anchor.diff:  	    case OldCloneFrom of
   		{value, Val} when Val /= noinit ->
   		    %% This means that the cloning is already done...
  -		    ok;
  +		    no_cloning(Cols);
   		_ ->
  -		    %% Otherwise, we must check the CloneFrom value
  -		    case snmp_generic:table_get_element(db(usmUserTable),
  -							RowIndex2,
  -							?usmUserStatus) of
  -			{value, ?'RowStatus_active'} -> ok;
  -			_ -> inconsistentName(?usmUserCloneFrom)
  -		    end
  +		    %% Otherwise, we must check the CloneFrom value. It
  +            %% must relate to a usmUserEntry that exists and is active.
  +            case snmp_generic:table_get_row(db(usmUserTable), RowIndex2) of
  +                CloneFromRow when is_tuple(CloneFromRow) ->
  +                    case element(?usmUserStatus, CloneFromRow) of
  +                        ?'RowStatus_active' ->
  +                            get_cloned_cols(CloneFromRow, Cols);
  +                        _ ->
  +                            inconsistentName(?usmUserCloneFrom)
  +                    end;
  +                undefined ->
  +                    inconsistentName(?usmUserCloneFrom)
  +            end
   	    end;
   	false ->
  -	    ok
  -    end.
  +        % no ?usmUserCloneFrom specified, don't modify columns
  +        no_cloning(Cols)
  +    end.
  +
  +get_cloned_cols(CloneFromRow, Cols) ->
  +    % initialize cloned columns with data from CloneFromRow
  +    % and overwrite that again with data found in Cols
  +    AuthP = element(?usmUserAuthProtocol, CloneFromRow),
  +    PrivP = element(?usmUserPrivProtocol, CloneFromRow),
  +    AuthK = element(?usmUserAuthKey, CloneFromRow),
  +    PrivK = element(?usmUserPrivKey, CloneFromRow),
  +    ClonedCols = [{?usmUserAuthProtocol, AuthP},
  +        {?usmUserPrivProtocol, PrivP},
  +        {?usmUserAuthKey, AuthK},
  +        {?usmUserPrivKey, PrivK},
  +        {?is_cloning, true}
  +    ],
  +    Func = fun({Col, _} = Item, NCols) ->
  +            lists:keystore(Col, 1, NCols, Item)
  +    end,
  +    Cols1 = lists:foldl(Func, ClonedCols, Cols),
  +    lists:keysort(1, Cols1).
  +
  +no_cloning(Cols0) ->
  +    Cols1 = lists:keydelete(?usmUserCloneFrom, Cols0),
  +    lists:keydelete(?is_cloning, Cols1).
   
   
   validate_auth_protocol(RowIndex, Cols) ->
       case lists:keysearch(?usmUserAuthProtocol, 1, Cols) of
   	{value, {_Col, AuthProtocol}} ->
  -	    %% Check if the row has been cloned; we can't check the
  +	    %% Check if the row is being cloned; we can't check the
   	    %% old value of authProtocol, because if the row was
   	    %% createAndWaited, the default value would have been
   	    %% written (usmNoAuthProtocol).
  -	    OldCloneFrom = snmp_generic:table_get_element(db(usmUserTable),
  -							  RowIndex,
  -							  ?usmUserCloneFrom),
  -	    case OldCloneFrom of
  -		{value, Val} when Val /= noinit ->
  -		    %% This means that the cloning is already done; set is ok
  -		    %% if new protocol is usmNoAuthProtocol
  +	    IsCloning = proplists:get_value(?is_cloning, Cols, false),
  +	    if
  +		not IsCloning ->
  +		    %% This means that the row is not being cloned right
  +            %% now; set is ok if new protocol is usmNoAuthProtocol
   		    case AuthProtocol of
   			?usmNoAuthProtocol ->
   			    %% Check that the Priv protocl is noPriv
  
positive.code: 	{ok, Cols} ->
  	    ?vtrace("usmUserTable(set) -> verified"
  		    "~n   Cols: ~p", [Cols]),
  	    NCols = pre_set(RowIndex, Cols),
  	    ?vtrace("usmUserTable(set) -> pre-set: "
  		    "~n   NCols: ~p", [NCols]),
  	    %% NOTE: The NCols parameter is sent to snmp_generic, but not to
  
negative.code: 			_ ->
  			    wrongValue(?usmUserAuthProtocol)
  		    end;
  		true ->
  		    %% Otherwise, check that the new protocol is known,
  		    %% and that the system we're running supports the
  		    %% hash function.
  