diff --git a/pkgs/servers/samba/default.nix b/pkgs/servers/samba/3.x.nix
similarity index 100%
rename from pkgs/servers/samba/default.nix
rename to pkgs/servers/samba/3.x.nix
diff --git a/pkgs/servers/samba/4.x-no-persistent-install.patch b/pkgs/servers/samba/4.x-no-persistent-install.patch
new file mode 100644
index 00000000000..68d0cf76aa5
--- /dev/null
+++ b/pkgs/servers/samba/4.x-no-persistent-install.patch
@@ -0,0 +1,18 @@
+diff --git a/dynconfig/wscript b/dynconfig/wscript
+index aa4e66e..d53f433 100755
+--- a/dynconfig/wscript
++++ b/dynconfig/wscript
+@@ -379,9 +379,9 @@ def build(bld):
+                         cflags=cflags)
+ 
+     # install some extra empty directories
+-    bld.INSTALL_DIRS("", "${CONFIGDIR} ${PRIVATE_DIR} ${LOGFILEBASE}");
+-    bld.INSTALL_DIRS("", "${PRIVATE_DIR} ${PRIVILEGED_SOCKET_DIR}")
+-    bld.INSTALL_DIRS("", "${STATEDIR} ${CACHEDIR}");
++    #bld.INSTALL_DIRS("", "${CONFIGDIR} ${PRIVATE_DIR} ${LOGFILEBASE}");
++    #bld.INSTALL_DIRS("", "${PRIVATE_DIR} ${PRIVILEGED_SOCKET_DIR}")
++    #bld.INSTALL_DIRS("", "${STATEDIR} ${CACHEDIR}");
+ 
+     # these might be on non persistent storage
+-    bld.INSTALL_DIRS("", "${LOCKDIR} ${PIDDIR} ${SOCKET_DIR}")
++    #bld.INSTALL_DIRS("", "${LOCKDIR} ${PIDDIR} ${SOCKET_DIR}")
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
new file mode 100644
index 00000000000..99d88c728a3
--- /dev/null
+++ b/pkgs/servers/samba/4.x.nix
@@ -0,0 +1,109 @@
+{ stdenv, fetchurl, python, pkgconfig, perl, libxslt, docbook_xsl_ns
+, docbook_xml_dtd_42, readline, talloc, ntdb, tdb, tevent, ldb, popt, iniparser
+, pythonPackages
+
+# source3/wscript optionals
+, heimdal ? null # Samba only supports heimdal for kerberos although mit-krb5 is being worked on
+, openldap ? null
+, cups ? null
+, pam ? null
+, avahi ? null
+, acl ? null
+, libaio ? null
+, fam ? null
+, ctdb ? null
+, ceph ? null
+, glusterfs ? null
+
+# buildtools/wafsamba/wscript optionals
+, libiconv ? null
+, gettext ? null
+
+# source4/lib/tls/wscript optionals
+, gnutls ? null
+, libgcrypt ? null
+, libgpgerror ? null
+
+# other optionals
+, zlib ? null
+, ncurses ? null
+, libcap ? null
+}:
+
+stdenv.mkDerivation rec {
+  name = "samba-4.1.14";
+
+  src = fetchurl {
+    url = "http://samba.org/samba/ftp/stable/${name}.tar.gz";
+    sha256 = "1ficvglapxcw4zrgwkmmjbprsqrxks3ii29nblsr4wlrram4p8ay";
+  };
+
+  patches = [ ./4.x-no-persistent-install.patch ];
+
+  buildInputs = [
+    python pkgconfig perl libxslt docbook_xsl_ns docbook_xml_dtd_42
+    readline talloc ntdb tdb tevent ldb popt iniparser pythonPackages.subunit
+
+    heimdal openldap cups pam avahi acl libaio fam ctdb ceph glusterfs
+
+    libiconv gettext
+
+    gnutls libgcrypt libgpgerror
+
+    zlib ncurses libcap
+  ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [
+    # source3/wscript options
+    "--with-static-modules=NONE"
+    "--with-shared-modules=ALL"
+    "--with-winbind"
+  ] ++ (if heimdal != null then [ "--with-ads" ] else [ "--without-ads" ])
+    ++ (if openldap != null then [ "--with-ldap" ] else [ "--without-ldap" ])
+    ++ (if cups != null then [ "--enable-cups" ] else [ "--disable-cups" ])
+    ++ (if pam != null then [ "--with-pam" "--with-pam_smbpass" ]
+        else [ "--without-pam" "--without-pam_smbpass" ]) ++ [
+    "--with-quotas"
+    "--with-sendfile-support"
+    "--with-utmp"
+    "--enable-pthreadpool"
+  ] ++ (if avahi != null then [ "--enable-avahi" ] else [ "--disable-avahi" ]) ++ [
+    "--with-iconv"
+  ] ++ (if acl != null then [ "--with-acl-support" ] else [ "--without-acl-support" ]) ++ [
+    "--with-dnsupdate"
+    "--with-syslog"
+    "--with-automount"
+  ] ++ (if libaio != null then [ "--with-aio-support" ] else [ "--without-aio-support" ])
+    ++ (if fam != null then [ "--with-fam" ] else [ "--without-fam" ])
+    ++ (if ctdb != null then [ "--with-cluster-support" "--with-ctdb-dir=${ctdb}" ]
+        else [ "--without-cluster-support" ])
+    ++ (if ceph != null then [ "--with-libcephfs=${ceph}" ] else [ ])
+    ++ (if glusterfs != null then [ "--enable-glusterfs" ] else [ "--disable-glusterfs" ]) ++ [
+    # dynconfig/wscript options
+    "--enable-fhs"
+    "--localstatedir=/var"
+
+    # buildtools/wafsamba/wscript options
+    "--bundled-libraries=${if heimdal != null then "NONE" else "com_err"}"
+    "--private-libraries=NONE"
+    "--builtin-libraries=replace"
+  ] ++ (if libiconv != null then [ "--with-libiconv=${libiconv}" ] else [ ])
+    ++ (if gettext != null then [ "--with-gettext=${gettext}" ] else [ "--without-gettext" ]) ++ [
+    # source4/lib/tls/wscript options
+  ] ++ (if gnutls != null && libgcrypt != null && libgpgerror != null
+        then [ "--enable-gnutls" ] else [ "--disable-gnutls" ]) ++ [
+    # wscript options
+  ] ++ stdenv.lib.optional (heimdal == null) "--without-ad-dc";
+
+  stripAllList = [ "bin" "sbin" ];
+
+  meta = with stdenv.lib; {
+    homepage = http://www.samba.org/;
+    description = "The standard Windows interoperability suite of programs for Linux and Unix";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ wkennington ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 59226ee969e..872af609e67 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7901,10 +7901,21 @@ let
       HTTPDate MailDKIM LWP IOSocketSSL;
   };
 
-  samba = callPackage ../servers/samba { };
+  samba3 = callPackage ../servers/samba/3.x.nix { };
 
-  # A lightweight Samba, useful for non-Linux-based OSes.
-  samba_light = lowPrio (callPackage ../servers/samba {
+  samba4 = callPackage ../servers/samba/4.x.nix {
+    python = python2;
+    pythonPackages = python2Packages;
+    libiconv = if stdenv.isLinux then null else libiconv;
+    libgcrypt = libgcrypt_1_6;
+  };
+
+  samba = samba4;
+
+  smbclient = samba;
+
+  # A lightweight Samba 3, useful for non-Linux-based OSes.
+  samba3_light = lowPrio samba3.override {
     pam = null;
     fam = null;
     cups = null;
@@ -7912,8 +7923,39 @@ let
     openldap = null;
     # libunwind 1.0.1 is not ported to GNU/Hurd.
     libunwind = null;
+  };
+
+  samba4_light = lowPrio (samba4.override {
+    # source3/wscript optionals
+    heimdal = null;
+    openldap = null;
+    cups = null;
+    pam = null;
+    avahi = null;
+    acl = null;
+    libaio = null;
+    fam = null;
+    ctdb = null;
+    ceph = null;
+    glusterfs = null;
+
+    # buildtools/wafsamba/wscript optionals
+    libiconv = null;
+    gettext = null;
+
+    # source4/lib/tls/wscript optionals
+    gnutls = null;
+    libgcrypt = null;
+    libgpgerror = null;
+
+    # other optionals
+    zlib = null;
+    ncurses = null;
+    libcap = null;
   });
 
+  samba_light = samba3_light;
+
   serfdom = callPackage ../servers/serfdom { };
 
   seyren = callPackage ../servers/monitoring/seyren { };