diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
index dab46f01e59..12185f999d6 100644
--- a/source4/dsdb/common/util.c
+++ b/source4/dsdb/common/util.c
@@ -3362,44 +3362,6 @@ int dsdb_load_udv_v1(struct ldb_context *samdb, struct ldb_dn *dn, TALLOC_CTX *m
 	return LDB_SUCCESS;
 }
 
-
-/*
-  a modify with the 'permissive' control
-  this means no error for entries that already exist on adds, or
-  removal of entries that don't exist
-*/
-int dsdb_modify_permissive(struct ldb_context *ldb,
-			   const struct ldb_message *message)
-{
-	struct ldb_request *req;
-	int ret;
-
-	ret = ldb_build_mod_req(&req, ldb, ldb,
-				message,
-				NULL,
-				NULL,
-				ldb_op_default_callback,
-				NULL);
-
-	if (ret != LDB_SUCCESS) return ret;
-
-	ret = ldb_request_add_control(req, LDB_CONTROL_PERMISSIVE_MODIFY_OID, false, NULL);
-	if (ret != LDB_SUCCESS) {
-		talloc_free(req);
-		return ret;
-	}
-
-	ret = ldb_request(ldb, req);
-	if (ret == LDB_SUCCESS) {
-		ret = ldb_wait(req->handle, LDB_WAIT_ALL);
-	}
-
-	talloc_free(req);
-	return ret;
-}
-
-
-
 /*
   add a set of controls to a ldb_request structure based on a set of
   flags. See util.h for a list of available flags
@@ -3465,5 +3427,45 @@ int dsdb_request_add_controls(struct ldb_request *req, uint32_t dsdb_flags)
 		}
 	}
 
+	if (dsdb_flags & DSDB_MODIFY_PERMISSIVE) {
+		ret = ldb_request_add_control(req, LDB_CONTROL_PERMISSIVE_MODIFY_OID, false, NULL);
+		if (ret != LDB_SUCCESS) {
+			return ret;
+		}
+	}
+
 	return LDB_SUCCESS;
 }
+
+/*
+  a modify with a set of controls
+*/
+int dsdb_modify(struct ldb_context *ldb, const struct ldb_message *message,
+		uint32_t dsdb_flags)
+{
+	struct ldb_request *req;
+	int ret;
+
+	ret = ldb_build_mod_req(&req, ldb, ldb,
+				message,
+				NULL,
+				NULL,
+				ldb_op_default_callback,
+				NULL);
+
+	if (ret != LDB_SUCCESS) return ret;
+
+	ret = dsdb_request_add_controls(req, dsdb_flags);
+	if (ret != LDB_SUCCESS) {
+		talloc_free(req);
+		return ret;
+	}
+
+	ret = ldb_request(ldb, req);
+	if (ret == LDB_SUCCESS) {
+		ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+	}
+
+	talloc_free(req);
+	return ret;
+}
diff --git a/source4/dsdb/common/util.h b/source4/dsdb/common/util.h
index 9152ac4220e..590653acc2d 100644
--- a/source4/dsdb/common/util.h
+++ b/source4/dsdb/common/util.h
@@ -29,3 +29,4 @@
 #define DSDB_SEARCH_REVEAL_INTERNALS          0x0008
 #define DSDB_SEARCH_SHOW_EXTENDED_DN          0x0010
 #define DSDB_MODIFY_RELAX		      0x0020
+#define DSDB_MODIFY_PERMISSIVE		      0x0040
diff --git a/source4/rpc_server/drsuapi/addentry.c b/source4/rpc_server/drsuapi/addentry.c
index b1c361da57a..b9d04c20f5f 100644
--- a/source4/rpc_server/drsuapi/addentry.c
+++ b/source4/rpc_server/drsuapi/addentry.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "rpc_server/dcerpc_server.h"
 #include "dsdb/samdb/samdb.h"
+#include "dsdb/common/util.h"
 #include "param/param.h"
 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
 #include "librpc/gen_ndr/ndr_drsuapi.h"
@@ -128,7 +129,7 @@ static WERROR drsuapi_add_SPNs(struct drsuapi_bind_state *b_state,
 			return WERR_NOMEM;
 		}
 
-		ret = dsdb_modify_permissive(b_state->sam_ctx, msg);
+		ret = dsdb_modify(b_state->sam_ctx, msg, DSDB_MODIFY_PERMISSIVE);
 		if (ret != LDB_SUCCESS) {
 			DEBUG(0,(__location__ ": Failed to add SPNs - %s\n",
 				 ldb_errstring(b_state->sam_ctx)));
diff --git a/source4/rpc_server/drsuapi/writespn.c b/source4/rpc_server/drsuapi/writespn.c
index 65a7183d11a..71ff49d5099 100644
--- a/source4/rpc_server/drsuapi/writespn.c
+++ b/source4/rpc_server/drsuapi/writespn.c
@@ -23,6 +23,7 @@
 #include "includes.h"
 #include "rpc_server/dcerpc_server.h"
 #include "dsdb/samdb/samdb.h"
+#include "dsdb/common/util.h"
 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
 
 /*
@@ -95,7 +96,7 @@ WERROR dcesrv_drsuapi_DsWriteAccountSpn(struct dcesrv_call_state *dce_call, TALL
 			}
 
 			/* Apply to database */
-			ret = dsdb_modify_permissive(b_state->sam_ctx, msg);
+			ret = dsdb_modify(b_state->sam_ctx, msg, DSDB_MODIFY_PERMISSIVE);
 			if (ret != 0) {
 				DEBUG(0,("Failed to modify SPNs on %s: %s\n",
 					 ldb_dn_get_linearized(msg->dn),