diff --git a/source4/scripting/bin/samba_upgradeprovision b/source4/scripting/bin/samba_upgradeprovision
index 570f783..c24c8d3 100755
--- a/source4/scripting/bin/samba_upgradeprovision
+++ b/source4/scripting/bin/samba_upgradeprovision
@@ -190,6 +190,8 @@ parser.add_option("--db_backup_only", action="store_true",
                   help="Do the backup of the database in the provision, skip the sysvol / netlogon shares")
 parser.add_option("--full", action="store_true",
                   help="Perform full upgrade of the samdb (schema, configuration, new objects, ...")
+parser.add_option("--very-old-pre-alpha9", action="store_true",
+                  help="Perform additional forced SD resets required for a database from before Samba 4.0.0alpha9.")
 
 opts = parser.parse_args()[0]
 
@@ -1826,7 +1828,7 @@ if __name__ == '__main__':
         deltaattr = None
     # 11)
         message(GUESS, oem)
-        if oem is None or hasATProvision(ldbs.sam) or re.match(".*alpha((9)|(\d\d+)).*", str(oem)):
+        if oem is None or hasATProvision(ldbs.sam) or not opts.very_old_pre_alpha9:
             # 11) A
             # Starting from alpha9 we can consider that the structure is quite ok
             # and that we should do only dela
@@ -1925,7 +1927,7 @@ if __name__ == '__main__':
         # 16) SD should be created with admin but as some previous acl were so wrong
         # that admin can't modify them we have first to recreate them with the good
         # form but with system account and then give the ownership to admin ...
-        if str(oem) != "" and not re.match(r'.*alpha(9|\d\d+)', str(oem)):
+        if opts.very_old_pre_alpha9:
             message(SIMPLE, "Fixing very old provision SD")
             rebuild_sd(ldbs.sam, names)