docs-xml/manpages/samba-tool.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="samba-tool.8">
   4
   5 <refmeta>
   6         <refentrytitle>samba-tool</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
  10         <refmiscinfo class="version">&doc.version;</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>samba-tool</refname>
  16         <refpurpose>Main Samba administration tool.
  17         </refpurpose>
  18 </refnamediv>
  19
  20 <refsynopsisdiv>
  21         <cmdsynopsis>
  22                 <command>samba-tool</command>
  23                 <arg choice="opt">-h</arg>
  24                 <arg choice="opt">-W myworkgroup</arg>
  25                 <arg choice="opt">-U user</arg>
  26                 <arg choice="opt">-d debuglevel</arg>
  27                 <arg choice="opt">--v</arg>
  28         </cmdsynopsis>
  29 </refsynopsisdiv>
  30
  31 <refsect1>
  32         <title>DESCRIPTION</title>
  33         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  34         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  35 </refsect1>
  36
  37 <refsect1>
  38         <title>OPTIONS</title>
  39
  40         <variablelist>
  41
  42         <varlistentry>
  43         <term>-h|--help</term>
  44         <listitem><para>
  45         Show this help message and exit
  46         </para></listitem>
  47         </varlistentry>
  48
  49         <varlistentry>
  50         <term>--realm=REALM</term>
  51         <listitem><para>
  52         Set the realm name
  53         </para></listitem>
  54         </varlistentry>
  55
  56         <varlistentry>
  57         <term>--simple-bind-dn=DN</term>
  58         <listitem><para>
  59         DN to use for a simple bind
  60         </para></listitem>
  61         </varlistentry>
  62
  63         <varlistentry>
  64         <term>--password=PASSWORD</term>
  65         <listitem><para>
  66         Password
  67         </para></listitem>
  68         </varlistentry>
  69
  70         <varlistentry>
  71         <term>-U USERNAME|--username=USERNAME</term>
  72         <listitem><para>
  73         Username
  74         </para></listitem>
  75         </varlistentry>
  76
  77         <varlistentry>
  78         <term>-W WORKGROUP|--workgroup=WORKGROUP</term>
  79         <listitem><para>
  80         Workgroup
  81         </para></listitem>
  82         </varlistentry>
  83
  84         <varlistentry>
  85         <term>-N|--no-pass</term>
  86         <listitem><para>
  87         Don't ask for a password
  88         </para></listitem>
  89         </varlistentry>
  90
  91         <varlistentry>
  92         <term>-k KERBEROS|--kerberos=KERBEROS</term>
  93         <listitem><para>
  94         Use Kerberos
  95         </para></listitem>
  96         </varlistentry>
  97
  98         <varlistentry>
  99         <term>--ipaddress=IPADDRESS</term>
 100         <listitem><para>
 101         IP address of the server
 102         </para></listitem>
 103         </varlistentry>
 104
 105         &popt.common.samba.client;
 106
 107         </variablelist>
 108 </refsect1>
 109
 110 <refsect1>
 111 <title>COMMANDS</title>
 112
 113 <refsect3>
 114         <title>computer create <replaceable>computername</replaceable> [options]</title>
 115         <para>Create a new computer in the Active Directory Domain.</para>
 116         <para>The new computer name specified on the command is the
 117         sAMAccountName, with or without the trailing dollar sign.</para>
 118
 119         <variablelist>
 120         <varlistentry>
 121         <term>--computerou=COMPUTEROU</term>
 122         <listitem><para>
 123         DN of alternative location (with or without domainDN counterpart) to
 124         default CN=Computers in which new computer object will be created.
 125         E.g. 'OU=OUname'.
 126         </para></listitem>
 127         </varlistentry>
 128
 129         <varlistentry>
 130         <term>--description=DESCRIPTION</term>
 131         <listitem><para>
 132         The new computers's description.
 133         </para></listitem>
 134         </varlistentry>
 135
 136         <varlistentry>
 137         <term>--ip-address=IP_ADDRESS_LIST</term>
 138         <listitem><para>
 139         IPv4 address for the computer's A record, or IPv6 address for AAAA record,
 140         can be provided multiple times.
 141         </para></listitem>
 142         </varlistentry>
 143
 144         <varlistentry>
 145         <term>--service-principal-name=SERVICE_PRINCIPAL_NAME_LIST</term>
 146         <listitem><para>
 147         Computer's Service Principal Name, can be provided multiple times.
 148         </para></listitem>
 149         </varlistentry>
 150
 151         <varlistentry>
 152         <term>--prepare-oldjoin</term>
 153         <listitem><para>
 154         Prepare enabled machine account for oldjoin mechanism.
 155         </para></listitem>
 156         </varlistentry>
 157         </variablelist>
 158 </refsect3>
 159
 160 <refsect3>
 161         <title>computer delete <replaceable>computername</replaceable> [options]</title>
 162         <para>Delete an existing computer account.</para>
 163         <para>The computer name specified on the command is the
 164         sAMAccountName, with or without the trailing dollar sign.</para>
 165 </refsect3>
 166
 167 <refsect3>
 168         <title>computer list</title>
 169         <para>List all computers.</para>
 170 </refsect3>
 171
 172 <refsect3>
 173         <title>computer move <replaceable>computername</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 174         <para>This command moves a computer account into the specified
 175         organizational unit or container.</para>
 176         <para>The computername specified on the command is the
 177         sAMAccountName, with or without the trailing dollar sign.</para>
 178         <para>The name of the organizational unit or container can be
 179         specified as a full DN or without the domainDN component.</para>
 180 </refsect3>
 181
 182 <refsect3>
 183         <title>computer show <replaceable>computername</replaceable> [options]</title>
 184         <para>Display a computer AD object.</para>
 185         <para>The computer name specified on the command is the
 186         sAMAccountName, with or without the trailing dollar sign.</para>
 187
 188         <variablelist>
 189         <varlistentry>
 190         <term>--attributes=USER_ATTRS</term>
 191         <listitem><para>
 192         Comma separated list of attributes, which will be printed.
 193         </para></listitem>
 194         </varlistentry>
 195         </variablelist>
 196 </refsect3>
 197
 198 <refsect2>
 199         <title>dbcheck</title>
 200         <para>Check the local AD database for errors.</para>
 201 </refsect2>
 202
 203 <refsect2>
 204         <title>delegation</title>
 205         <para>Manage Delegations.</para>
 206 </refsect2>
 207
 208 <refsect3>
 209         <title>delegation add-service <replaceable>accountname</replaceable> <replaceable>principal</replaceable> [options]</title>
 210         <para>Add a service principal as msDS-AllowedToDelegateTo.</para>
 211 </refsect3>
 212
 213 <refsect3>
 214         <title>delegation del-service <replaceable>accountname</replaceable> <replaceable>principal</replaceable> [options]</title>
 215         <para>Delete a service principal as msDS-AllowedToDelegateTo.</para>
 216 </refsect3>
 217
 218 <refsect3>
 219         <title>delegation for-any-protocol <replaceable>accountname</replaceable> [(on|off)] [options]</title>
 220         <para>Set/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy)
 221         for an account.</para>
 222 </refsect3>
 223
 224 <refsect3>
 225         <title>delegation for-any-service <replaceable>accountname</replaceable> [(on|off)] [options]</title>
 226         <para>Set/unset UF_TRUSTED_FOR_DELEGATION for an account.</para>
 227 </refsect3>
 228
 229 <refsect3>
 230         <title>delegation show <replaceable>accountname</replaceable> [options] </title>
 231         <para>Show the delegation setting of an account.</para>
 232 </refsect3>
 233
 234 <refsect2>
 235         <title>dns</title>
 236         <para>Manage Domain Name Service (DNS).</para>
 237 </refsect2>
 238
 239 <refsect3>
 240         <title>dns add <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>data</replaceable></title>
 241         <para>Add a DNS record.</para>
 242 </refsect3>
 243
 244 <refsect3>
 245         <title>dns delete <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>data</replaceable></title>
 246         <para>Delete a DNS record.</para>
 247 </refsect3>
 248
 249 <refsect3>
 250         <title>dns query <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT|ALL</replaceable> [options] <replaceable>data</replaceable></title>
 251         <para>Query a name.</para>
 252 </refsect3>
 253
 254 <refsect3>
 255         <title>dns roothints <replaceable>server</replaceable> [<replaceable>name</replaceable>] [options]</title>
 256         <para>Query root hints.</para>
 257 </refsect3>
 258
 259 <refsect3>
 260         <title>dns serverinfo <replaceable>server</replaceable> [options]</title>
 261         <para>Query server information.</para>
 262 </refsect3>
 263
 264 <refsect3>
 265         <title>dns update <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>olddata</replaceable> <replaceable>newdata</replaceable></title>
 266         <para>Update a DNS record.</para>
 267 </refsect3>
 268
 269 <refsect3>
 270         <title>dns zonecreate <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 271         <para>Create a zone.</para>
 272 </refsect3>
 273
 274 <refsect3>
 275         <title>dns zonedelete <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 276         <para>Delete a zone.</para>
 277 </refsect3>
 278
 279 <refsect3>
 280         <title>dns zoneinfo <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 281         <para>Query zone information.</para>
 282 </refsect3>
 283
 284 <refsect3>
 285         <title>dns zonelist <replaceable>server</replaceable> [options]</title>
 286         <para>List zones.</para>
 287 </refsect3>
 288
 289 <refsect2>
 290         <title>domain</title>
 291         <para>Manage Domain.</para>
 292 </refsect2>
 293
 294 <refsect3>
 295         <title>domain backup</title>
 296         <para>Create or restore a backup of the domain.</para>
 297 </refsect3>
 298
 299 <refsect3>
 300         <title>domain backup online</title>
 301         <para>Copy a running DC's current DB into a backup tar file.</para>
 302 </refsect3>
 303
 304 <refsect3>
 305         <title>domain backup rename</title>
 306         <para>Copy a running DC's DB to backup file, renaming the domain in the process.</para>
 307 </refsect3>
 308
 309 <refsect3>
 310         <title>domain backup restore</title>
 311         <para>Restore the domain's DB from a backup-file.</para>
 312 </refsect3>
 313
 314 <refsect3>
 315         <title>domain classicupgrade [options] <replaceable>classic_smb_conf</replaceable></title>
 316         <para>Upgrade from Samba classic (NT4-like) database to Samba AD DC
 317         database.</para>
 318 </refsect3>
 319
 320 <refsect3>
 321         <title>domain dcpromo <replaceable>dnsdomain</replaceable> [DC|RODC] [options]</title>
 322         <para>Promote an existing domain member or NT4 PDC to an AD DC.</para>
 323 </refsect3>
 324
 325 <refsect3>
 326         <title>domain demote</title>
 327         <para>Demote ourselves from the role of domain controller.</para>
 328 </refsect3>
 329
 330 <refsect3>
 331         <title>domain exportkeytab <replaceable>keytab</replaceable> [options]</title>
 332         <para>Dumps Kerberos keys of the domain into a keytab.</para>
 333 </refsect3>
 334
 335 <refsect3>
 336         <title>domain info <replaceable>ip_address</replaceable> [options]</title>
 337         <para>Print basic info about a domain and the specified DC.
 338 </para>
 339 </refsect3>
 340
 341 <refsect3>
 342         <title>domain join <replaceable>dnsdomain</replaceable> [DC|RODC|MEMBER|SUBDOMAIN] [options]</title>
 343         <para>Join a domain as either member or backup domain controller.</para>
 344 </refsect3>
 345
 346 <refsect3>
 347         <title>domain level <replaceable>show|raise</replaceable> <replaceable>options</replaceable> [options]</title>
 348         <para>Show/raise domain and forest function levels.</para>
 349 </refsect3>
 350
 351 <refsect3>
 352         <title>domain passwordsettings <replaceable>show|set</replaceable> <replaceable>options</replaceable> [options]</title>
 353         <para>Show/set password settings.</para>
 354 </refsect3>
 355
 356 <refsect3>
 357         <title>domain passwordsettings pso</title>
 358         <para>Manage fine-grained Password Settings Objects (PSOs).</para>
 359 </refsect3>
 360
 361 <refsect3>
 362         <title>domain passwordsettings pso apply <replaceable>pso-name</replaceable> <replaceable>user-or-group-name</replaceable> [options]</title>
 363         <para>Applies a PSO's password policy to a user or group.</para>
 364 </refsect3>
 365
 366 <refsect3>
 367         <title>domain passwordsettings pso create <replaceable>pso-name</replaceable> <replaceable>precedence</replaceable> [options]</title>
 368         <para>Creates a new Password Settings Object (PSO).</para>
 369 </refsect3>
 370
 371 <refsect3>
 372         <title>domain passwordsettings pso delete <replaceable>pso-name</replaceable> [options]</title>
 373         <para>Deletes a Password Settings Object (PSO).</para>
 374 </refsect3>
 375
 376 <refsect3>
 377         <title>domain passwordsettings pso list [options]</title>
 378         <para>Lists all Password Settings Objects (PSOs).</para>
 379 </refsect3>
 380
 381 <refsect3>
 382         <title>domain passwordsettings pso set <replaceable>pso-name</replaceable> [options]</title>
 383         <para>Modifies a Password Settings Object (PSO).</para>
 384 </refsect3>
 385
 386 <refsect3>
 387         <title>domain passwordsettings pso show <replaceable>user-name</replaceable> [options]</title>
 388         <para>Displays a Password Settings Object (PSO).</para>
 389 </refsect3>
 390
 391 <refsect3>
 392         <title>domain passwordsettings pso show-user <replaceable>pso-name</replaceable> [options]</title>
 393         <para>Displays the Password Settings that apply to a user.</para>
 394 </refsect3>
 395
 396 <refsect3>
 397         <title>domain passwordsettings pso unapply <replaceable>pso-name</replaceable> <replaceable>user-or-group-name</replaceable> [options]</title>
 398         <para>Updates a PSO to no longer apply to a user or group.</para>
 399 </refsect3>
 400
 401 <refsect3>
 402         <title>domain provision</title>
 403         <para>Promote an existing domain member or NT4 PDC to an AD DC.</para>
 404 </refsect3>
 405
 406 <refsect3>
 407         <title>domain trust</title>
 408         <para>Domain and forest trust management.</para>
 409 </refsect3>
 410
 411 <refsect3>
 412         <title>domain trust create <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 413         <para>Create a domain or forest trust.</para>
 414 </refsect3>
 415
 416 <refsect3>
 417         <title>domain trust delete <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 418         <para>Delete a domain trust.</para>
 419 </refsect3>
 420
 421 <refsect3>
 422         <title>domain trust list <replaceable>options</replaceable> [options]</title>
 423         <para>List domain trusts.</para>
 424 </refsect3>
 425
 426 <refsect3>
 427         <title>domain trust namespaces [<replaceable>DOMAIN</replaceable>] <replaceable>options</replaceable> [options]</title>
 428         <para>Manage forest trust namespaces.</para>
 429 </refsect3>
 430
 431 <refsect3>
 432         <title>domain trust show <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 433         <para>Show trusted domain details.</para>
 434 </refsect3>
 435
 436 <refsect3>
 437         <title>domain trust validate <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 438         <para>Validate a domain trust.</para>
 439 </refsect3>
 440
 441 <refsect2>
 442         <title>drs</title>
 443         <para>Manage Directory Replication Services (DRS).</para>
 444 </refsect2>
 445
 446 <refsect3>
 447         <title>drs bind</title>
 448         <para>Show DRS capabilities of a server.</para>
 449 </refsect3>
 450
 451 <refsect3>
 452         <title>drs kcc</title>
 453         <para>Trigger knowledge consistency center run.</para>
 454 </refsect3>
 455
 456 <refsect3>
 457         <title>drs options</title>
 458         <para>Query or change <replaceable>options</replaceable> for NTDS Settings
 459         object of a domain controller.</para>
 460 </refsect3>
 461
 462 <refsect3>
 463         <title>drs replicate <replaceable>destination_DC</replaceable> <replaceable>source_DC</replaceable> <replaceable>NC</replaceable> [options]</title>
 464         <para>Replicate a naming context between two DCs.</para>
 465 </refsect3>
 466
 467 <refsect3>
 468         <title>drs showrepl</title>
 469         <para>Show replication status. The <arg
 470         choice="opt">--json</arg> option results in JSON output, and
 471         with the <arg choice="opt">--summary</arg> option produces
 472         very little output when the replication status seems healthy.
 473         </para>
 474 </refsect3>
 475
 476 <refsect2>
 477         <title>dsacl</title>
 478         <para>Administer DS ACLs</para>
 479 </refsect2>
 480
 481 <refsect3>
 482         <title>dsacl set</title>
 483         <para>Modify access list on a directory object.</para>
 484 </refsect3>
 485
 486 <refsect2>
 487         <title>forest</title>
 488         <para>Manage Forest configuration.</para>
 489 </refsect2>
 490
 491 <refsect3>
 492         <title>forest directory_service</title>
 493         <para>Manage directory_service behaviour for the forest.</para>
 494 </refsect3>
 495
 496 <refsect3>
 497         <title>forest directory_service dsheuristics <replaceable>VALUE</replaceable></title>
 498         <para>Modify dsheuristics directory_service configuration for the forest.</para>
 499 </refsect3>
 500
 501 <refsect3>
 502         <title>forest directory_service show</title>
 503         <para>Show current directory_service configuration for the forest.</para>
 504 </refsect3>
 505
 506 <refsect2>
 507         <title>fsmo</title>
 508         <para>Manage Flexible Single Master Operations (FSMO).</para>
 509 </refsect2>
 510
 511 <refsect3>
 512         <title>fsmo seize [options]</title>
 513         <para>Seize the role.</para>
 514 </refsect3>
 515
 516 <refsect3>
 517         <title>fsmo show</title>
 518         <para>Show the roles.</para>
 519 </refsect3>
 520
 521 <refsect3>
 522         <title>fsmo transfer [options]</title>
 523         <para>Transfer the role.</para>
 524 </refsect3>
 525
 526 <refsect2>
 527         <title>gpo</title>
 528         <para>Manage Group Policy Objects (GPO).</para>
 529 </refsect2>
 530
 531 <refsect3>
 532         <title>gpo create <replaceable>displayname</replaceable> [options]</title>
 533         <para>Create an empty GPO.</para>
 534 </refsect3>
 535
 536 <refsect3>
 537         <title>gpo del <replaceable>gpo</replaceable> [options]</title>
 538         <para>Delete GPO.</para>
 539 </refsect3>
 540
 541 <refsect3>
 542         <title>gpo dellink <replaceable>container_dn</replaceable> <replaceable>gpo</replaceable> [options]</title>
 543         <para>Delete GPO link from a container.</para>
 544 </refsect3>
 545
 546 <refsect3>
 547         <title>gpo fetch <replaceable>gpo</replaceable> [options]</title>
 548         <para>Download a GPO.</para>
 549 </refsect3>
 550
 551 <refsect3>
 552         <title>gpo getinheritance <replaceable>container_dn</replaceable> [options]</title>
 553         <para>Get inheritance flag for a container.</para>
 554 </refsect3>
 555
 556 <refsect3>
 557         <title>gpo getlink <replaceable>container_dn</replaceable> [options]</title>
 558         <para>List GPO Links for a container.</para>
 559 </refsect3>
 560
 561 <refsect3>
 562         <title>gpo list <replaceable>username</replaceable> [options]</title>
 563         <para>List GPOs for an account.</para>
 564 </refsect3>
 565
 566 <refsect3>
 567         <title>gpo listall</title>
 568         <para>List all GPOs.</para>
 569 </refsect3>
 570
 571 <refsect3>
 572         <title>gpo listcontainers <replaceable>gpo</replaceable> [options]</title>
 573         <para>List all linked containers for a GPO.</para>
 574 </refsect3>
 575
 576 <refsect3>
 577         <title>gpo setinheritance <replaceable>container_dn</replaceable> <replaceable>block|inherit</replaceable> [options]</title>
 578         <para>Set inheritance flag on a container.</para>
 579 </refsect3>
 580
 581 <refsect3>
 582         <title>gpo setlink <replaceable>container_dn</replaceable> <replaceable>gpo</replaceable> [options]</title>
 583         <para>Add or Update a GPO link to a container.</para>
 584 </refsect3>
 585
 586 <refsect3>
 587         <title>gpo show <replaceable>gpo</replaceable> [options]</title>
 588         <para>Show information for a GPO.</para>
 589 </refsect3>
 590
 591 <refsect2>
 592         <title>group</title>
 593         <para>Manage groups.</para>
 594 </refsect2>
 595
 596 <refsect3>
 597         <title>group add <replaceable>groupname</replaceable> [options]</title>
 598         <para>Create a new AD group.</para>
 599 </refsect3>
 600
 601 <refsect3>
 602         <title>group addmembers <replaceable>groupname</replaceable> <replaceable>members</replaceable> [options]</title>
 603         <para>Add members to an AD group.</para>
 604 </refsect3>
 605
 606 <refsect3>
 607         <title>group delete <replaceable>groupname</replaceable> [options]</title>
 608         <para>Delete an AD group.</para>
 609 </refsect3>
 610
 611 <refsect3>
 612         <title>group list</title>
 613         <para>List all groups.</para>
 614 </refsect3>
 615
 616 <refsect3>
 617         <title>group listmembers <replaceable>groupname</replaceable> [options]</title>
 618         <para>List all members of the specified AD group.</para>
 619 </refsect3>
 620
 621 <refsect3>
 622         <title>group move <replaceable>groupname</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 623         <para>This command moves a group into the specified organizational unit
 624         or container.</para>
 625         <para>The groupname specified on the command is the sAMAccountName.
 626         </para>
 627         <para>The name of the organizational unit or container can be
 628         specified as a full DN or without the domainDN component.</para>
 629         <para></para>
 630 </refsect3>
 631
 632 <refsect3>
 633         <title>group removemembers <replaceable>groupname</replaceable> <replaceable>members</replaceable> [options]</title>
 634         <para>Remove members from the specified AD group.</para>
 635 </refsect3>
 636
 637 <refsect3>
 638         <title>group show <replaceable>groupname</replaceable> [options]</title>
 639         <para>Show group object and it's attributes.</para>
 640 </refsect3>
 641
 642 <refsect2>
 643         <title>ldapcmp <replaceable>URL1</replaceable> <replaceable>URL2</replaceable> <replaceable>domain|configuration|schema|dnsdomain|dnsforest</replaceable> [options] </title>
 644         <para>Compare two LDAP databases.</para>
 645 </refsect2>
 646
 647 <refsect2>
 648         <title>ntacl</title>
 649         <para>Manage NT ACLs.</para>
 650 </refsect2>
 651
 652 <refsect3>
 653         <title>ntacl get <replaceable>file</replaceable> [options]</title>
 654         <para>Get ACLs on a file.</para>
 655 </refsect3>
 656
 657 <refsect3>
 658         <title>ntacl set <replaceable>acl</replaceable> <replaceable>file</replaceable> [options]</title>
 659         <para>Set ACLs on a file.</para>
 660 </refsect3>
 661
 662 <refsect3>
 663         <title>ntacl sysvolcheck</title>
 664         <para>Check sysvol ACLs match defaults (including correct ACLs on GPOs).</para>
 665 </refsect3>
 666
 667 <refsect3>
 668         <title>ntacl sysvolreset</title>
 669         <para>Reset sysvol ACLs to defaults (including correct ACLs on GPOs).</para>
 670 </refsect3>
 671
 672 <refsect3>
 673         <title>ou create <replaceable>ou_dn</replaceable> [options]</title>
 674         <para>Create an organizational unit.</para>
 675         <para>The name of the organizational unit can be specified as a full DN
 676         or without the domainDN component.</para>
 677
 678         <variablelist>
 679         <varlistentry>
 680         <term>--description=DESCRIPTION</term>
 681         <listitem><para>
 682         Specify OU's description.
 683         </para></listitem>
 684         </varlistentry>
 685         </variablelist>
 686 </refsect3>
 687
 688 <refsect3>
 689         <title>ou delete <replaceable>ou_dn</replaceable> [options]</title>
 690         <para>Delete an organizational unit.</para>
 691         <para>The name of the organizational unit can be specified as a full DN
 692         or without the domainDN component.</para>
 693
 694         <variablelist>
 695         <varlistentry>
 696         <term>--force-subtree-delete</term>
 697         <listitem><para>
 698         Delete organizational unit and all children reclusively.
 699         </para></listitem>
 700         </varlistentry>
 701         </variablelist>
 702 </refsect3>
 703
 704 <refsect3>
 705         <title>ou list [options]</title>
 706         <para>List all organizational units.</para>
 707         <variablelist>
 708         <varlistentry>
 709         <term>--full-dn</term>
 710         <listitem><para>
 711         Display DNs including the base DN.
 712         </para></listitem>
 713         </varlistentry>
 714         </variablelist>
 715 </refsect3>
 716
 717 <refsect3>
 718         <title>ou listobjects <replaceable>ou_dn</replaceable> [options]</title>
 719         <para>List all objects in an organizational unit.</para>
 720         <para>The name of the organizational unit can be specified as a full DN
 721         or without the domainDN component.</para>
 722
 723         <variablelist>
 724         <varlistentry>
 725         <term>--full-dn</term>
 726         <listitem><para>
 727         Display DNs including the base DN.
 728         </para></listitem>
 729         </varlistentry>
 730
 731         <varlistentry>
 732         <term>-r|--recursive</term>
 733         <listitem><para>
 734         List objects recursively.
 735         </para></listitem>
 736         </varlistentry>
 737         </variablelist>
 738 </refsect3>
 739
 740 <refsect3>
 741         <title>ou move <replaceable>old_ou_dn</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 742         <para>Move an organizational unit.</para>
 743         <para>The name of the organizational units can be specified as a full DN
 744         or without the domainDN component.</para>
 745 </refsect3>
 746
 747 <refsect3>
 748         <title>ou rename <replaceable>old_ou_dn</replaceable> <replaceable>new_ou_dn</replaceable> [options]</title>
 749         <para>Rename an organizational unit.</para>
 750         <para>The name of the organizational units can be specified as a full DN
 751         or without the domainDN component.</para>
 752 </refsect3>
 753
 754 <refsect2>
 755         <title>rodc</title>
 756         <para>Manage Read-Only Domain Controller (RODC).</para>
 757 </refsect2>
 758
 759 <refsect3>
 760         <title>rodc preload <replaceable>SID</replaceable>|<replaceable>DN</replaceable>|<replaceable>accountname</replaceable> [options]</title>
 761         <para>Preload one account for an RODC.</para>
 762 </refsect3>
 763
 764 <refsect2>
 765         <title>schema</title>
 766         <para>Manage and query schema.</para>
 767 </refsect2>
 768
 769 <refsect3>
 770         <title>schema attribute modify <replaceable>attribute</replaceable> [options]</title>
 771         <para>Modify the behaviour of an attribute in schema.</para>
 772 </refsect3>
 773
 774 <refsect3>
 775         <title>schema attribute show <replaceable>attribute</replaceable> [options]</title>
 776         <para>Display an attribute schema definition.</para>
 777 </refsect3>
 778
 779 <refsect3>
 780         <title>schema attribute show_oc <replaceable>attribute</replaceable> [options]</title>
 781         <para>Show objectclasses that MAY or MUST contain this attribute.</para>
 782 </refsect3>
 783
 784 <refsect3>
 785         <title>schema objectclass show <replaceable>objectclass</replaceable> [options]</title>
 786         <para>Display an objectclass schema definition.</para>
 787 </refsect3>
 788
 789 <refsect2>
 790         <title>sites</title>
 791         <para>Manage sites.</para>
 792 </refsect2>
 793
 794 <refsect3>
 795         <title>sites create <replaceable>site</replaceable> [options]</title>
 796         <para>Create a new site.</para>
 797 </refsect3>
 798
 799 <refsect3>
 800         <title>sites remove <replaceable>site</replaceable> [options]</title>
 801         <para>Delete an existing site.</para>
 802 </refsect3>
 803
 804 <refsect2>
 805         <title>spn</title>
 806         <para>Manage Service Principal Names (SPN).</para>
 807 </refsect2>
 808
 809 <refsect3>
 810         <title>spn add <replaceable>name</replaceable> <replaceable>user</replaceable> [options]</title>
 811         <para>Create a new SPN.</para>
 812 </refsect3>
 813
 814 <refsect3>
 815         <title>spn delete <replaceable>name</replaceable> [<replaceable>user</replaceable>] [options]</title>
 816         <para>Delete an existing SPN.</para>
 817 </refsect3>
 818
 819 <refsect3>
 820         <title>spn list <replaceable>user</replaceable> [options]</title>
 821         <para>List SPNs of a given user.</para>
 822 </refsect3>
 823
 824 <refsect2>
 825         <title>testparm</title>
 826         <para>Check the syntax of the configuration file.</para>
 827 </refsect2>
 828
 829 <refsect2>
 830         <title>time</title>
 831         <para>Retrieve the time on a server.</para>
 832 </refsect2>
 833
 834 <refsect2>
 835         <title>user</title>
 836         <para>Manage users.</para>
 837 </refsect2>
 838
 839 <refsect3>
 840         <title>user add <replaceable>username</replaceable> [<replaceable>password</replaceable>]</title>
 841         <para>Create a new user. Please note that this subcommand is deprecated
 842         and available for compatibility reasons only. Please use
 843         <command>samba-tool user create</command> instead.</para>
 844 </refsect3>
 845
 846 <refsect3>
 847         <title>user create <replaceable>username</replaceable> [<replaceable>password</replaceable>]</title>
 848         <para>Create a new user in the Active Directory Domain.</para>
 849 </refsect3>
 850
 851 <refsect3>
 852         <title>user delete <replaceable>username</replaceable> [options]</title>
 853         <para>Delete an existing user account.</para>
 854 </refsect3>
 855
 856 <refsect3>
 857         <title>user disable <replaceable>username</replaceable></title>
 858         <para>Disable an user account.</para>
 859 </refsect3>
 860
 861 <refsect3>
 862         <title>user enable <replaceable>username</replaceable></title>
 863         <para>Enable an user account.</para>
 864 </refsect3>
 865
 866 <refsect3>
 867         <title>user list</title>
 868         <para>List all users.</para>
 869 </refsect3>
 870
 871 <refsect3>
 872         <title>user show <replaceable>username</replaceable> [options]</title>
 873         <para>Display a user AD object.</para>
 874
 875         <variablelist>
 876         <varlistentry>
 877         <term>--attributes=USER_ATTRS</term>
 878         <listitem><para>
 879         Comma separated list of attributes, which will be printed.
 880         </para></listitem>
 881         </varlistentry>
 882         </variablelist>
 883 </refsect3>
 884
 885 <refsect3>
 886         <title>user move <replaceable>username</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 887         <para>This command moves a user account into the specified
 888         organizational unit or container.</para>
 889         <para>The username specified on the command is the
 890         sAMAccountName.</para>
 891         <para>The name of the organizational unit or container can be
 892         specified as a full DN or without the domainDN component.</para>
 893 </refsect3>
 894
 895 <refsect3>
 896         <title>user password [options]</title>
 897         <para>Change password for an user account (the one provided in
 898         authentication).</para>
 899 </refsect3>
 900
 901 <refsect3>
 902         <title>user setexpiry <replaceable>username</replaceable> [options]</title>
 903         <para>Set the expiration of an user account.</para>
 904 </refsect3>
 905
 906 <refsect3>
 907         <title>user setpassword <replaceable>username</replaceable> [options]</title>
 908         <para>Sets or resets the password of an user account.</para>
 909 </refsect3>
 910
 911 <refsect3>
 912         <title>user getpassword <replaceable>username</replaceable> [options]</title>
 913         <para>Gets the password of an user account.</para>
 914 </refsect3>
 915
 916 <refsect3>
 917         <title>user syncpasswords <replaceable>--cache-ldb-initialize</replaceable> [options]</title>
 918         <para>Syncs the passwords of all user accounts, using an optional script.</para>
 919         <para>Note that this command should run on a single domain controller only
 920         (typically the PDC-emulator).</para>
 921 </refsect3>
 922
 923 <refsect2>
 924         <title>vampire [options] <replaceable>domain</replaceable></title>
 925         <para>Join and synchronise a remote AD domain to the local server.
 926         Please note that <command>samba-tool vampire</command> is deprecated,
 927         please use <command>samba-tool domain join</command> instead.</para>
 928 </refsect2>
 929
 930 <refsect2>
 931         <title>visualize [options] <replaceable>subcommand</replaceable></title>
 932         <para>Produce graphical representations of Samba network state.
 933         To work out what is happening in a replication graph, it is sometimes
 934         helpful to use visualisations.</para>
 935
 936         <para>
 937         There are two subcommands, two graphical modes, and (roughly) two modes
 938         of operation with respect to the location of authority.</para>
 939
 940         <refsect3><title>MODES OF OPERATION</title>
 941         <varlistentry>
 942                 <term>samba-tool visualize ntdsconn</term>
 943                 <listitem><para>Looks at NTDS connections.
 944                 </para></listitem>
 945                 </varlistentry>
 946
 947         <varlistentry>
 948                 <term>samba-tool visualize reps</term>
 949                 <listitem><para>Looks at repsTo and repsFrom objects.
 950                 </para></listitem>
 951                 </varlistentry>
 952
 953         <varlistentry>
 954                 <term>samba-tool visualize uptodateness</term>
 955                 <listitem><para>Looks at replication lag as shown by the
 956                 uptodateness vectors.
 957                 </para></listitem>
 958                 </varlistentry>
 959         </refsect3>
 960
 961         <refsect3><title>GRAPHICAL MODES</title>
 962         <varlistentry>
 963                 <term>--distance</term>
 964                 <listitem><para>Distances between DCs are shown in a matrix in
 965                  the terminal.
 966                 </para></listitem>
 967                 </varlistentry>
 968
 969         <varlistentry>
 970                 <term>--dot</term>
 971                 <listitem><para>Generate Graphviz dot output (for
 972                 ntdsconn and reps modes). When viewed using dot or
 973                 xdot, this shows the network as a graph with DCs as
 974                 vertices and connections edges. Certain types of
 975                 degenerate edges are shown in different colours or
 976                 line-styles. </para></listitem>
 977                 </varlistentry>
 978         <varlistentry>
 979                 <term>--xdot</term>
 980                 <listitem><para>Generate Graphviz dot output as with
 981                 <arg choice="opt">--dot</arg> and attempt to view it
 982                 immediately using <command>/usr/bin/xdot</command>.
 983                 </para></listitem>
 984                 </varlistentry>
 985         </refsect3>
 986
 987         <varlistentry>
 988                 <term>-r</term>
 989                 <listitem><para>Normally,
 990                 <command>samba-tool</command> talks to one database;
 991                 with the <arg choice="opt">-r</arg> option attempts
 992                 are made to contact all the DCs known to the first
 993                 database. This is necessary for <command>samba-tool
 994                 visualize uptodateness</command> and for
 995                 <command>samba-tool visualize reps</command> because
 996                 the repsFrom/To objects are not replicated, and it can
 997                 reveal replication issues in other modes.
 998                 </para></listitem>
 999                 </varlistentry>
1000 </refsect2>
1001
1002 <refsect2>
1003 <title>help</title>
1004 <para>Gives usage information.</para>
1005 </refsect2>
1006
1007 </refsect1>
1008
1009 <refsect1>
1010         <title>VERSION</title>
1011
1012         <para>This man page is complete for version &doc.version; of the Samba
1013         suite.</para>
1014 </refsect1>
1015
1016 <refsect1>
1017         <title>AUTHOR</title>
1018
1019         <para>The original Samba software and related utilities
1020         were created by Andrew Tridgell. Samba is now developed
1021         by the Samba Team as an Open Source project similar
1022         to the way the Linux kernel is developed.</para>
1023 </refsect1>
1024
1025 </refentry>