1 # implement samba_tool drs commands
3 # Copyright Andrew Tridgell 2010
5 # based on C implementation by Kamen Mazdrashki <kamen.mazdrashki@postpath.com>
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
21 import samba.getopt as options
24 from samba.auth import system_session
25 from samba.netcmd import (
31 from samba.samdb import SamDB
32 from samba import drs_utils, nttime2string, dsdb
33 from samba.dcerpc import drsuapi, misc
36 def drsuapi_connect(ctx):
37 '''make a DRSUAPI connection to the server'''
39 (ctx.drsuapi, ctx.drsuapi_handle, ctx.bind_supported_extensions) = drs_utils.drsuapi_connect(ctx.server, ctx.lp, ctx.creds)
41 raise CommandError("DRS connection to %s failed" % ctx.server, e)
43 def samdb_connect(ctx):
44 '''make a ldap connection to the server'''
46 ctx.samdb = SamDB(url="ldap://%s" % ctx.server,
47 session_info=system_session(),
48 credentials=ctx.creds, lp=ctx.lp)
50 raise CommandError("LDAP connection to %s failed" % ctx.server, e)
53 '''return "was successful" or an error string'''
54 (ecode, estring) = werr
56 return "was successful"
57 return "failed, result %u (%s)" % (ecode, estring)
61 def attr_default(msg, attrname, default):
62 '''get an attribute from a ldap msg with a default'''
64 return msg[attrname][0]
69 def drs_parse_ntds_dn(ntds_dn):
70 '''parse a NTDS DN returning a site and server'''
71 a = ntds_dn.split(',')
72 if a[0] != "CN=NTDS Settings" or a[2] != "CN=Servers" or a[4] != 'CN=Sites':
73 raise RuntimeError("bad NTDS DN %s" % ntds_dn)
74 server = a[1].split('=')[1]
75 site = a[3].split('=')[1]
82 class cmd_drs_showrepl(Command):
83 """show replication status"""
85 synopsis = "%prog [<DC>] [options]"
87 takes_optiongroups = {
88 "sambaopts": options.SambaOptions,
89 "versionopts": options.VersionOptions,
90 "credopts": options.CredentialsOptions,
95 def print_neighbour(self, n):
96 '''print one set of neighbour information'''
97 self.message("%s" % n.naming_context_dn)
99 (site, server) = drs_parse_ntds_dn(n.source_dsa_obj_dn)
100 self.message("\t%s\%s via RPC" % (site, server))
102 self.message("\tNTDS DN: %s" % n.source_dsa_obj_dn)
103 self.message("\t\tDSA object GUID: %s" % n.source_dsa_obj_guid)
104 self.message("\t\tLast attempt @ %s %s" % (nttime2string(n.last_attempt),
105 drs_errmsg(n.result_last_attempt)))
106 self.message("\t\t%u consecutive failure(s)." % n.consecutive_sync_failures)
107 self.message("\t\tLast success @ %s" % nttime2string(n.last_success))
110 def drsuapi_ReplicaInfo(ctx, info_type):
111 '''call a DsReplicaInfo'''
113 req1 = drsuapi.DsReplicaGetInfoRequest1()
114 req1.info_type = info_type
116 (info_type, info) = ctx.drsuapi.DsReplicaGetInfo(ctx.drsuapi_handle, 1, req1)
118 raise CommandError("DsReplicaGetInfo of type %u failed" % info_type, e)
119 return (info_type, info)
121 def run(self, DC=None, sambaopts=None,
122 credopts=None, versionopts=None, server=None):
124 self.lp = sambaopts.get_loadparm()
126 DC = common.netcmd_dnsname(self.lp)
128 self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
130 drsuapi_connect(self)
133 # show domain information
134 ntds_dn = self.samdb.get_dsServiceName()
135 server_dns = self.samdb.search(base="", scope=ldb.SCOPE_BASE, attrs=["dnsHostName"])[0]['dnsHostName'][0]
137 (site, server) = drs_parse_ntds_dn(ntds_dn)
139 ntds = self.samdb.search(base=ntds_dn, scope=ldb.SCOPE_BASE, attrs=['options', 'objectGUID', 'invocationId'])
141 raise CommandError("Failed to search NTDS DN %s" % ntds_dn)
142 conn = self.samdb.search(base=ntds_dn, expression="(objectClass=nTDSConnection)")
144 self.message("%s\\%s" % (site, server))
145 self.message("DSA Options: 0x%08x" % int(attr_default(ntds[0], "options", 0)))
146 self.message("DSA object GUID: %s" % self.samdb.schema_format_value("objectGUID", ntds[0]["objectGUID"][0]))
147 self.message("DSA invocationId: %s\n" % self.samdb.schema_format_value("objectGUID", ntds[0]["invocationId"][0]))
149 self.message("==== INBOUND NEIGHBORS ====\n")
150 (info_type, info) = self.drsuapi_ReplicaInfo(drsuapi.DRSUAPI_DS_REPLICA_INFO_NEIGHBORS)
152 self.print_neighbour(n)
155 self.message("==== OUTBOUND NEIGHBORS ====\n")
156 (info_type, info) = self.drsuapi_ReplicaInfo(drsuapi.DRSUAPI_DS_REPLICA_INFO_REPSTO)
158 self.print_neighbour(n)
160 reasons = ['NTDSCONN_KCC_GC_TOPOLOGY',
161 'NTDSCONN_KCC_RING_TOPOLOGY',
162 'NTDSCONN_KCC_MINIMIZE_HOPS_TOPOLOGY',
163 'NTDSCONN_KCC_STALE_SERVERS_TOPOLOGY',
164 'NTDSCONN_KCC_OSCILLATING_CONNECTION_TOPOLOGY',
165 'NTDSCONN_KCC_INTERSITE_GC_TOPOLOGY',
166 'NTDSCONN_KCC_INTERSITE_TOPOLOGY',
167 'NTDSCONN_KCC_SERVER_FAILOVER_TOPOLOGY',
168 'NTDSCONN_KCC_SITE_FAILOVER_TOPOLOGY',
169 'NTDSCONN_KCC_REDUNDANT_SERVER_TOPOLOGY']
171 self.message("==== KCC CONNECTION OBJECTS ====\n")
173 self.message("Connection --")
174 self.message("\tConnection name: %s" % c['name'][0])
175 self.message("\tEnabled : %s" % attr_default(c, 'enabledConnection', 'TRUE'))
176 self.message("\tServer DNS name : %s" % server_dns)
177 self.message("\tServer DN name : %s" % c['fromServer'][0])
178 self.message("\t\tTransportType: RPC")
179 self.message("\t\toptions: 0x%08X" % int(attr_default(c, 'options', 0)))
180 if not 'mS-DS-ReplicatesNCReason' in c:
181 self.message("Warning: No NC replicated for Connection!")
183 for r in c['mS-DS-ReplicatesNCReason']:
184 a = str(r).split(':')
185 self.message("\t\tReplicatesNC: %s" % a[3])
186 self.message("\t\tReason: 0x%08x" % int(a[2]))
188 if getattr(dsdb, s, 0) & int(a[2]):
189 self.message("\t\t\t%s" % s)
193 class cmd_drs_kcc(Command):
194 """trigger knowledge consistency center run"""
196 synopsis = "%prog [<DC>] [options]"
198 takes_optiongroups = {
199 "sambaopts": options.SambaOptions,
200 "versionopts": options.VersionOptions,
201 "credopts": options.CredentialsOptions,
206 def run(self, DC=None, sambaopts=None,
207 credopts=None, versionopts=None, server=None):
209 self.lp = sambaopts.get_loadparm()
211 DC = common.netcmd_dnsname(self.lp)
214 self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
216 drsuapi_connect(self)
218 req1 = drsuapi.DsExecuteKCC1()
220 self.drsuapi.DsExecuteKCC(self.drsuapi_handle, 1, req1)
222 raise CommandError("DsExecuteKCC failed", e)
223 self.message("Consistency check on %s successful." % DC)
227 def drs_local_replicate(self, SOURCE_DC, NC):
228 '''replicate from a source DC to the local SAM'''
230 self.server = SOURCE_DC
231 drsuapi_connect(self)
233 self.local_samdb = SamDB(session_info=system_session(), url=None,
234 credentials=self.creds, lp=self.lp)
236 self.samdb = SamDB(url="ldap://%s" % self.server,
237 session_info=system_session(),
238 credentials=self.creds, lp=self.lp)
240 # work out the source and destination GUIDs
241 res = self.local_samdb.search(base="", scope=ldb.SCOPE_BASE, attrs=["dsServiceName"])
242 self.ntds_dn = res[0]["dsServiceName"][0]
244 res = self.local_samdb.search(base=self.ntds_dn, scope=ldb.SCOPE_BASE, attrs=["objectGUID"])
245 self.ntds_guid = misc.GUID(self.samdb.schema_format_value("objectGUID", res[0]["objectGUID"][0]))
248 source_dsa_invocation_id = misc.GUID(self.samdb.get_invocation_id())
249 destination_dsa_guid = self.ntds_guid
251 self.samdb.transaction_start()
252 repl = drs_utils.drs_Replicate("ncacn_ip_tcp:%s[seal]" % self.server, self.lp,
253 self.creds, self.local_samdb)
255 repl.replicate(NC, source_dsa_invocation_id, destination_dsa_guid)
257 raise CommandError("Error replicating DN %s" % NC, e)
258 self.samdb.transaction_commit()
262 class cmd_drs_replicate(Command):
263 """replicate a naming context between two DCs"""
265 synopsis = "%prog <destinationDC> <sourceDC> <NC> [options]"
267 takes_optiongroups = {
268 "sambaopts": options.SambaOptions,
269 "versionopts": options.VersionOptions,
270 "credopts": options.CredentialsOptions,
273 takes_args = ["DEST_DC", "SOURCE_DC", "NC"]
276 Option("--add-ref", help="use ADD_REF to add to repsTo on source", action="store_true"),
277 Option("--sync-forced", help="use SYNC_FORCED to force inbound replication", action="store_true"),
278 Option("--sync-all", help="use SYNC_ALL to replicate from all DCs", action="store_true"),
279 Option("--full-sync", help="resync all objects", action="store_true"),
280 Option("--local", help="pull changes directly into the local database (destination DC is ignored)", action="store_true"),
283 def run(self, DEST_DC, SOURCE_DC, NC,
284 add_ref=False, sync_forced=False, sync_all=False, full_sync=False,
285 local=False, sambaopts=None, credopts=None, versionopts=None, server=None):
287 self.server = DEST_DC
288 self.lp = sambaopts.get_loadparm()
290 self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
293 drs_local_replicate(self, SOURCE_DC, NC)
296 drsuapi_connect(self)
299 # we need to find the NTDS GUID of the source DC
300 msg = self.samdb.search(base=self.samdb.get_config_basedn(),
301 expression="(&(objectCategory=server)(|(name=%s)(dNSHostName=%s)))" % (
302 ldb.binary_encode(SOURCE_DC),
303 ldb.binary_encode(SOURCE_DC)),
306 raise CommandError("Failed to find source DC %s" % SOURCE_DC)
307 server_dn = msg[0]['dn']
309 msg = self.samdb.search(base=server_dn, scope=ldb.SCOPE_ONELEVEL,
310 expression="(|(objectCategory=nTDSDSA)(objectCategory=nTDSDSARO))",
311 attrs=['objectGUID', 'options'])
313 raise CommandError("Failed to find source NTDS DN %s" % SOURCE_DC)
314 source_dsa_guid = msg[0]['objectGUID'][0]
315 dsa_options = int(attr_default(msg, 'options', 0))
319 if not (dsa_options & dsdb.DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL):
320 req_options |= drsuapi.DRSUAPI_DRS_WRIT_REP
322 req_options |= drsuapi.DRSUAPI_DRS_ADD_REF
324 req_options |= drsuapi.DRSUAPI_DRS_SYNC_FORCED
326 req_options |= drsuapi.DRSUAPI_DRS_SYNC_ALL
328 req_options |= drsuapi.DRSUAPI_DRS_FULL_SYNC_NOW
331 drs_utils.sendDsReplicaSync(self.drsuapi, self.drsuapi_handle, source_dsa_guid, NC, req_options)
332 except drs_utils.drsException, estr:
333 raise CommandError("DsReplicaSync failed", estr)
334 self.message("Replicate from %s to %s was successful." % (SOURCE_DC, DEST_DC))
338 class cmd_drs_bind(Command):
339 """show DRS capabilities of a server"""
341 synopsis = "%prog [<DC>] [options]"
343 takes_optiongroups = {
344 "sambaopts": options.SambaOptions,
345 "versionopts": options.VersionOptions,
346 "credopts": options.CredentialsOptions,
351 def run(self, DC=None, sambaopts=None,
352 credopts=None, versionopts=None, server=None):
354 self.lp = sambaopts.get_loadparm()
356 DC = common.netcmd_dnsname(self.lp)
358 self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
360 drsuapi_connect(self)
363 bind_info = drsuapi.DsBindInfoCtr()
364 bind_info.length = 28
365 bind_info.info = drsuapi.DsBindInfo28()
366 (info, handle) = self.drsuapi.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info)
369 ("DRSUAPI_SUPPORTED_EXTENSION_BASE", "DRS_EXT_BASE"),
370 ("DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION", "DRS_EXT_ASYNCREPL"),
371 ("DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI", "DRS_EXT_REMOVEAPI"),
372 ("DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2", "DRS_EXT_MOVEREQ_V2"),
373 ("DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS", "DRS_EXT_GETCHG_DEFLATE"),
374 ("DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1", "DRS_EXT_DCINFO_V1"),
375 ("DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION", "DRS_EXT_RESTORE_USN_OPTIMIZATION"),
376 ("DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY", "DRS_EXT_ADDENTRY"),
377 ("DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE", "DRS_EXT_KCC_EXECUTE"),
378 ("DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2", "DRS_EXT_ADDENTRY_V2"),
379 ("DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION", "DRS_EXT_LINKED_VALUE_REPLICATION"),
380 ("DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2", "DRS_EXT_DCINFO_V2"),
381 ("DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD","DRS_EXT_INSTANCE_TYPE_NOT_REQ_ON_MOD"),
382 ("DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND", "DRS_EXT_CRYPTO_BIND"),
383 ("DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO", "DRS_EXT_GET_REPL_INFO"),
384 ("DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION", "DRS_EXT_STRONG_ENCRYPTION"),
385 ("DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01", "DRS_EXT_DCINFO_VFFFFFFFF"),
386 ("DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP", "DRS_EXT_TRANSITIVE_MEMBERSHIP"),
387 ("DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY", "DRS_EXT_ADD_SID_HISTORY"),
388 ("DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3", "DRS_EXT_POST_BETA3"),
389 ("DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5", "DRS_EXT_GETCHGREQ_V5"),
390 ("DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2", "DRS_EXT_GETMEMBERSHIPS2"),
391 ("DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6", "DRS_EXT_GETCHGREQ_V6"),
392 ("DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS", "DRS_EXT_NONDOMAIN_NCS"),
393 ("DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8", "DRS_EXT_GETCHGREQ_V8"),
394 ("DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5", "DRS_EXT_GETCHGREPLY_V5"),
395 ("DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6", "DRS_EXT_GETCHGREPLY_V6"),
396 ("DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3", "DRS_EXT_WHISTLER_BETA3"),
397 ("DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7", "DRS_EXT_WHISTLER_BETA3"),
398 ("DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT", "DRS_EXT_WHISTLER_BETA3"),
399 ("DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS", "DRS_EXT_W2K3_DEFLATE"),
400 ("DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V10", "DRS_EXT_GETCHGREQ_V10"),
401 ("DRSUAPI_SUPPORTED_EXTENSION_RESERVED_PART2", "DRS_EXT_RESERVED_FOR_WIN2K_OR_DOTNET_PART2"),
402 ("DRSUAPI_SUPPORTED_EXTENSION_RESERVED_PART3", "DRS_EXT_RESERVED_FOR_WIN2K_OR_DOTNET_PART3")
406 ("DRSUAPI_SUPPORTED_EXTENSION_ADAM", "DRS_EXT_ADAM"),
407 ("DRSUAPI_SUPPORTED_EXTENSION_LH_BETA2", "DRS_EXT_LH_BETA2"),
408 ("DRSUAPI_SUPPORTED_EXTENSION_RECYCLE_BIN", "DRS_EXT_RECYCLE_BIN")]
410 self.message("Bind to %s succeeded." % DC)
411 self.message("Extensions supported:")
412 for (opt, str) in optmap:
413 optval = getattr(drsuapi, opt, 0)
414 if info.info.supported_extensions & optval:
418 self.message(" %-60s: %s (%s)" % (opt, yesno, str))
420 if isinstance(info.info, drsuapi.DsBindInfo48):
421 self.message("\nExtended Extensions supported:")
422 for (opt, str) in optmap_ext:
423 optval = getattr(drsuapi, opt, 0)
424 if info.info.supported_extensions_ext & optval:
428 self.message(" %-60s: %s (%s)" % (opt, yesno, str))
430 self.message("\nSite GUID: %s" % info.info.site_guid)
431 self.message("Repl epoch: %u" % info.info.repl_epoch)
432 if isinstance(info.info, drsuapi.DsBindInfo48):
433 self.message("Forest GUID: %s" % info.info.config_dn_guid)
437 class cmd_drs_options(Command):
438 """query or change 'options' for NTDS Settings object of a domain controller"""
440 synopsis = "%prog [<DC>] [options]"
442 takes_optiongroups = {
443 "sambaopts": options.SambaOptions,
444 "versionopts": options.VersionOptions,
445 "credopts": options.CredentialsOptions,
451 Option("--dsa-option", help="DSA option to enable/disable", type="str",
452 metavar="{+|-}IS_GC | {+|-}DISABLE_INBOUND_REPL | {+|-}DISABLE_OUTBOUND_REPL | {+|-}DISABLE_NTDSCONN_XLATE" ),
455 option_map = {"IS_GC": 0x00000001,
456 "DISABLE_INBOUND_REPL": 0x00000002,
457 "DISABLE_OUTBOUND_REPL": 0x00000004,
458 "DISABLE_NTDSCONN_XLATE": 0x00000008}
460 def run(self, DC=None, dsa_option=None,
461 sambaopts=None, credopts=None, versionopts=None):
463 self.lp = sambaopts.get_loadparm()
465 DC = common.netcmd_dnsname(self.lp)
467 self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
471 ntds_dn = self.samdb.get_dsServiceName()
472 res = self.samdb.search(base=ntds_dn, scope=ldb.SCOPE_BASE, attrs=["options"])
473 dsa_opts = int(res[0]["options"][0])
475 # print out current DSA options
476 cur_opts = [x for x in self.option_map if self.option_map[x] & dsa_opts]
477 self.message("Current DSA options: " + ", ".join(cur_opts))
481 if dsa_option[:1] not in ("+", "-"):
482 raise CommandError("Unknown option %s" % dsa_option)
483 flag = dsa_option[1:]
484 if flag not in self.option_map.keys():
485 raise CommandError("Unknown option %s" % dsa_option)
486 if dsa_option[:1] == "+":
487 dsa_opts |= self.option_map[flag]
489 dsa_opts &= ~self.option_map[flag]
492 m.dn = ldb.Dn(self.samdb, ntds_dn)
493 m["options"]= ldb.MessageElement(str(dsa_opts), ldb.FLAG_MOD_REPLACE, "options")
495 # print out new DSA options
496 cur_opts = [x for x in self.option_map if self.option_map[x] & dsa_opts]
497 self.message("New DSA options: " + ", ".join(cur_opts))
500 class cmd_drs(SuperCommand):
501 """Directory Replication Services (DRS) management"""
504 subcommands["bind"] = cmd_drs_bind()
505 subcommands["kcc"] = cmd_drs_kcc()
506 subcommands["replicate"] = cmd_drs_replicate()
507 subcommands["showrepl"] = cmd_drs_showrepl()
508 subcommands["options"] = cmd_drs_options()