--- samba-4.4.0rc2/source3/wscript
+++ samba-4.4.0rc2/source3/wscript
@@ -870,7 +870,7 @@
         if conf.env.with_iconv:
             conf.DEFINE('HAVE_ICONV', 1)
 
-    if Options.options.with_pam:
+    if Options.options.with_pam != False:
         use_pam=True
         conf.CHECK_HEADERS('security/pam_appl.h pam/pam_appl.h')
         if not conf.CONFIG_SET('HAVE_SECURITY_PAM_APPL_H') and not conf.CONFIG_SET('HAVE_PAM_PAM_APPL_H'):
@@ -943,6 +943,17 @@
             conf.DEFINE('WITH_PAM', 1)
             conf.DEFINE('WITH_PAM_MODULES', 1)
 
+    else:
+        Logs.warn("PAM disabled")
+        use_pam=False
+        conf.undefine('WITH_PAM')
+        conf.undefine('WITH_PAM_MODULES')
+        conf.undefine('HAVE_SECURITY_PAM_APPL_H')
+        conf.undefine('PAM_RHOST')
+        conf.undefine('PAM_TTY')
+        conf.undefine('HAVE_PAM_PAM_APPL_H')
+
+
     seteuid = False
 
 #