diff --git a/xos/synchronizer/event_steps/onu_event.py b/xos/synchronizer/event_steps/onu_event.py
index 9a6c6f8..0d51255 100644
--- a/xos/synchronizer/event_steps/onu_event.py
+++ b/xos/synchronizer/event_steps/onu_event.py
@@ -32,16 +32,18 @@
         value = json.loads(event.value)
         self.log.info("onu.events: received event", value=value)
 
+        att_si = AttHelpers.find_or_create_att_si(self.model_accessor, self.log, value)
         if value["status"] == "activated":
             self.log.info("onu.events: activated onu", value=value)
-            att_si = AttHelpers.find_or_create_att_si(self.model_accessor, self.log, value)
             att_si.no_sync = False
             att_si.uni_port_id = long(value["portNumber"])
             att_si.of_dpid = value["deviceId"]
-            att_si.onu_state = "ENABLED"
+            att_si.oper_onu_status = "ENABLED"
             att_si.save_changed_fields(always_update_timestamp=True)
         elif value["status"] == "disabled":
-            self.log.info("onu.events: disabled onu, not taking any action", value=value)
+            self.log.info("onu.events: disabled onu, resetting the subscriber", value=value)
+            att_si.oper_onu_status = "DISABLED"
+            att_si.save_changed_fields(always_update_timestamp=True)
             return
         else:
             self.log.warn("onu.events: Unknown status value: %s" % value["status"], value=value)
diff --git a/xos/synchronizer/event_steps/test_dhcp_event.py b/xos/synchronizer/event_steps/test_dhcp_event.py
index 275c1ef..2b9b963 100644
--- a/xos/synchronizer/event_steps/test_dhcp_event.py
+++ b/xos/synchronizer/event_steps/test_dhcp_event.py
@@ -103,5 +103,5 @@
 
 
 if __name__ == '__main__':
-    sys.path.append("..")  # for import of helpers.py
+    sys.path.append(os.path.join(os.path.dirname(os.path.realpath(__file__)), ".."))  # for import of helpers.py
     unittest.main()
diff --git a/xos/synchronizer/event_steps/test_onu_events.py b/xos/synchronizer/event_steps/test_onu_events.py
index fe8f87e..a425908 100644
--- a/xos/synchronizer/event_steps/test_onu_events.py
+++ b/xos/synchronizer/event_steps/test_onu_events.py
@@ -89,7 +89,9 @@
             self.assertEqual(att_si.serial_number, self.event_dict['serialNumber'])
             self.assertEqual(att_si.of_dpid, self.event_dict['deviceId'])
             self.assertEqual(att_si.uni_port_id, long(self.event_dict['portNumber']))
-            self.assertEqual(att_si.onu_state, "ENABLED")
+            # Receiving an ONU event doesn't change the admin_onu_state until the model policy runs
+            self.assertEqual(att_si.admin_onu_state, "AWAITING")
+            self.assertEqual(att_si.oper_onu_status, "ENABLED")
 
     def test_reuse_instance(self):
 
@@ -113,24 +115,76 @@
             self.assertEqual(att_si.serial_number, self.event_dict['serialNumber'])
             self.assertEqual(att_si.of_dpid, self.event_dict['deviceId'])
             self.assertEqual(att_si.uni_port_id, long(self.event_dict['portNumber']))
-            self.assertEqual(att_si.onu_state, "ENABLED")
+            # Receiving an ONU event doesn't change the admin_onu_state until the model policy runs
+            self.assertEqual(att_si.admin_onu_state, "AWAITING")
+            self.assertEqual(att_si.oper_onu_status, "ENABLED")
 
     def test_disable_onu(self):
         self.event_dict = {
             'status': 'disabled',
             'serialNumber': 'BRCM1234',
             'deviceId': 'of:109299321',
-            'portNumber': '16'
+            'portNumber': '16',
         }
+
+        si = AttWorkflowDriverServiceInstance(
+            serial_number=self.event_dict["serialNumber"],
+            of_dpid="foo",
+            uni_port_id="foo",
+            admin_onu_state="ENABLED",
+            oper_onu_status="ENABLED",
+        )
+
         self.event.value = json.dumps(self.event_dict)
 
-        with patch.object(AttWorkflowDriverServiceInstance, "save", autospec=True) as mock_save:
+        with patch.object(AttWorkflowDriverServiceInstance.objects, "get_items") as att_si_mock, \
+                patch.object(AttWorkflowDriverServiceInstance, "save_changed_fields", autospec=True) as mock_save:
+            att_si_mock.return_value = [si]
 
             self.event_step.process_event(self.event)
 
-            self.assertEqual(mock_save.call_count, 0)
+            att_si = mock_save.call_args[0][0]
+
+            self.assertEqual(mock_save.call_count, 1)
+
+            # Receiving an ONU event doesn't change the admin_onu_state until the model policy runs
+            self.assertEqual(att_si.admin_onu_state, 'ENABLED')
+            self.assertEqual(att_si.oper_onu_status, 'DISABLED')
+
+    def test_enable_onu(self):
+        self.event_dict = {
+            'status': 'activated',
+            'serialNumber': 'BRCM1234',
+            'deviceId': 'of:109299321',
+            'portNumber': '16',
+        }
+
+        si = AttWorkflowDriverServiceInstance(
+            serial_number=self.event_dict["serialNumber"],
+            of_dpid="foo",
+            uni_port_id="foo",
+            admin_onu_state="DISABLED",
+            oper_onu_status="DISABLED",
+        )
+
+        self.event.value = json.dumps(self.event_dict)
+
+        with patch.object(AttWorkflowDriverServiceInstance.objects, "get_items") as att_si_mock, \
+                patch.object(AttWorkflowDriverServiceInstance, "save_changed_fields", autospec=True) as mock_save:
+            att_si_mock.return_value = [si]
+
+            self.event_step.process_event(self.event)
+
+            att_si = mock_save.call_args[0][0]
+
+            self.assertEqual(mock_save.call_count, 1)
+
+            # Receiving an ONU event doesn't change the admin_onu_state until the model policy runs
+            self.assertEqual(att_si.admin_onu_state, 'DISABLED')
+            self.assertEqual(att_si.oper_onu_status, 'ENABLED')
+
 
 
 if __name__ == '__main__':
-    sys.path.append("..")  # for import of helpers.py
+    sys.path.append(os.path.join(os.path.dirname(os.path.realpath(__file__)), ".."))  # for import of helpers.py
     unittest.main()
diff --git a/xos/synchronizer/helpers.py b/xos/synchronizer/helpers.py
index afc471b..b6b69d4 100644
--- a/xos/synchronizer/helpers.py
+++ b/xos/synchronizer/helpers.py
@@ -40,7 +40,8 @@
 
         whitelisted = matching_entries[0]
         try:
-            pon_port = model_accessor.ONUDevice.objects.get(serial_number=att_si.serial_number).pon_port
+            onu = model_accessor.ONUDevice.objects.get(serial_number=att_si.serial_number)
+            pon_port = onu.pon_port
         except IndexError:
             raise DeferredException("ONU device %s is not know to XOS yet" % att_si.serial_number)
 
diff --git a/xos/synchronizer/migrations/0005_auto_20190425_2002.py b/xos/synchronizer/migrations/0005_auto_20190425_2002.py
new file mode 100644
index 0000000..140084d
--- /dev/null
+++ b/xos/synchronizer/migrations/0005_auto_20190425_2002.py
@@ -0,0 +1,39 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.20 on 2019-04-26 00:02
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('att-workflow-driver', '0004_auto_20190409_1736'),
+    ]
+
+    operations = [
+        migrations.RenameField(
+            model_name='attworkflowdriverserviceinstance',
+            old_name='onu_state',
+            new_name='admin_onu_state',
+        ),
+        migrations.AddField(
+            model_name='attworkflowdriverserviceinstance',
+            name='oper_onu_status',
+            field=models.CharField(choices=[(b'AWAITING', b'Awaiting'), (b'ENABLED', b'Enabled'), (b'DISABLED', b'Disabled')], default=b'AWAITING', help_text=b'ONU operational state', max_length=256),
+        ),
+    ]
diff --git a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py
index 3b7b74e..833adf9 100644
--- a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py
+++ b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py
@@ -37,7 +37,7 @@
 
     def handle_update(self, si):
         self.logger.debug("MODEL_POLICY: handle_update for AttWorkflowDriverServiceInstance %s " %
-                          (si.id), onu_state=si.onu_state, authentication_state=si.authentication_state)
+                          (si.id), onu_state=si.admin_onu_state, authentication_state=si.authentication_state)
 
         # Changing ONU state can change auth state
         # Changing auth state can change DHCP state
@@ -56,21 +56,15 @@
 
         si.save_changed_fields()
 
+    # Check the whitelist to see if the ONU is valid.  If it is, make sure that it's enabled.
     def process_onu_state(self, si):
         [valid, message] = AttHelpers.validate_onu(self.model_accessor, self.logger, si)
-        if si.onu_state == "AWAITING" or si.onu_state == "ENABLED":
-            si.status_message = message
-            if valid:
-                si.onu_state = "ENABLED"
-                self.update_onu(si.serial_number, "ENABLED")
-            else:
-                si.onu_state = "DISABLED"
-                self.update_onu(si.serial_number, "DISABLED")
-        else:  # DISABLED
-            if not valid:
-                si.status_message = message
-            else:
-                si.status_message = "ONU has been disabled"
+        si.status_message = message
+        if valid:
+            si.admin_onu_state = "ENABLED"
+            self.update_onu(si.serial_number, "ENABLED")
+        else:
+            si.admin_onu_state = "DISABLED"
             self.update_onu(si.serial_number, "DISABLED")
 
     # If the ONU has been disabled then we force re-authentication when it
@@ -87,7 +81,7 @@
             "APPROVED": " - Authentication succeeded",
             "DENIED": " - Authentication denied"
         }
-        if si.onu_state == "DISABLED":
+        if si.admin_onu_state == "DISABLED" or si.oper_onu_status == "DISABLED":
             si.authentication_state = "AWAITING"
         else:
             si.status_message += auth_msgs[si.authentication_state]
@@ -119,14 +113,14 @@
     # ENABLED   | APPROVED | *
     # DISABLED  | AWAITING | AWAITING
     def validate_states(self, si):
-        if (si.onu_state == "AWAITING" or si.onu_state ==
+        if (si.admin_onu_state == "AWAITING" or si.admin_onu_state ==
                 "DISABLED") and si.authentication_state == "AWAITING" and si.dhcp_state == "AWAITING":
             return
-        if si.onu_state == "ENABLED" and (si.authentication_state == "APPROVED" or si.dhcp_state == "AWAITING"):
+        if si.admin_onu_state == "ENABLED" and (si.authentication_state == "APPROVED" or si.dhcp_state == "AWAITING"):
             return
         self.logger.warning(
             "MODEL_POLICY (validate_states): invalid state combination",
-            onu_state=si.onu_state,
+            onu_state=si.admin_onu_state,
             auth_state=si.authentication_state,
             dhcp_state=si.dhcp_state)
 
diff --git a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py
index 7a31116..348af76 100644
--- a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py
+++ b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py
@@ -34,14 +34,14 @@
     def validate_onu_state(self, si):
         [valid, message] = AttHelpers.validate_onu(self.model_accessor, self.logger, si)
         if valid:
-            si.onu_state = "ENABLED"
+            si.admin_onu_state = "ENABLED"
         else:
-            si.onu_state = "DISABLED"
+            si.admin_onu_state = "DISABLED"
 
         self.logger.debug(
             "MODEL_POLICY: activating AttWorkflowDriverServiceInstance because of change in the whitelist",
             si=si,
-            onu_state=si.onu_state,
+            onu_state=si.admin_onu_state,
             authentication_state=si.authentication_state)
         si.save_changed_fields(always_update_timestamp=True)
 
diff --git a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py
index d784258..7de68cb 100644
--- a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py
+++ b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py
@@ -117,15 +117,18 @@
             update_onu.return_value = None
             get_subscriber.return_value = None
 
-            self.si.onu_state = "AWAITING"
+            self.si.admin_onu_state = "AWAITING"
+            self.si.oper_onu_status = "AWAITING"
             self.policy.handle_update(self.si)
             process_onu_state.assert_called_with(self.si)
 
-            self.si.onu_state = "ENABLED"
+            self.si.admin_onu_state = "ENABLED"
+            self.si.oper_onu_status = "ENABLED"
             self.policy.handle_update(self.si)
             process_onu_state.assert_called_with(self.si)
 
-            self.si.onu_state = "DISABLED"
+            self.si.admin_onu_state = "DISABLED"
+            self.si.oper_onu_status = "DISABLED"
             self.policy.handle_update(self.si)
             process_onu_state.assert_called_with(self.si)
 
@@ -277,7 +280,7 @@
             self.assertEqual(saved_ip.description, "DHCP Assigned IP Address")
 
     def test_handle_update_subscriber(self):
-        self.si.onu_state = "DISABLED"
+        self.si.admin_onu_state = "DISABLED"
 
         sub = RCORDSubscriber(
             onu_device="BRCM1234"
@@ -296,6 +299,24 @@
             self.policy.handle_update(self.si)
             update_subscriber.assert_called_with(sub, self.si)
 
+    def test_process_auth_state(self):
+        # testing change in admin_onu_state
+        self.si.admin_onu_state = "DISABLED"
+        self.si.oper_onu_status = "ENABLED"
+        self.si.authentication_state, "APPROVED"
+
+        self.policy.process_auth_state(self.si)
+        self.assertEqual(self.si.authentication_state, "AWAITING")
+
+        # testing change in oper_onu_status
+        self.si.admin_onu_state = "ENABLED"
+        self.si.oper_onu_status = "DISABLED"
+        self.si.authentication_state, "APPROVED"
+
+        self.policy.process_auth_state(self.si)
+        self.assertEqual(self.si.authentication_state, "AWAITING")
+
 
 if __name__ == '__main__':
+    sys.path.append(os.path.join(os.path.dirname(os.path.realpath(__file__)), ".."))
     unittest.main()
diff --git a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py
index 7bc24b4..8015a6b 100644
--- a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py
+++ b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py
@@ -76,7 +76,7 @@
             save_si.assert_called_once()
             save_si.assert_called_with(
                 always_update_timestamp=True, update_fields=[
-                    'onu_state', 'serial_number', 'updated'])
+                    'admin_onu_state', 'serial_number', 'updated'])
 
     def test_disable_onu(self):
         si = AttWorkflowDriverServiceInstance(serial_number="BRCM333", owner_id=self.service.id, valid="invalid")
@@ -89,7 +89,7 @@
             save_si.assert_called_once()
             save_si.assert_called_with(
                 always_update_timestamp=True, update_fields=[
-                    'onu_state', 'serial_number', 'updated'])
+                    'admin_onu_state', 'serial_number', 'updated'])
 
     def test_whitelist_update(self):
         si = AttWorkflowDriverServiceInstance(serial_number="BRCM333", owner_id=self.service.id)
@@ -125,4 +125,5 @@
 
 
 if __name__ == '__main__':
+    sys.path.append(os.path.join(os.path.dirname(os.path.realpath(__file__)), ".."))
     unittest.main()
diff --git a/xos/synchronizer/models/att-workflow-driver.xproto b/xos/synchronizer/models/att-workflow-driver.xproto
index 603e059..f19494d 100644
--- a/xos/synchronizer/models/att-workflow-driver.xproto
+++ b/xos/synchronizer/models/att-workflow-driver.xproto
@@ -28,7 +28,7 @@
         max_length = 256];
     required int32 uni_port_id = 5 [
         help_text = "ONU UNI port ID"];
-    required string onu_state = 6 [
+    required string admin_onu_state = 6 [
         help_text = "ONU administrative state",
         choices = "(('AWAITING', 'Awaiting'), ('ENABLED', 'Enabled'), ('DISABLED', 'Disabled'))",
         default = "AWAITING",
@@ -51,6 +51,12 @@
         help_text = "Subscriber MAC address, leanred from DHCP",
         feedback_state = True,
         max_length = 20];
+    required string oper_onu_status = 11 [
+        help_text = "ONU operational state",
+        choices = "(('AWAITING', 'Awaiting'), ('ENABLED', 'Enabled'), ('DISABLED', 'Disabled'))",
+        default = "AWAITING",
+        feedback_state = True,
+        max_length = 256];
 }
 
 message AttWorkflowDriverWhiteListEntry (XOSBase) {