 @@
 
 from enum import IntFlag
 
-from samba.dsdb import (ATYPE_SECURITY_GLOBAL_GROUP,
-                        ATYPE_SECURITY_LOCAL_GROUP,
-                        ATYPE_NORMAL_ACCOUNT,
-                        ATYPE_DISTRIBUTION_GLOBAL_GROUP,
-                        ATYPE_DISTRIBUTION_LOCAL_GROUP,
-                        ATYPE_WORKSTATION_TRUST,
-                        ATYPE_INTERDOMAIN_TRUST)
+from samba.dsdb import (
+    ATYPE_SECURITY_GLOBAL_GROUP,
+    ATYPE_SECURITY_LOCAL_GROUP,
+    ATYPE_NORMAL_ACCOUNT,
+    ATYPE_DISTRIBUTION_GLOBAL_GROUP,
+    ATYPE_DISTRIBUTION_LOCAL_GROUP,
+    ATYPE_WORKSTATION_TRUST,
+    ATYPE_INTERDOMAIN_TRUST,
+    SYSTEM_FLAG_CR_NTDS_NC,
+    SYSTEM_FLAG_CR_NTDS_DOMAIN,
+    SYSTEM_FLAG_CR_NTDS_NOT_GC_REPLICATED,
+    SYSTEM_FLAG_ATTR_IS_RDN,
+    SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE,
+    SYSTEM_FLAG_CONFIG_ALLOW_MOVE,
+    SYSTEM_FLAG_CONFIG_ALLOW_RENAME,
+    SYSTEM_FLAG_DISALLOW_DELETE,
+    SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE,
+    SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE,
+    SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME
+)
 
 
 class AccountType(IntFlag):
@@ -39,3 +52,17 @@ class AccountType(IntFlag):
     DISTRIBUTION_LOCAL_GROUP = ATYPE_DISTRIBUTION_LOCAL_GROUP
     WORKSTATION_TRUST = ATYPE_WORKSTATION_TRUST
     INTERDOMAIN_TRUST = ATYPE_INTERDOMAIN_TRUST
+
+
+class SystemFlags(IntFlag):
+    CR_NTDS_NC = SYSTEM_FLAG_CR_NTDS_NC
+    CR_NTDS_DOMAIN = SYSTEM_FLAG_CR_NTDS_DOMAIN
+    CR_NTDS_NOT_GC_REPLICATED = SYSTEM_FLAG_CR_NTDS_NOT_GC_REPLICATED
+    ATTR_IS_RDN = SYSTEM_FLAG_ATTR_IS_RDN
+    CONFIG_ALLOW_LIMITED_MOVE = SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE
+    CONFIG_ALLOW_MOVE = SYSTEM_FLAG_CONFIG_ALLOW_MOVE
+    CONFIG_ALLOW_RENAME = SYSTEM_FLAG_CONFIG_ALLOW_RENAME
+    DISALLOW_DELETE = SYSTEM_FLAG_DISALLOW_DELETE
+    DISALLOW_MOVE_ON_DELETE = SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE
+    DOMAIN_DISALLOW_MOVE = SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE
+    DOMAIN_DISALLOW_RENAME = SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME