source4/setup/domainlevel

   1 #!/usr/bin/python
   2 #
   3 # Raises domain and forest function levels
   4 #
   5 # Copyright Matthias Dieter Wallnoefer 2009
   6 #
   7 # This program is free software; you can redistribute it and/or modify
   8 # it under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 3 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # This program is distributed in the hope that it will be useful,
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 #
  20
  21 import sys
  22
  23 # Find right directory when running from source tree
  24 sys.path.insert(0, "bin/python")
  25
  26 import samba.getopt as options
  27 import optparse
  28 import ldb
  29
  30 from samba.auth import system_session
  31 from samba.samdb import SamDB
  32 from samba import DS_DOMAIN_FUNCTION_2000, DS_DOMAIN_FUNCTION_2003
  33 from samba import DS_DOMAIN_FUNCTION_2003_MIXED, DS_DOMAIN_FUNCTION_2008
  34 from samba import DS_DOMAIN_FUNCTION_2008_R2
  35
  36 parser = optparse.OptionParser("domainlevel (show | raise <options>)")
  37 sambaopts = options.SambaOptions(parser)
  38 parser.add_option_group(sambaopts)
  39 parser.add_option_group(options.VersionOptions(parser))
  40 credopts = options.CredentialsOptions(parser)
  41 parser.add_option_group(credopts)
  42 parser.add_option("--quiet", help="Be quiet", action="store_true")
  43 parser.add_option("--forest",
  44   help="The forest function level (2000 | 2003 | 2008 | 2008_R2). We don't support the 2003 with mixed domains (NT4 DC support) level.", type=str)
  45 parser.add_option("--domain",
  46   help="The domain function level (2000 | 2003 | 2008 | 2008_R2). We don't support mixed/interim (NT4 DC support) levels.", type=str)
  47 opts, args = parser.parse_args()
  48
  49 #
  50 #  print a message if quiet is not set
  51 #
  52 def message(text):
  53         if not opts.quiet:
  54                 print text
  55
  56 if len(args) == 0:
  57         parser.print_usage()
  58         sys.exit(1)
  59
  60 lp = sambaopts.get_loadparm()
  61 creds = credopts.get_credentials(lp)
  62
  63 samdb = SamDB(url=lp.get("sam database"), session_info=system_session(),
  64               credentials=creds, lp=lp)
  65
  66 domain_dn = SamDB.domain_dn(samdb)
  67
  68 res_forest = samdb.search("CN=Partitions,CN=Configuration," + domain_dn,
  69   scope=ldb.SCOPE_BASE, attrs=["msDS-Behavior-Version"])
  70 assert(len(res_forest) == 1)
  71
  72 res_domain = samdb.search(domain_dn, scope=ldb.SCOPE_BASE,
  73   attrs=["msDS-Behavior-Version", "nTMixedDomain"])
  74 assert(len(res_domain) == 1)
  75
  76 try:
  77         level_forest = int(res_forest[0]["msDS-Behavior-Version"][0])
  78         level_domain = int(res_domain[0]["msDS-Behavior-Version"][0])
  79         level_domain_mixed = int(res_domain[0]["nTMixedDomain"][0])
  80
  81         if level_forest < 0 or level_domain < 0:
  82                 print "ERROR: Domain and/or forest functional level(s) is/are invalid. Correct them or reprovision!"
  83                 sys.exit(1)
  84         if level_forest > level_domain:
  85                 print "ERROR: Forest function level is higher than the domain level(s). That can't be. Correct this or reprovision!"
  86                 sys.exit(1)
  87 except:
  88         print "ERROR: Could not retrieve the actual domain and/or forest level!"
  89         if args[0] == "show":
  90                 print "So the levels can't be displayed!"
  91         sys.exit(1)
  92
  93 if args[0] == "show":
  94         message("Domain and forest function level for domain '" + domain_dn + "'")
  95         if level_forest == DS_DOMAIN_FUNCTION_2003_MIXED:
  96                 message("\nATTENTION: You run SAMBA 4 on the 2003 with mixed domains (NT4 DC support) forest level. This isn't supported! Please raise!")
  97         if (level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0) or level_domain == DS_DOMAIN_FUNCTION_2003_MIXED:
  98                 message("\nATTENTION: You run SAMBA 4 on a mixed/interim (NT4 DC support) domain level. This isn't supported! Please raise!")
  99
 100         message("")
 101
 102         if level_forest == DS_DOMAIN_FUNCTION_2000:
 103                 outstr = "2000"
 104         elif level_forest == DS_DOMAIN_FUNCTION_2003_MIXED:
 105                 outstr = "2003 with mixed domains/interim (NT4 DC support)"
 106         elif level_forest == DS_DOMAIN_FUNCTION_2003:
 107                 outstr = "2003"
 108         elif level_forest == DS_DOMAIN_FUNCTION_2008:
 109                 outstr = "2008"
 110         elif level_forest == DS_DOMAIN_FUNCTION_2008_R2:
 111                 outstr = "2008 R2"
 112         else:
 113                 outstr = "higher than 2008 R2"
 114         message("Forest function level: (Windows) " + outstr)
 115
 116         if level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0:
 117                 outstr = "2000 mixed (NT4 DC support)"
 118         elif level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed == 0:
 119                 outstr = "2000"
 120         elif level_domain == DS_DOMAIN_FUNCTION_2003_MIXED:
 121                 outstr = "2003 with mixed domains/interim (NT4 DC support)"
 122         elif level_domain == DS_DOMAIN_FUNCTION_2003:
 123                 outstr = "2003"
 124         elif level_domain == DS_DOMAIN_FUNCTION_2008:
 125                 outstr = "2008"
 126         elif level_domain == DS_DOMAIN_FUNCTION_2008_R2:
 127                 outstr = "2008 R2"
 128         else:
 129                 outstr = "higher than 2008 R2"
 130         message("Domain function level: (Windows) " + outstr)
 131
 132 elif args[0] == "raise":
 133         msgs = []
 134
 135         if opts.domain is not None:
 136                 arg = opts.domain
 137
 138                 if arg == "2000":
 139                         new_level_domain = DS_DOMAIN_FUNCTION_2000
 140                 elif arg == "2003":
 141                         new_level_domain = DS_DOMAIN_FUNCTION_2003
 142                 elif arg == "2008":
 143                         new_level_domain = DS_DOMAIN_FUNCTION_2008
 144                 elif arg == "2008_R2":
 145                         new_level_domain = DS_DOMAIN_FUNCTION_2008_R2
 146                 else:
 147                         print "ERROR: Wrong argument '" + arg + "'!"
 148                         sys.exit(1)
 149
 150                 if new_level_domain <= level_domain and level_domain_mixed == 0:
 151                         print "ERROR: Domain function level can't be smaller equal to the actual one!"
 152                         sys.exit(1)
 153
 154                 # Deactivate mixed/interim domain support
 155                 if level_domain_mixed != 0:
 156                         m = ldb.Message()
 157                         m.dn = ldb.Dn(samdb, domain_dn)
 158                         m["nTMixedDomain"] = ldb.MessageElement("0",
 159                           ldb.FLAG_MOD_REPLACE, "nTMixedDomain")
 160                         samdb.modify(m)
 161
 162                 m = ldb.Message()
 163                 m.dn = ldb.Dn(samdb, domain_dn)
 164                 m["msDS-Behavior-Version"]= ldb.MessageElement(
 165                   str(new_level_domain), ldb.FLAG_MOD_REPLACE,
 166                   "msDS-Behavior-Version")
 167                 samdb.modify(m)
 168
 169                 level_domain = new_level_domain
 170
 171                 msgs.append("Domain function level changed!")
 172
 173         if opts.forest is not None:
 174                 arg = opts.forest
 175
 176                 if arg == "2000":
 177                         new_level_forest = DS_DOMAIN_FUNCTION_2000
 178                 elif arg == "2003":
 179                         new_level_forest = DS_DOMAIN_FUNCTION_2003
 180                 elif arg == "2008":
 181                         new_level_forest = DS_DOMAIN_FUNCTION_2008
 182                 elif arg == "2008_R2":
 183                         new_level_forest = DS_DOMAIN_FUNCTION_2008_R2
 184                 else:
 185                         print "ERROR: Wrong argument '" + arg + "'!"
 186                         sys.exit(1)
 187
 188                 if new_level_forest <= level_forest:
 189                         print "ERROR: Forest function level can't be smaller equal to the actual one!"
 190                         sys.exit(1)
 191
 192                 if new_level_forest > level_domain:
 193                         print "ERROR: Forest function level can't be higher than the domain function level(s). Please raise it/them first!"
 194                         sys.exit(1)
 195
 196                 m = ldb.Message()
 197                 m.dn = ldb.Dn(samdb, "CN=Partitions,CN=Configuration,"
 198                   + domain_dn)
 199                 m["msDS-Behavior-Version"]= ldb.MessageElement(
 200                   str(new_level_forest), ldb.FLAG_MOD_REPLACE,
 201                   "msDS-Behavior-Version")
 202                 samdb.modify(m)
 203
 204                 msgs.append("Forest function level changed!")
 205
 206         msgs.append("All changes applied successfully!")
 207
 208         message("\n".join(msgs))
 209 else:
 210         print "ERROR: Wrong argument '" + args[0] + "'!"
 211         sys.exit(1)