diff --git a/0004-Always-generate-kpasswdinfo-file.patch b/0004-Always-generate-kpasswdinfo-file.patch
new file mode 100644
index 0000000..9c16404
--- /dev/null
+++ b/0004-Always-generate-kpasswdinfo-file.patch
@@ -0,0 +1,28 @@
+From 39efef47b659fa952a9ac73f948688ebfbc0d5de Mon Sep 17 00:00:00 2001
+From: Stephen Gallagher <sgallagh@redhat.com>
+Date: Mon, 18 Apr 2011 11:11:13 -0400
+Subject: [PATCH] Always generate kpasswdinfo file
+
+Previously, we only generated it when performing a password change,
+but this didn't play nicely with kpasswd.
+---
+ src/providers/krb5/krb5_auth.c |    3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
+index 379a97be6446bdf0fc5c9bc120c561a532d454cf..55a06a511688d6c9511a4f68db47046a4bfdc737 100644
+--- a/src/providers/krb5/krb5_auth.c
++++ b/src/providers/krb5/krb5_auth.c
+@@ -523,8 +523,7 @@ static void krb5_resolve_kdc_done(struct tevent_req *subreq)
+         be_mark_offline(state->be_ctx);
+         kr->is_offline = true;
+     } else {
+-        if (state->pd->cmd == SSS_PAM_CHAUTHTOK &&
+-            kr->krb5_ctx->kpasswd_service != NULL) {
++        if (kr->krb5_ctx->kpasswd_service != NULL) {
+             subreq = be_resolve_server_send(state, state->ev, state->be_ctx,
+                                             kr->krb5_ctx->kpasswd_service->name);
+             if (subreq == NULL) {
+-- 
+1.7.4.4
+
diff --git a/sssd.spec b/sssd.spec
index 61108f6..bd6890b 100644
--- a/sssd.spec
+++ b/sssd.spec
@@ -9,7 +9,7 @@
 
 Name: sssd
 Version: 1.5.5
-Release: 4%{?dist}
+Release: 5%{?dist}
 Group: Applications/System
 Summary: System Security Services Daemon
 License: GPLv3+
@@ -21,6 +21,8 @@ BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 Patch0001: 0001-memberof-fix-calculation-of-replaced-members.patch
 Patch0002: 0002-memberof-free-delete-operation-apyload-once-done.patch
 Patch0003: 0003-Never-remove-gecos-from-the-sysdb-cache.patch
+Patch0004: 0004-Always-generate-kpasswdinfo-file.patch
+
 ### Dependencies ###
 
 Requires: libldb = %{ldb_version}
@@ -116,6 +118,7 @@ use with ldap_default_authtok_type = obfuscated_password.
 %patch0001 -p1
 %patch0002 -p1
 %patch0003 -p1
+%patch0004 -p1
 
 %build
 autoreconf -ivf
@@ -275,11 +278,17 @@ if [ $1 = 0 ]; then
     /bin/systemctl stop sssd.service > /dev/null 2>&1 || :
 fi
 
-%triggerun -- sssd < 1.5.5-4
-if /sbin/chkconfig sssd ; then
+%triggerun -- sssd < 1.5.5-5
+if /sbin/chkconfig --level 3 sssd ; then
         /bin/systemctl --no-reload enable sssd.service >/dev/null 2>&1 || :
 fi
 
+if /sbin/chkconfig --level 5 sssd ; then
+        /bin/systemctl --no-reload enable sssd.service >/dev/null 2>&1 || :
+fi
+
+
+
 %postun
 /sbin/ldconfig
 /bin/systemctl daemon-reload >/dev/null 2>&1 || :
@@ -294,6 +303,11 @@ fi
 %postun client -p /sbin/ldconfig
 
 %changelog
+* Wed Apr 20 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
+- Resolves: rhbz#697057 - kpasswd fails when using sssd and
+-                         kadmin server != kdc server
+- Upgrades from SysV should now maintain enabled/disabled status
+
 * Mon Apr 18 2011 Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-4
 - Fix %%postun