diff --git a/source3/lib/smbconf/smbconf_private.h b/source3/lib/smbconf/smbconf_private.h
index 6250dc73396..e08a2b186a1 100644
--- a/source3/lib/smbconf/smbconf_private.h
+++ b/source3/lib/smbconf/smbconf_private.h
@@ -54,9 +54,9 @@ struct smbconf_ops {
 };
 
 struct smbconf_ctx {
-	NT_USER_TOKEN *token;
 	const char *path;
 	struct smbconf_ops *ops;
+	void *data; /* private data for use in backends */
 };
 
 WERROR smbconf_add_string_to_array(TALLOC_CTX *mem_ctx,
diff --git a/source3/lib/smbconf/smbconf_reg.c b/source3/lib/smbconf/smbconf_reg.c
index beb1c20de6e..aaa03e21e85 100644
--- a/source3/lib/smbconf/smbconf_reg.c
+++ b/source3/lib/smbconf/smbconf_reg.c
@@ -20,6 +20,9 @@
 #include "includes.h"
 #include "smbconf_private.h"
 
+struct reg_private_data {
+	NT_USER_TOKEN *token;
+};
 
 /**********************************************************************
  *
@@ -27,6 +30,11 @@
  *
  **********************************************************************/
 
+static struct reg_private_data *rpd(struct smbconf_ctx *ctx)
+{
+	return (struct reg_private_data *)(ctx->data);
+}
+
 /**
  * Open a registry key specified by "path"
  */
@@ -44,7 +52,7 @@ static WERROR smbconf_reg_open_path(TALLOC_CTX *mem_ctx,
 		goto done;
 	}
 
-	if (ctx->token == NULL) {
+	if (rpd(ctx)->token == NULL) {
 		DEBUG(1, ("Error: token missing from smbconf_ctx. "
 			  "was smbconf_init() called?\n"));
 		werr = WERR_INVALID_PARAM;
@@ -57,7 +65,8 @@ static WERROR smbconf_reg_open_path(TALLOC_CTX *mem_ctx,
 		goto done;
 	}
 
-	werr = reg_open_path(mem_ctx, path, desired_access, ctx->token, key);
+	werr = reg_open_path(mem_ctx, path, desired_access, rpd(ctx)->token,
+			     key);
 
 	if (!W_ERROR_IS_OK(werr)) {
 		DEBUG(1, ("Error opening registry path '%s': %s\n",
@@ -385,17 +394,20 @@ static WERROR smbconf_reg_init(struct smbconf_ctx *ctx, const char *path)
 		goto done;
 	}
 
+	ctx->data = TALLOC_ZERO_P(ctx, struct reg_private_data);
+
+	werr = ntstatus_to_werror(registry_create_admin_token(ctx,
+							&(rpd(ctx)->token)));
+	if (!W_ERROR_IS_OK(werr)) {
+		DEBUG(1, ("Error creating admin token\n"));
+		goto done;
+	}
+
 	if (!registry_init_smbconf()) {
 		werr = WERR_REG_IO_FAILURE;
 		goto done;
 	}
 
-	werr = ntstatus_to_werror(registry_create_admin_token(ctx,
-							      &(ctx->token)));
-	if (!W_ERROR_IS_OK(werr)) {
-		DEBUG(1, ("Error creating admin token\n"));
-		goto done;
-	}
 
 done:
 	return werr;