docs-xml/manpages/samba-tool.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="samba-tool.8">
   4
   5 <refmeta>
   6         <refentrytitle>samba-tool</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
  10         <refmiscinfo class="version">&doc.version;</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>samba-tool</refname>
  16         <refpurpose>Main Samba administration tool.
  17         </refpurpose>
  18 </refnamediv>
  19
  20 <refsynopsisdiv>
  21         <cmdsynopsis>
  22                 <command>samba-tool</command>
  23                 <arg choice="opt">-h</arg>
  24                 <arg choice="opt">-W myworkgroup</arg>
  25                 <arg choice="opt">-U user</arg>
  26                 <arg choice="opt">-d debuglevel</arg>
  27                 <arg choice="opt">--v</arg>
  28         </cmdsynopsis>
  29 </refsynopsisdiv>
  30
  31 <refsect1>
  32         <title>DESCRIPTION</title>
  33         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  34         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  35 </refsect1>
  36
  37 <refsect1>
  38         <title>OPTIONS</title>
  39
  40         <variablelist>
  41
  42         <varlistentry>
  43         <term>-h|--help</term>
  44         <listitem><para>
  45         Show this help message and exit
  46         </para></listitem>
  47         </varlistentry>
  48
  49         <varlistentry>
  50         <term>--realm=REALM</term>
  51         <listitem><para>
  52         Set the realm name
  53         </para></listitem>
  54         </varlistentry>
  55
  56         <varlistentry>
  57         <term>--simple-bind-dn=DN</term>
  58         <listitem><para>
  59         DN to use for a simple bind
  60         </para></listitem>
  61         </varlistentry>
  62
  63         <varlistentry>
  64         <term>--password=PASSWORD</term>
  65         <listitem><para>
  66         Password
  67         </para></listitem>
  68         </varlistentry>
  69
  70         <varlistentry>
  71         <term>-U USERNAME|--username=USERNAME</term>
  72         <listitem><para>
  73         Username
  74         </para></listitem>
  75         </varlistentry>
  76
  77         <varlistentry>
  78         <term>-W WORKGROUP|--workgroup=WORKGROUP</term>
  79         <listitem><para>
  80         Workgroup
  81         </para></listitem>
  82         </varlistentry>
  83
  84         <varlistentry>
  85         <term>-N|--no-pass</term>
  86         <listitem><para>
  87         Don't ask for a password
  88         </para></listitem>
  89         </varlistentry>
  90
  91         <varlistentry>
  92         <term>-k KERBEROS|--kerberos=KERBEROS</term>
  93         <listitem><para>
  94         Use Kerberos
  95         </para></listitem>
  96         </varlistentry>
  97
  98         <varlistentry>
  99         <term>--ipaddress=IPADDRESS</term>
 100         <listitem><para>
 101         IP address of the server
 102         </para></listitem>
 103         </varlistentry>
 104
 105         &popt.common.samba.client;
 106
 107         </variablelist>
 108 </refsect1>
 109
 110 <refsect1>
 111 <title>COMMANDS</title>
 112
 113 <refsect3>
 114         <title>computer create <replaceable>computername</replaceable> [options]</title>
 115         <para>Create a new computer in the Active Directory Domain.</para>
 116         <para>The new computer name specified on the command is the
 117         sAMAccountName, with or without the trailing dollar sign.</para>
 118
 119         <variablelist>
 120         <varlistentry>
 121         <term>--computerou=COMPUTEROU</term>
 122         <listitem><para>
 123         DN of alternative location (with or without domainDN counterpart) to
 124         default CN=Computers in which new computer object will be created.
 125         E.g. 'OU=OUname'.
 126         </para></listitem>
 127         </varlistentry>
 128
 129         <varlistentry>
 130         <term>--description=DESCRIPTION</term>
 131         <listitem><para>
 132         The new computers's description.
 133         </para></listitem>
 134         </varlistentry>
 135
 136         <varlistentry>
 137         <term>--ip-address=IP_ADDRESS_LIST</term>
 138         <listitem><para>
 139         IPv4 address for the computer's A record, or IPv6 address for AAAA record,
 140         can be provided multiple times.
 141         </para></listitem>
 142         </varlistentry>
 143
 144         <varlistentry>
 145         <term>--service-principal-name=SERVICE_PRINCIPAL_NAME_LIST</term>
 146         <listitem><para>
 147         Computer's Service Principal Name, can be provided multiple times.
 148         </para></listitem>
 149         </varlistentry>
 150
 151         <varlistentry>
 152         <term>--prepare-oldjoin</term>
 153         <listitem><para>
 154         Prepare enabled machine account for oldjoin mechanism.
 155         </para></listitem>
 156         </varlistentry>
 157         </variablelist>
 158 </refsect3>
 159
 160 <refsect3>
 161         <title>computer delete <replaceable>computername</replaceable> [options]</title>
 162         <para>Delete an existing computer account.</para>
 163         <para>The computer name specified on the command is the
 164         sAMAccountName, with or without the trailing dollar sign.</para>
 165 </refsect3>
 166
 167 <refsect3>
 168         <title>computer list</title>
 169         <para>List all computers.</para>
 170 </refsect3>
 171
 172 <refsect3>
 173         <title>computer move <replaceable>computername</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 174         <para>This command moves a computer account into the specified
 175         organizational unit or container.</para>
 176         <para>The computername specified on the command is the
 177         sAMAccountName, with or without the trailing dollar sign.</para>
 178         <para>The name of the organizational unit or container can be
 179         specified as a full DN or without the domainDN component.</para>
 180 </refsect3>
 181
 182 <refsect3>
 183         <title>computer show <replaceable>computername</replaceable> [options]</title>
 184         <para>Display a computer AD object.</para>
 185         <para>The computer name specified on the command is the
 186         sAMAccountName, with or without the trailing dollar sign.</para>
 187
 188         <variablelist>
 189         <varlistentry>
 190         <term>--attributes=USER_ATTRS</term>
 191         <listitem><para>
 192         Comma separated list of attributes, which will be printed.
 193         </para></listitem>
 194         </varlistentry>
 195         </variablelist>
 196 </refsect3>
 197
 198 <refsect2>
 199         <title>dbcheck</title>
 200         <para>Check the local AD database for errors.</para>
 201 </refsect2>
 202
 203 <refsect2>
 204         <title>delegation</title>
 205         <para>Manage Delegations.</para>
 206 </refsect2>
 207
 208 <refsect3>
 209         <title>delegation add-service <replaceable>accountname</replaceable> <replaceable>principal</replaceable> [options]</title>
 210         <para>Add a service principal as msDS-AllowedToDelegateTo.</para>
 211 </refsect3>
 212
 213 <refsect3>
 214         <title>delegation del-service <replaceable>accountname</replaceable> <replaceable>principal</replaceable> [options]</title>
 215         <para>Delete a service principal as msDS-AllowedToDelegateTo.</para>
 216 </refsect3>
 217
 218 <refsect3>
 219         <title>delegation for-any-protocol <replaceable>accountname</replaceable> [(on|off)] [options]</title>
 220         <para>Set/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy)
 221         for an account.</para>
 222 </refsect3>
 223
 224 <refsect3>
 225         <title>delegation for-any-service <replaceable>accountname</replaceable> [(on|off)] [options]</title>
 226         <para>Set/unset UF_TRUSTED_FOR_DELEGATION for an account.</para>
 227 </refsect3>
 228
 229 <refsect3>
 230         <title>delegation show <replaceable>accountname</replaceable> [options] </title>
 231         <para>Show the delegation setting of an account.</para>
 232 </refsect3>
 233
 234 <refsect2>
 235         <title>dns</title>
 236         <para>Manage Domain Name Service (DNS).</para>
 237 </refsect2>
 238
 239 <refsect3>
 240         <title>dns add <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>data</replaceable></title>
 241         <para>Add a DNS record.</para>
 242 </refsect3>
 243
 244 <refsect3>
 245         <title>dns delete <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>data</replaceable></title>
 246         <para>Delete a DNS record.</para>
 247 </refsect3>
 248
 249 <refsect3>
 250         <title>dns query <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT|ALL</replaceable> [options] <replaceable>data</replaceable></title>
 251         <para>Query a name.</para>
 252 </refsect3>
 253
 254 <refsect3>
 255         <title>dns roothints <replaceable>server</replaceable> [<replaceable>name</replaceable>] [options]</title>
 256         <para>Query root hints.</para>
 257 </refsect3>
 258
 259 <refsect3>
 260         <title>dns serverinfo <replaceable>server</replaceable> [options]</title>
 261         <para>Query server information.</para>
 262 </refsect3>
 263
 264 <refsect3>
 265         <title>dns update <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>olddata</replaceable> <replaceable>newdata</replaceable></title>
 266         <para>Update a DNS record.</para>
 267 </refsect3>
 268
 269 <refsect3>
 270         <title>dns zonecreate <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 271         <para>Create a zone.</para>
 272 </refsect3>
 273
 274 <refsect3>
 275         <title>dns zonedelete <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 276         <para>Delete a zone.</para>
 277 </refsect3>
 278
 279 <refsect3>
 280         <title>dns zoneinfo <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 281         <para>Query zone information.</para>
 282 </refsect3>
 283
 284 <refsect3>
 285         <title>dns zonelist <replaceable>server</replaceable> [options]</title>
 286         <para>List zones.</para>
 287 </refsect3>
 288
 289 <refsect2>
 290         <title>domain</title>
 291         <para>Manage Domain.</para>
 292 </refsect2>
 293
 294 <refsect3>
 295         <title>domain classicupgrade [options] <replaceable>classic_smb_conf</replaceable></title>
 296         <para>Upgrade from Samba classic (NT4-like) database to Samba AD DC
 297         database.</para>
 298 </refsect3>
 299
 300 <refsect3>
 301         <title>domain dcpromo <replaceable>dnsdomain</replaceable> [DC|RODC] [options]</title>
 302         <para>Promote an existing domain member or NT4 PDC to an AD DC.</para>
 303 </refsect3>
 304
 305 <refsect3>
 306         <title>domain demote</title>
 307         <para>Demote ourselves from the role of domain controller.</para>
 308 </refsect3>
 309
 310 <refsect3>
 311         <title>domain exportkeytab <replaceable>keytab</replaceable> [options]</title>
 312         <para>Dumps Kerberos keys of the domain into a keytab.</para>
 313 </refsect3>
 314
 315 <refsect3>
 316         <title>domain info <replaceable>ip_address</replaceable> [options]</title>
 317         <para>Print basic info about a domain and the specified DC.
 318 </para>
 319 </refsect3>
 320
 321 <refsect3>
 322         <title>domain join <replaceable>dnsdomain</replaceable> [DC|RODC|MEMBER|SUBDOMAIN] [options]</title>
 323         <para>Join a domain as either member or backup domain controller.</para>
 324 </refsect3>
 325
 326 <refsect3>
 327         <title>domain level <replaceable>show|raise</replaceable> <replaceable>options</replaceable> [options]</title>
 328         <para>Show/raise domain and forest function levels.</para>
 329 </refsect3>
 330
 331 <refsect3>
 332         <title>domain passwordsettings <replaceable>show|set</replaceable> <replaceable>options</replaceable> [options]</title>
 333         <para>Show/set password settings.</para>
 334 </refsect3>
 335
 336 <refsect3>
 337         <title>domain passwordsettings pso</title>
 338         <para>Manage fine-grained Password Settings Objects (PSOs).</para>
 339 </refsect3>
 340
 341 <refsect3>
 342         <title>domain passwordsettings pso apply <replaceable>pso-name</replaceable> <replaceable>user-or-group-name</replaceable> [options]</title>
 343         <para>Applies a PSO's password policy to a user or group.</para>
 344 </refsect3>
 345
 346 <refsect3>
 347         <title>domain passwordsettings pso create <replaceable>pso-name</replaceable> <replaceable>precedence</replaceable> [options]</title>
 348         <para>Creates a new Password Settings Object (PSO).</para>
 349 </refsect3>
 350
 351 <refsect3>
 352         <title>domain passwordsettings pso delete <replaceable>pso-name</replaceable> [options]</title>
 353         <para>Deletes a Password Settings Object (PSO).</para>
 354 </refsect3>
 355
 356 <refsect3>
 357         <title>domain passwordsettings pso list [options]</title>
 358         <para>Lists all Password Settings Objects (PSOs).</para>
 359 </refsect3>
 360
 361 <refsect3>
 362         <title>domain passwordsettings pso set <replaceable>pso-name</replaceable> [options]</title>
 363         <para>Modifies a Password Settings Object (PSO).</para>
 364 </refsect3>
 365
 366 <refsect3>
 367         <title>domain passwordsettings pso show <replaceable>user-name</replaceable> [options]</title>
 368         <para>Displays a Password Settings Object (PSO).</para>
 369 </refsect3>
 370
 371 <refsect3>
 372         <title>domain passwordsettings pso show-user <replaceable>pso-name</replaceable> [options]</title>
 373         <para>Displays the Password Settings that apply to a user.</para>
 374 </refsect3>
 375
 376 <refsect3>
 377         <title>domain passwordsettings pso unapply <replaceable>pso-name</replaceable> <replaceable>user-or-group-name</replaceable> [options]</title>
 378         <para>Updates a PSO to no longer apply to a user or group.</para>
 379 </refsect3>
 380
 381 <refsect3>
 382         <title>domain provision</title>
 383         <para>Promote an existing domain member or NT4 PDC to an AD DC.</para>
 384 </refsect3>
 385
 386 <refsect3>
 387         <title>domain trust</title>
 388         <para>Domain and forest trust management.</para>
 389 </refsect3>
 390
 391 <refsect3>
 392         <title>domain trust create <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 393         <para>Create a domain or forest trust.</para>
 394 </refsect3>
 395
 396 <refsect3>
 397         <title>domain trust delete <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 398         <para>Delete a domain trust.</para>
 399 </refsect3>
 400
 401 <refsect3>
 402         <title>domain trust list <replaceable>options</replaceable> [options]</title>
 403         <para>List domain trusts.</para>
 404 </refsect3>
 405
 406 <refsect3>
 407         <title>domain trust namespaces [<replaceable>DOMAIN</replaceable>] <replaceable>options</replaceable> [options]</title>
 408         <para>Manage forest trust namespaces.</para>
 409 </refsect3>
 410
 411 <refsect3>
 412         <title>domain trust show <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 413         <para>Show trusted domain details.</para>
 414 </refsect3>
 415
 416 <refsect3>
 417         <title>domain trust validate <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 418         <para>Validate a domain trust.</para>
 419 </refsect3>
 420
 421 <refsect2>
 422         <title>drs</title>
 423         <para>Manage Directory Replication Services (DRS).</para>
 424 </refsect2>
 425
 426 <refsect3>
 427         <title>drs bind</title>
 428         <para>Show DRS capabilities of a server.</para>
 429 </refsect3>
 430
 431 <refsect3>
 432         <title>drs kcc</title>
 433         <para>Trigger knowledge consistency center run.</para>
 434 </refsect3>
 435
 436 <refsect3>
 437         <title>drs options</title>
 438         <para>Query or change <replaceable>options</replaceable> for NTDS Settings
 439         object of a domain controller.</para>
 440 </refsect3>
 441
 442 <refsect3>
 443         <title>drs replicate <replaceable>destination_DC</replaceable> <replaceable>source_DC</replaceable> <replaceable>NC</replaceable> [options]</title>
 444         <para>Replicate a naming context between two DCs.</para>
 445 </refsect3>
 446
 447 <refsect3>
 448         <title>drs showrepl</title>
 449         <para>Show replication status.</para>
 450 </refsect3>
 451
 452 <refsect2>
 453         <title>dsacl</title>
 454         <para>Administer DS ACLs</para>
 455 </refsect2>
 456
 457 <refsect3>
 458         <title>dsacl set</title>
 459         <para>Modify access list on a directory object.</para>
 460 </refsect3>
 461
 462 <refsect2>
 463         <title>forest</title>
 464         <para>Manage Forest configuration.</para>
 465 </refsect2>
 466
 467 <refsect3>
 468         <title>forest directory_service</title>
 469         <para>Manage directory_service behaviour for the forest.</para>
 470 </refsect3>
 471
 472 <refsect3>
 473         <title>forest directory_service dsheuristics <replaceable>VALUE</replaceable></title>
 474         <para>Modify dsheuristics directory_service configuration for the forest.</para>
 475 </refsect3>
 476
 477 <refsect3>
 478         <title>forest directory_service show</title>
 479         <para>Show current directory_service configuration for the forest.</para>
 480 </refsect3>
 481
 482 <refsect2>
 483         <title>fsmo</title>
 484         <para>Manage Flexible Single Master Operations (FSMO).</para>
 485 </refsect2>
 486
 487 <refsect3>
 488         <title>fsmo seize [options]</title>
 489         <para>Seize the role.</para>
 490 </refsect3>
 491
 492 <refsect3>
 493         <title>fsmo show</title>
 494         <para>Show the roles.</para>
 495 </refsect3>
 496
 497 <refsect3>
 498         <title>fsmo transfer [options]</title>
 499         <para>Transfer the role.</para>
 500 </refsect3>
 501
 502 <refsect2>
 503         <title>gpo</title>
 504         <para>Manage Group Policy Objects (GPO).</para>
 505 </refsect2>
 506
 507 <refsect3>
 508         <title>gpo create <replaceable>displayname</replaceable> [options]</title>
 509         <para>Create an empty GPO.</para>
 510 </refsect3>
 511
 512 <refsect3>
 513         <title>gpo del <replaceable>gpo</replaceable> [options]</title>
 514         <para>Delete GPO.</para>
 515 </refsect3>
 516
 517 <refsect3>
 518         <title>gpo dellink <replaceable>container_dn</replaceable> <replaceable>gpo</replaceable> [options]</title>
 519         <para>Delete GPO link from a container.</para>
 520 </refsect3>
 521
 522 <refsect3>
 523         <title>gpo fetch <replaceable>gpo</replaceable> [options]</title>
 524         <para>Download a GPO.</para>
 525 </refsect3>
 526
 527 <refsect3>
 528         <title>gpo getinheritance <replaceable>container_dn</replaceable> [options]</title>
 529         <para>Get inheritance flag for a container.</para>
 530 </refsect3>
 531
 532 <refsect3>
 533         <title>gpo getlink <replaceable>container_dn</replaceable> [options]</title>
 534         <para>List GPO Links for a container.</para>
 535 </refsect3>
 536
 537 <refsect3>
 538         <title>gpo list <replaceable>username</replaceable> [options]</title>
 539         <para>List GPOs for an account.</para>
 540 </refsect3>
 541
 542 <refsect3>
 543         <title>gpo listall</title>
 544         <para>List all GPOs.</para>
 545 </refsect3>
 546
 547 <refsect3>
 548         <title>gpo listcontainers <replaceable>gpo</replaceable> [options]</title>
 549         <para>List all linked containers for a GPO.</para>
 550 </refsect3>
 551
 552 <refsect3>
 553         <title>gpo setinheritance <replaceable>container_dn</replaceable> <replaceable>block|inherit</replaceable> [options]</title>
 554         <para>Set inheritance flag on a container.</para>
 555 </refsect3>
 556
 557 <refsect3>
 558         <title>gpo setlink <replaceable>container_dn</replaceable> <replaceable>gpo</replaceable> [options]</title>
 559         <para>Add or Update a GPO link to a container.</para>
 560 </refsect3>
 561
 562 <refsect3>
 563         <title>gpo show <replaceable>gpo</replaceable> [options]</title>
 564         <para>Show information for a GPO.</para>
 565 </refsect3>
 566
 567 <refsect2>
 568         <title>group</title>
 569         <para>Manage groups.</para>
 570 </refsect2>
 571
 572 <refsect3>
 573         <title>group add <replaceable>groupname</replaceable> [options]</title>
 574         <para>Create a new AD group.</para>
 575 </refsect3>
 576
 577 <refsect3>
 578         <title>group addmembers <replaceable>groupname</replaceable> <replaceable>members</replaceable> [options]</title>
 579         <para>Add members to an AD group.</para>
 580 </refsect3>
 581
 582 <refsect3>
 583         <title>group delete <replaceable>groupname</replaceable> [options]</title>
 584         <para>Delete an AD group.</para>
 585 </refsect3>
 586
 587 <refsect3>
 588         <title>group list</title>
 589         <para>List all groups.</para>
 590 </refsect3>
 591
 592 <refsect3>
 593         <title>group listmembers <replaceable>groupname</replaceable> [options]</title>
 594         <para>List all members of the specified AD group.</para>
 595 </refsect3>
 596
 597 <refsect3>
 598         <title>group move <replaceable>groupname</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 599         <para>This command moves a group into the specified organizational unit
 600         or container.</para>
 601         <para>The groupname specified on the command is the sAMAccountName.
 602         </para>
 603         <para>The name of the organizational unit or container can be
 604         specified as a full DN or without the domainDN component.</para>
 605         <para></para>
 606 </refsect3>
 607
 608 <refsect3>
 609         <title>group removemembers <replaceable>groupname</replaceable> <replaceable>members</replaceable> [options]</title>
 610         <para>Remove members from the specified AD group.</para>
 611 </refsect3>
 612
 613 <refsect3>
 614         <title>group show <replaceable>groupname</replaceable> [options]</title>
 615         <para>Show group object and it's attributes.</para>
 616 </refsect3>
 617
 618 <refsect2>
 619         <title>ldapcmp <replaceable>URL1</replaceable> <replaceable>URL2</replaceable> <replaceable>domain|configuration|schema|dnsdomain|dnsforest</replaceable> [options] </title>
 620         <para>Compare two LDAP databases.</para>
 621 </refsect2>
 622
 623 <refsect2>
 624         <title>ntacl</title>
 625         <para>Manage NT ACLs.</para>
 626 </refsect2>
 627
 628 <refsect3>
 629         <title>ntacl get <replaceable>file</replaceable> [options]</title>
 630         <para>Get ACLs on a file.</para>
 631 </refsect3>
 632
 633 <refsect3>
 634         <title>ntacl set <replaceable>acl</replaceable> <replaceable>file</replaceable> [options]</title>
 635         <para>Set ACLs on a file.</para>
 636 </refsect3>
 637
 638 <refsect3>
 639         <title>ntacl sysvolcheck</title>
 640         <para>Check sysvol ACLs match defaults (including correct ACLs on GPOs).</para>
 641 </refsect3>
 642
 643 <refsect3>
 644         <title>ntacl sysvolreset</title>
 645         <para>Reset sysvol ACLs to defaults (including correct ACLs on GPOs).</para>
 646 </refsect3>
 647
 648 <refsect3>
 649         <title>ou create <replaceable>ou_dn</replaceable> [options]</title>
 650         <para>Create an organizational unit.</para>
 651         <para>The name of the organizational unit can be specified as a full DN
 652         or without the domainDN component.</para>
 653
 654         <variablelist>
 655         <varlistentry>
 656         <term>--description=DESCRIPTION</term>
 657         <listitem><para>
 658         Specify OU's description.
 659         </para></listitem>
 660         </varlistentry>
 661         </variablelist>
 662 </refsect3>
 663
 664 <refsect3>
 665         <title>ou delete <replaceable>ou_dn</replaceable> [options]</title>
 666         <para>Delete an organizational unit.</para>
 667         <para>The name of the organizational unit can be specified as a full DN
 668         or without the domainDN component.</para>
 669
 670         <variablelist>
 671         <varlistentry>
 672         <term>--force-subtree-delete</term>
 673         <listitem><para>
 674         Delete organizational unit and all children reclusively.
 675         </para></listitem>
 676         </varlistentry>
 677         </variablelist>
 678 </refsect3>
 679
 680 <refsect3>
 681         <title>ou list [options]</title>
 682         <para>List all organizational units.</para>
 683         <variablelist>
 684         <varlistentry>
 685         <term>--full-dn</term>
 686         <listitem><para>
 687         Display DNs including the base DN.
 688         </para></listitem>
 689         </varlistentry>
 690         </variablelist>
 691 </refsect3>
 692
 693 <refsect3>
 694         <title>ou listobjects <replaceable>ou_dn</replaceable> [options]</title>
 695         <para>List all objects in an organizational unit.</para>
 696         <para>The name of the organizational unit can be specified as a full DN
 697         or without the domainDN component.</para>
 698
 699         <variablelist>
 700         <varlistentry>
 701         <term>--full-dn</term>
 702         <listitem><para>
 703         Display DNs including the base DN.
 704         </para></listitem>
 705         </varlistentry>
 706
 707         <varlistentry>
 708         <term>-r|--recursive</term>
 709         <listitem><para>
 710         List objects recursively.
 711         </para></listitem>
 712         </varlistentry>
 713         </variablelist>
 714 </refsect3>
 715
 716 <refsect3>
 717         <title>ou move <replaceable>old_ou_dn</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 718         <para>Move an organizational unit.</para>
 719         <para>The name of the organizational units can be specified as a full DN
 720         or without the domainDN component.</para>
 721 </refsect3>
 722
 723 <refsect3>
 724         <title>ou rename <replaceable>old_ou_dn</replaceable> <replaceable>new_ou_dn</replaceable> [options]</title>
 725         <para>Rename an organizational unit.</para>
 726         <para>The name of the organizational units can be specified as a full DN
 727         or without the domainDN component.</para>
 728 </refsect3>
 729
 730 <refsect2>
 731         <title>rodc</title>
 732         <para>Manage Read-Only Domain Controller (RODC).</para>
 733 </refsect2>
 734
 735 <refsect3>
 736         <title>rodc preload <replaceable>SID</replaceable>|<replaceable>DN</replaceable>|<replaceable>accountname</replaceable> [options]</title>
 737         <para>Preload one account for an RODC.</para>
 738 </refsect3>
 739
 740 <refsect2>
 741         <title>sites</title>
 742         <para>Manage sites.</para>
 743 </refsect2>
 744
 745 <refsect3>
 746         <title>sites create <replaceable>site</replaceable> [options]</title>
 747         <para>Create a new site.</para>
 748 </refsect3>
 749
 750 <refsect3>
 751         <title>sites remove <replaceable>site</replaceable> [options]</title>
 752         <para>Delete an existing site.</para>
 753 </refsect3>
 754
 755 <refsect2>
 756         <title>spn</title>
 757         <para>Manage Service Principal Names (SPN).</para>
 758 </refsect2>
 759
 760 <refsect3>
 761         <title>spn add <replaceable>name</replaceable> <replaceable>user</replaceable> [options]</title>
 762         <para>Create a new SPN.</para>
 763 </refsect3>
 764
 765 <refsect3>
 766         <title>spn delete <replaceable>name</replaceable> [<replaceable>user</replaceable>] [options]</title>
 767         <para>Delete an existing SPN.</para>
 768 </refsect3>
 769
 770 <refsect3>
 771         <title>spn list <replaceable>user</replaceable> [options]</title>
 772         <para>List SPNs of a given user.</para>
 773 </refsect3>
 774
 775 <refsect2>
 776         <title>testparm</title>
 777         <para>Check the syntax of the configuration file.</para>
 778 </refsect2>
 779
 780 <refsect2>
 781         <title>time</title>
 782         <para>Retrieve the time on a server.</para>
 783 </refsect2>
 784
 785 <refsect2>
 786         <title>user</title>
 787         <para>Manage users.</para>
 788 </refsect2>
 789
 790 <refsect3>
 791         <title>user add <replaceable>username</replaceable> [<replaceable>password</replaceable>]</title>
 792         <para>Create a new user. Please note that this subcommand is deprecated
 793         and available for compatibility reasons only. Please use
 794         <command>samba-tool user create</command> instead.</para>
 795 </refsect3>
 796
 797 <refsect3>
 798         <title>user create <replaceable>username</replaceable> [<replaceable>password</replaceable>]</title>
 799         <para>Create a new user in the Active Directory Domain.</para>
 800 </refsect3>
 801
 802 <refsect3>
 803         <title>user delete <replaceable>username</replaceable> [options]</title>
 804         <para>Delete an existing user account.</para>
 805 </refsect3>
 806
 807 <refsect3>
 808         <title>user disable <replaceable>username</replaceable></title>
 809         <para>Disable an user account.</para>
 810 </refsect3>
 811
 812 <refsect3>
 813         <title>user enable <replaceable>username</replaceable></title>
 814         <para>Enable an user account.</para>
 815 </refsect3>
 816
 817 <refsect3>
 818         <title>user list</title>
 819         <para>List all users.</para>
 820 </refsect3>
 821
 822 <refsect3>
 823         <title>user show <replaceable>username</replaceable> [options]</title>
 824         <para>Display a user AD object.</para>
 825
 826         <variablelist>
 827         <varlistentry>
 828         <term>--attributes=USER_ATTRS</term>
 829         <listitem><para>
 830         Comma separated list of attributes, which will be printed.
 831         </para></listitem>
 832         </varlistentry>
 833         </variablelist>
 834 </refsect3>
 835
 836 <refsect3>
 837         <title>user move <replaceable>username</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 838         <para>This command moves a user account into the specified
 839         organizational unit or container.</para>
 840         <para>The username specified on the command is the
 841         sAMAccountName.</para>
 842         <para>The name of the organizational unit or container can be
 843         specified as a full DN or without the domainDN component.</para>
 844 </refsect3>
 845
 846 <refsect3>
 847         <title>user password [options]</title>
 848         <para>Change password for an user account (the one provided in
 849         authentication).</para>
 850 </refsect3>
 851
 852 <refsect3>
 853         <title>user setexpiry <replaceable>username</replaceable> [options]</title>
 854         <para>Set the expiration of an user account.</para>
 855 </refsect3>
 856
 857 <refsect3>
 858         <title>user setpassword <replaceable>username</replaceable> [options]</title>
 859         <para>Sets or resets the password of an user account.</para>
 860 </refsect3>
 861
 862 <refsect3>
 863         <title>user getpassword <replaceable>username</replaceable> [options]</title>
 864         <para>Gets the password of an user account.</para>
 865 </refsect3>
 866
 867 <refsect3>
 868         <title>user syncpasswords <replaceable>--cache-ldb-initialize</replaceable> [options]</title>
 869         <para>Syncs the passwords of all user accounts, using an optional script.</para>
 870         <para>Note that this command should run on a single domain controller only
 871         (typically the PDC-emulator).</para>
 872 </refsect3>
 873
 874 <refsect2>
 875         <title>vampire [options] <replaceable>domain</replaceable></title>
 876         <para>Join and synchronise a remote AD domain to the local server.
 877         Please note that <command>samba-tool vampire</command> is deprecated,
 878         please use <command>samba-tool domain join</command> instead.</para>
 879 </refsect2>
 880
 881 <refsect2>
 882         <title>visualize [options] <replaceable>subcommand</replaceable></title>
 883         <para>Produce graphical representations of Samba network state.
 884         To work out what is happening in a replication graph, it is sometimes
 885         helpful to use visualisations.</para>
 886
 887         <para>
 888         There are two subcommands, two graphical modes, and (roughly) two modes
 889         of operation with respect to the location of authority.</para>
 890
 891         <refsect3><title>MODES OF OPERATION</title>
 892         <varlistentry>
 893                 <term>samba-tool visualize ntdsconn</term>
 894                 <listitem><para>Looks at NTDS connections.
 895                 </para></listitem>
 896                 </varlistentry>
 897
 898         <varlistentry>
 899                 <term>samba-tool visualize reps</term>
 900                 <listitem><para>Looks at repsTo and repsFrom objects.
 901                 </para></listitem>
 902                 </varlistentry>
 903         </refsect3>
 904
 905         <refsect3><title>GRAPHICAL MODES</title>
 906         <varlistentry>
 907                 <term>--distance</term>
 908                 <listitem><para>Distances between DCs are shown in a matrix in
 909                  the terminal.
 910                 </para></listitem>
 911                 </varlistentry>
 912
 913         <varlistentry>
 914                 <term>--dot</term>
 915                 <listitem><para>Generate Graphviz dot output. When viewed using
 916                 dot or xdot, this shows the network as a graph with DCs as
 917                 vertices and connections edges. Certain types of degenerate
 918                 edges are shown in different colours or line-styles.
 919                 </para></listitem>
 920                 </varlistentry>
 921         </refsect3>
 922
 923         <varlistentry>
 924                 <term>-r</term>
 925                 <listitem><para>Normally, <command>samba-tool</command> talks
 926                 to one database; with the <arg choice="opt">-r</arg> option
 927                 attempts are made to contact all the DCs known to the first
 928                 database. This is necessary to get sensible results from
 929                 <command>samba-tool visualize reps</command> because the
 930                 repsFrom/To objects are not replicated, and it can reveal
 931                 replication issues in other modes.
 932                 </para></listitem>
 933                 </varlistentry>
 934 </refsect2>
 935
 936 <refsect2>
 937 <title>help</title>
 938 <para>Gives usage information.</para>
 939 </refsect2>
 940
 941 </refsect1>
 942
 943 <refsect1>
 944         <title>VERSION</title>
 945
 946         <para>This man page is complete for version &doc.version; of the Samba
 947         suite.</para>
 948 </refsect1>
 949
 950 <refsect1>
 951         <title>AUTHOR</title>
 952
 953         <para>The original Samba software and related utilities
 954         were created by Andrew Tridgell. Samba is now developed
 955         by the Samba Team as an Open Source project similar
 956         to the way the Linux kernel is developed.</para>
 957 </refsect1>
 958
 959 </refentry>