diff --git a/.gitignore b/.gitignore
index 668b50574..ae8292f38 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,6 +21,9 @@ todo
 ## Environment normalisation:
 /.bundle
 /vendor/bundle
+.idea
+# editor tmp files
+*.*~
 
 # these should all be checked in to normalise the environment:
 # Gemfile.lock, .ruby-version, .ruby-gemset
diff --git a/app/models/depp/user.rb b/app/models/depp/user.rb
index 44c25bbb1..51ce3f682 100644
--- a/app/models/depp/user.rb
+++ b/app/models/depp/user.rb
@@ -18,7 +18,7 @@ module Depp
     def server
       client_cert = File.read(ENV['cert_path'])
       client_key = File.read(ENV['key_path'])
-      port = Rails.env.test? ? 701 : ENV['epp_port']
+      port = ENV['epp_port'] || '700'
 
       @server_cache ||= Epp::Server.new({
         server: ENV['epp_hostname'],
diff --git a/app/models/domain.rb b/app/models/domain.rb
index 1ea6a1cc6..add4ea0df 100644
--- a/app/models/domain.rb
+++ b/app/models/domain.rb
@@ -12,9 +12,10 @@ class Domain < ActiveRecord::Base
   # TODO: should we user validates_associated :registrant here?
 
   has_many :admin_domain_contacts
-  accepts_nested_attributes_for :admin_domain_contacts, allow_destroy: true
+  accepts_nested_attributes_for :admin_domain_contacts,  allow_destroy: !:admin_change_prohibited?, reject_if: :admin_change_prohibited?
   has_many :tech_domain_contacts
-  accepts_nested_attributes_for :tech_domain_contacts, allow_destroy: true
+  accepts_nested_attributes_for :tech_domain_contacts, allow_destroy: !:tech_change_prohibited?, reject_if: :tech_change_prohibited?
+
 
   # NB! contacts, admin_contacts, tech_contacts are empty for a new record
   has_many :domain_contacts, dependent: :destroy
@@ -174,6 +175,14 @@ class Domain < ActiveRecord::Base
     nameservers.select { |x| !x.hostname.end_with?(name) }
   end
 
+  def admin_change_prohibited?
+    statuses.include? DomainStatus::SERVER_ADMIN_CHANGE_PROHIBITED
+  end
+
+  def tech_change_prohibited?
+    statuses.include? DomainStatus::SERVER_TECH_CHANGE_PROHIBITED
+  end
+
   class << self
     def convert_period_to_time(period, unit)
       return (period.to_i / 365).years if unit == 'd'
@@ -354,7 +363,7 @@ class Domain < ActiveRecord::Base
       end
     end
 
-    return false if statuses.include?(DomainStatus::DELETE_CANDIDATE)
+    return false if statuses.include?(DomainStatus::DELETE_CANDIDATE) || statuses.include?(DomainStatus::FORCE_DELETE)
 
     true
   end
diff --git a/app/models/domain_status.rb b/app/models/domain_status.rb
index 3f88de39f..9a18602f0 100644
--- a/app/models/domain_status.rb
+++ b/app/models/domain_status.rb
@@ -126,11 +126,11 @@ class DomainStatus < ActiveRecord::Base
         # sync with admin_statuses_map
         # SERVER_MANUAL_INZONE,
         # SERVER_RENEW_PROHIBITED,
-        # SERVER_TRANSFER_PROHIBITED,
+        SERVER_TRANSFER_PROHIBITED,
         # SERVER_REGISTRANT_CHANGE_PROHIBITED,
-        # SERVER_ADMIN_CHANGE_PROHIBITED,
-        # SERVER_TECH_CHANGE_PROHIBITED,
-        SERVER_DELETE_PROHIBITED,
+        SERVER_ADMIN_CHANGE_PROHIBITED,
+        SERVER_TECH_CHANGE_PROHIBITED,
+        SERVER_DELETE_PROHIBITED, 
         SERVER_UPDATE_PROHIBITED
       ]
     end
@@ -144,8 +144,8 @@ class DomainStatus < ActiveRecord::Base
         # ['RenewProhibited', SERVER_RENEW_PROHIBITED],
         ['TransferProhibited', SERVER_TRANSFER_PROHIBITED],
         # ['RegistrantChangeProhibited', SERVER_REGISTRANT_CHANGE_PROHIBITED],
-        # ['AdminChangeProhibited', SERVER_ADMIN_CHANGE_PROHIBITED],
-        # ['TechChangeProhibited', SERVER_TECH_CHANGE_PROHIBITED],
+        ['AdminChangeProhibited', SERVER_ADMIN_CHANGE_PROHIBITED],
+        ['TechChangeProhibited', SERVER_TECH_CHANGE_PROHIBITED],
         # [''],
         ['UpdateProhibited', SERVER_UPDATE_PROHIBITED],
         ['DeleteProhibited', SERVER_DELETE_PROHIBITED]
diff --git a/app/models/epp/domain.rb b/app/models/epp/domain.rb
index c8ceef2dc..732686252 100644
--- a/app/models/epp/domain.rb
+++ b/app/models/epp/domain.rb
@@ -233,6 +233,11 @@ class Epp::Domain < Domain
   def admin_domain_contacts_attrs(frame, action)
     admin_attrs = domain_contact_attrs_from(frame, action, 'admin')
 
+    if action && !admin_attrs.empty? && admin_change_prohibited?
+      add_epp_error('2304', 'admin', DomainStatus::SERVER_ADMIN_CHANGE_PROHIBITED, I18n.t(:object_status_prohibits_operation))
+      return []
+    end
+
     case action
     when 'rem'
       return destroy_attrs(admin_attrs, admin_domain_contacts)
@@ -244,6 +249,11 @@ class Epp::Domain < Domain
   def tech_domain_contacts_attrs(frame, action)
     tech_attrs = domain_contact_attrs_from(frame, action, 'tech')
 
+    if action && !tech_attrs.empty? && tech_change_prohibited?
+      add_epp_error('2304', 'tech', DomainStatus::SERVER_TECH_CHANGE_PROHIBITED, I18n.t(:object_status_prohibits_operation))
+      return []
+    end
+
     case action
     when 'rem'
       return destroy_attrs(tech_attrs, tech_domain_contacts)
@@ -377,7 +387,6 @@ class Epp::Domain < Domain
 
   def domain_statuses_attrs(frame, action)
     status_list = domain_status_list_from(frame)
-
     if action == 'rem'
       to_destroy = []
       status_list.each do |x|
@@ -429,8 +438,19 @@ class Epp::Domain < Domain
 
     at_add = attrs_from(frame.css('add'), current_user)
     at[:nameservers_attributes] += at_add[:nameservers_attributes]
-    at[:admin_domain_contacts_attributes] += at_add[:admin_domain_contacts_attributes]
-    at[:tech_domain_contacts_attributes] += at_add[:tech_domain_contacts_attributes]
+
+    if !at[:admin_domain_contacts_attributes].empty? && admin_change_prohibited?
+      add_epp_error('2304', 'admin', DomainStatus::SERVER_ADMIN_CHANGE_PROHIBITED, I18n.t(:object_status_prohibits_operation))
+    else
+      at[:admin_domain_contacts_attributes] += at_add[:admin_domain_contacts_attributes]
+    end
+
+    if !at[:tech_domain_contacts_attributes].empty? && tech_change_prohibited?
+      add_epp_error('2304', 'tech', DomainStatus::SERVER_TECH_CHANGE_PROHIBITED, I18n.t(:object_status_prohibits_operation))
+    else
+      at[:tech_domain_contacts_attributes] += at_add[:tech_domain_contacts_attributes]
+    end
+
     at[:dnskeys_attributes] += at_add[:dnskeys_attributes]
     at[:statuses] =
       statuses - domain_statuses_attrs(frame.css('rem'), 'rem') + domain_statuses_attrs(frame.css('add'), 'add')
diff --git a/config/initializers/pdfkit.rb b/config/initializers/pdfkit.rb
index b38887c6e..d7bbc64b8 100644
--- a/config/initializers/pdfkit.rb
+++ b/config/initializers/pdfkit.rb
@@ -1,5 +1,9 @@
 PDFKit.configure do |config|
-  config.wkhtmltopdf = "#{Rails.root}/vendor/bin/wkhtmltopdf"
+  installed = %x(which wkhtmltopdf).chomp
+  if installed == "" then
+    installed = "#{Rails.root}/vendor/bin/wkhtmltopdf"
+  end
+  config.wkhtmltopdf = installed
   config.default_options = {
     page_size: 'A4',
     quiet: true
diff --git a/lib/schemas/domain-eis-1.0.xsd b/lib/schemas/domain-eis-1.0.xsd
index 222d3d6f4..4febe6f15 100644
--- a/lib/schemas/domain-eis-1.0.xsd
+++ b/lib/schemas/domain-eis-1.0.xsd
@@ -396,6 +396,10 @@
       <enumeration value="serverRenewProhibited"/>
       <enumeration value="serverTransferProhibited"/>
       <enumeration value="serverUpdateProhibited"/>
+      <!-- Custom EIS domain status values -->
+      <enumeration value="serverTechChangeProhibited"/>
+      <enumeration value="serverAdminChangeProhibited"/>
+
     </restriction>
    </simpleType>
 
diff --git a/spec/models/domain_spec.rb b/spec/models/domain_spec.rb
index 8ec5f4b25..7249a0d6f 100644
--- a/spec/models/domain_spec.rb
+++ b/spec/models/domain_spec.rb
@@ -64,10 +64,15 @@ describe Domain do
   end
 
   context 'with valid attributes' do
-    before :all do
+    before :example do
       @domain = Fabricate(:domain)
     end
 
+    after do
+      @domain.delete
+      @domain = nil
+    end
+
     it 'should be valid' do
       @domain.valid?
       @domain.errors.full_messages.should match_array([])
@@ -305,6 +310,108 @@ describe Domain do
       ])
     end
 
+    it 'should should be manual in zone and held after force delete' do
+      @domain.valid?
+      @domain.outzone_at = Time.zone.now + 1.day # before redemption grace period
+      # what should this be?
+      # @domain.server_holdable?.should be true
+      @domain.statuses.include?(DomainStatus::SERVER_HOLD).should be false
+      @domain.statuses.include?(DomainStatus::SERVER_MANUAL_INZONE).should be false
+      @domain.set_force_delete
+      @domain.server_holdable?.should be false
+      @domain.statuses.include?(DomainStatus::SERVER_MANUAL_INZONE).should be true
+      @domain.statuses.include?(DomainStatus::SERVER_HOLD).should be false
+    end
+
+    it 'should not allow update after force delete' do
+      @domain.valid?
+      @domain.pending_update_prohibited?.should be false
+      @domain.update_prohibited?.should be false
+      @domain.set_force_delete
+      @domain.pending_update_prohibited?.should be true
+      @domain.update_prohibited?.should be true
+    end
+
+    context 'with time period settings' do
+      before :all do
+        @save_days_to_renew = Setting.days_to_renew_domain_before_expire
+        @save_warning_period = Setting.expire_warning_period
+        @save_grace_period = Setting.redemption_grace_period
+      end
+
+      after :all do
+        Setting.days_to_renew_domain_before_expire = @save_days_to_renew
+        Setting.expire_warning_period = @save_warning_period
+        Setting.redemption_grace_period = @save_grace_period
+      end
+
+      before :example do
+        @domain.valid?
+      end
+
+      context 'with no renewal limit, renew anytime' do
+        before do
+          Setting.days_to_renew_domain_before_expire = 0
+        end
+
+        it 'should always renew with no policy' do
+          @domain.renewable?.should be true
+        end
+
+        it 'should not allow to renew after force delete' do
+          @domain.set_force_delete
+          @domain.renewable?.should be false
+        end
+      end
+
+      context 'with renew policy' do
+        before :all do
+          @policy = 30
+          Setting.days_to_renew_domain_before_expire = @policy
+        end
+
+        it 'should not allow renew before policy' do
+          @domain.valid_to = Time.zone.now.beginning_of_day + @policy.days * 2
+          @domain.renewable?.should be false
+        end
+
+        context 'ready to renew' do
+          before { @domain.valid_to = Time.zone.now + (@policy - 2).days }
+
+          it 'should allow renew' do
+            @domain.renewable?.should be true
+          end
+
+          it 'should not allow to renew after force delete' do
+            @domain.set_force_delete
+            @domain.renewable?.should be false
+          end
+        end
+      end
+    end
+
+    it 'should start redemption grace period' do
+      Domain.start_redemption_grace_period
+      @domain.reload
+      @domain.statuses.include?(DomainStatus::SERVER_HOLD).should == false
+
+      @domain.outzone_at = Time.zone.now
+      @domain.statuses << DomainStatus::SERVER_MANUAL_INZONE # this prohibits server_hold
+      @domain.save
+
+      Domain.start_redemption_grace_period
+      @domain.reload
+      @domain.statuses.include?(DomainStatus::SERVER_HOLD).should == false
+
+      @domain.statuses = []
+      @domain.save
+
+      Domain.start_redemption_grace_period
+      @domain.reload
+      @domain.statuses.include?(DomainStatus::SERVER_HOLD).should == true
+    end
+
+
     it 'should set expired status and update outzone_at and delete_at' do
       domain = Fabricate(:domain)
       domain.statuses.should == ['ok']
@@ -482,7 +589,7 @@ describe Domain do
     end
 
     context 'about registrant update confirm' do
-      before :all do
+      before :example do
         @domain.registrant_verification_token = 123
         @domain.registrant_verification_asked_at = Time.zone.now
         @domain.statuses << DomainStatus::PENDING_UPDATE
@@ -503,7 +610,7 @@ describe Domain do
     end
 
     context 'about registrant update confirm when domain is invalid' do
-      before :all do
+      before :example do
         @domain.registrant_verification_token = 123
         @domain.registrant_verification_asked_at = Time.zone.now
         @domain.statuses << DomainStatus::PENDING_UPDATE
diff --git a/spec/support/epp.rb b/spec/support/epp.rb
index 24a86e3d9..6d57e7d9e 100644
--- a/spec/support/epp.rb
+++ b/spec/support/epp.rb
@@ -92,8 +92,10 @@ module Epp
   end
 
   def server
+    port = ENV['epp_port'] || 700
+    hostname = ENV['epp_hostname'] || 'localhost'
     # tag and password not in use, add those at login xml
-    @server ||= Epp::Server.new({ server: 'localhost', port: 701, tag: '', password: '' })
+    @server ||= Epp::Server.new({ server: hostname, port: port, tag: '', password: '' })
   end
 
   def parse_response(raw)