diff --git a/source4/librpc/idl/winreg.idl b/source4/librpc/idl/winreg.idl
index 2dbd4de944e..d7211725071 100644
--- a/source4/librpc/idl/winreg.idl
+++ b/source4/librpc/idl/winreg.idl
@@ -125,42 +125,30 @@
 		[in,out]    winreg_Time *last_changed_time
 	);
 
-        typedef struct {
-	        uint32 max_len;
-	        uint32 offset;
- 	        uint32 len;
-        } EnumValueIn;
-
-        typedef struct {
-                uint16 len;
-                uint16 max_len;
-                EnumValueIn *buffer;
-        } EnumValueNameIn;
-
-        typedef struct {
-	        uint32 max_len;
-	        uint32 offset;
-	        DATA_BLOB buffer;
-        } EnumValueOut;
-
-        typedef struct {
-                uint16 len;
-                uint16 max_len;
-                unistr *name;
-        } EnumValueNameOut;
-
 	/******************/
 	/* Function: 0x0a */
+
+	/* 
+	   this is equivalent IDL to a winreg_String, but we need to
+	   have absolute control over the length/size fields as the
+	   server looks at those to see what size buffer we have, so
+	   we can't use the automatic unistr handing in pidl.
+	*/
+	typedef struct {
+		uint16 length;
+		uint16 size;
+		[size_is(size/2),length_is(length/2)] uint16 *name;
+	} winreg_EnumValueString;
+
 	WERROR winreg_EnumValue(
 		[in,ref] policy_handle *handle,
-		[in] uint32 enum_index,
-		[in] EnumValueNameIn name_in,
-		[out] EnumValueNameOut name_out,
+		[in]     uint32 enum_index,
+		[in]     winreg_EnumValueString name_in,
+		[out]    winreg_String name_out,
 		[in,out] uint32 *type,
-		[in] EnumValueIn *value_in,
-		[out] EnumValueOut *value_out,
-		[in,out] uint32 *value_len1,
-		[in,out] uint32 *value_len2
+		[in,out,size_is(*size),length_is(*length)] uint8 *value,
+		[in,out] uint32 *size,
+		[in,out] uint32 *length
 	);
 
 	/******************/
diff --git a/source4/torture/rpc/winreg.c b/source4/torture/rpc/winreg.c
index 592f2ff86ab..6f44034273a 100644
--- a/source4/torture/rpc/winreg.c
+++ b/source4/torture/rpc/winreg.c
@@ -293,12 +293,9 @@ static BOOL test_QueryValue(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, struct p
 {
 	struct winreg_QueryValue r;
 	NTSTATUS status;
-	struct EnumValueNameOut valname;
 	uint32 zero = 0;
 	uint32 offered = 0xfff;
 
-	valname.name = valuename;
-
 	printf("Testing QueryValue\n");
 
 	r.in.handle = handle;
@@ -325,29 +322,23 @@ static BOOL test_EnumValue(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 			   struct policy_handle *handle, int max_valnamelen, int max_valbufsize)
 {
 	struct winreg_EnumValue r;
-	struct EnumValueIn buf_name;
-	struct EnumValueIn buf_val;
 	uint32 type;
-	uint32 len1 = max_valbufsize, len2 = 0;
+	uint32 size = max_valbufsize, zero = 0;
 	BOOL ret = True;
+	uint8_t buf8;
+	uint16_t buf16;
 
 	printf("testing EnumValue\n");
 
 	r.in.handle = handle;
 	r.in.enum_index = 0;
-	r.in.name_in.len = 0;
-	r.in.name_in.max_len = max_valnamelen * 2;
-	buf_name.max_len = max_valnamelen;
-	buf_name.offset = 0;
-	buf_name.len = 0;
-	r.in.name_in.buffer = &buf_name;
+	r.in.name_in.length = 0;
+	r.in.name_in.size = 0x200;
+	r.in.name_in.name = &buf16;
 	r.in.type = &type;
-	buf_val.max_len = max_valbufsize;
-	buf_val.offset = 0;
-	buf_val.len = 0;
-	r.in.value_in = &buf_val;
-	r.in.value_len1 = &len1;
-	r.in.value_len2 = &len2;
+	r.in.value = &buf8;
+	r.in.length = &zero;
+	r.in.size = &size;
 	
 	do {
 		NTSTATUS status = dcerpc_winreg_EnumValue(p, mem_ctx, &r);