2 Unix SMB/CIFS implementation.
4 utility code to join/leave a domain
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 this code is used by other torture modules to join/leave a domain
25 as either a member, bdc or thru a trust relationship
29 #include "torture/torture.h"
30 #include "system/time.h"
31 #include "lib/crypto/crypto.h"
32 #include "libnet/libnet.h"
33 #include "lib/cmdline/popt_common.h"
34 #include "lib/ldb/include/ldb.h"
35 #include "librpc/gen_ndr/ndr_samr_c.h"
37 #include "libcli/auth/libcli_auth.h"
38 #include "torture/rpc/rpc.h"
39 #include "libcli/security/security.h"
42 struct dcerpc_pipe *p;
43 struct policy_handle user_handle;
44 struct libnet_JoinDomain *libnet_r;
45 struct dom_sid *dom_sid;
46 struct dom_sid *user_sid;
50 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
51 struct policy_handle *handle, const char *name)
54 struct samr_DeleteUser d;
55 struct policy_handle user_handle;
57 struct samr_LookupNames n;
58 struct lsa_String sname;
59 struct samr_OpenUser r;
63 n.in.domain_handle = handle;
67 status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
68 if (NT_STATUS_IS_OK(status)) {
69 rid = n.out.rids.ids[0];
74 r.in.domain_handle = handle;
75 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
77 r.out.user_handle = &user_handle;
79 status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
80 if (!NT_STATUS_IS_OK(status)) {
81 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
85 d.in.user_handle = &user_handle;
86 d.out.user_handle = &user_handle;
87 status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
88 if (!NT_STATUS_IS_OK(status)) {
96 create a test user in the domain
97 an opaque pointer is returned. Pass it to torture_leave_domain()
101 struct test_join *torture_create_testuser(const char *username,
104 const char **random_password)
107 struct samr_Connect c;
108 struct samr_CreateUser2 r;
109 struct samr_OpenDomain o;
110 struct samr_LookupDomain l;
111 struct samr_GetUserPwInfo pwp;
112 struct samr_SetUserInfo s;
113 union samr_UserInfo u;
114 struct policy_handle handle;
115 struct policy_handle domain_handle;
116 uint32_t access_granted;
118 DATA_BLOB session_key;
119 struct lsa_String name;
121 int policy_min_pw_len = 0;
122 struct test_join *join;
125 join = talloc(NULL, struct test_join);
132 printf("Connecting to SAMR\n");
134 status = torture_rpc_connection(join,
137 if (!NT_STATUS_IS_OK(status)) {
141 c.in.system_name = NULL;
142 c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
143 c.out.connect_handle = &handle;
145 status = dcerpc_samr_Connect(join->p, join, &c);
146 if (!NT_STATUS_IS_OK(status)) {
147 const char *errstr = nt_errstr(status);
148 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
149 errstr = dcerpc_errstr(join, join->p->last_fault_code);
151 printf("samr_Connect failed - %s\n", errstr);
155 printf("Opening domain %s\n", domain);
157 name.string = domain;
158 l.in.connect_handle = &handle;
159 l.in.domain_name = &name;
161 status = dcerpc_samr_LookupDomain(join->p, join, &l);
162 if (!NT_STATUS_IS_OK(status)) {
163 printf("LookupDomain failed - %s\n", nt_errstr(status));
167 talloc_steal(join, l.out.sid);
168 join->dom_sid = l.out.sid;
170 o.in.connect_handle = &handle;
171 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
172 o.in.sid = l.out.sid;
173 o.out.domain_handle = &domain_handle;
175 status = dcerpc_samr_OpenDomain(join->p, join, &o);
176 if (!NT_STATUS_IS_OK(status)) {
177 printf("OpenDomain failed - %s\n", nt_errstr(status));
181 printf("Creating account %s\n", username);
184 name.string = username;
185 r.in.domain_handle = &domain_handle;
186 r.in.account_name = &name;
187 r.in.acct_flags = acct_type;
188 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
189 r.out.user_handle = &join->user_handle;
190 r.out.access_granted = &access_granted;
193 status = dcerpc_samr_CreateUser2(join->p, join, &r);
195 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
196 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
197 if (NT_STATUS_IS_OK(status)) {
202 if (!NT_STATUS_IS_OK(status)) {
203 printf("CreateUser2 failed - %s\n", nt_errstr(status));
207 join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
209 pwp.in.user_handle = &join->user_handle;
211 status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
212 if (NT_STATUS_IS_OK(status)) {
213 policy_min_pw_len = pwp.out.info.min_password_length;
216 random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
218 printf("Setting account password '%s'\n", random_pw);
220 s.in.user_handle = &join->user_handle;
224 encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
225 u.info24.pw_len = strlen(random_pw);
227 status = dcerpc_fetch_session_key(join->p, &session_key);
228 if (!NT_STATUS_IS_OK(status)) {
229 printf("SetUserInfo level %u - no session key - %s\n",
230 s.in.level, nt_errstr(status));
231 torture_leave_domain(join);
235 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
237 status = dcerpc_samr_SetUserInfo(join->p, join, &s);
238 if (!NT_STATUS_IS_OK(status)) {
239 printf("SetUserInfo failed - %s\n", nt_errstr(status));
244 s.in.user_handle = &join->user_handle;
248 u.info21.acct_flags = acct_type;
249 u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
251 u.info21.comment.string = talloc_asprintf(join,
252 "Tortured by Samba4: %s",
253 timestring(join, time(NULL)));
255 u.info21.full_name.string = talloc_asprintf(join,
256 "Torture account for Samba4: %s",
257 timestring(join, time(NULL)));
259 u.info21.description.string = talloc_asprintf(join,
260 "Samba4 torture account created by host %s: %s",
261 lp_netbios_name(), timestring(join, time(NULL)));
263 printf("Resetting ACB flags, force pw change time\n");
265 status = dcerpc_samr_SetUserInfo(join->p, join, &s);
266 if (!NT_STATUS_IS_OK(status)) {
267 printf("SetUserInfo failed - %s\n", nt_errstr(status));
271 if (random_password) {
272 *random_password = random_pw;
278 torture_leave_domain(join);
283 _PUBLIC_ struct test_join *torture_join_domain(const char *machine_name,
285 struct cli_credentials **machine_credentials)
288 struct libnet_context *libnet_ctx;
289 struct libnet_JoinDomain *libnet_r;
290 struct test_join *tj;
291 struct samr_SetUserInfo s;
292 union samr_UserInfo u;
294 tj = talloc(NULL, struct test_join);
295 if (!tj) return NULL;
297 libnet_r = talloc(tj, struct libnet_JoinDomain);
303 libnet_ctx = libnet_context_init(NULL);
309 tj->libnet_r = libnet_r;
311 libnet_ctx->cred = cmdline_credentials;
312 libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
313 if (!libnet_r->in.binding) {
314 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(-1, "torture", "host"));
316 libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
317 libnet_r->in.netbios_name = machine_name;
318 libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
319 if (!libnet_r->in.account_name) {
324 libnet_r->in.acct_type = acct_flags;
325 libnet_r->in.recreate_account = True;
327 status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
328 if (!NT_STATUS_IS_OK(status)) {
329 if (libnet_r->out.error_string) {
330 DEBUG(0, ("Domain join failed - %s\n", libnet_r->out.error_string));
332 DEBUG(0, ("Domain join failed - %s\n", nt_errstr(status)));
337 tj->p = libnet_r->out.samr_pipe;
338 tj->user_handle = *libnet_r->out.user_handle;
339 tj->dom_sid = libnet_r->out.domain_sid;
340 talloc_steal(tj, libnet_r->out.domain_sid);
343 s.in.user_handle = &tj->user_handle;
347 u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
348 u.info21.comment.string = talloc_asprintf(tj,
349 "Tortured by Samba4: %s",
350 timestring(tj, time(NULL)));
351 u.info21.full_name.string = talloc_asprintf(tj,
352 "Torture account for Samba4: %s",
353 timestring(tj, time(NULL)));
355 u.info21.description.string = talloc_asprintf(tj,
356 "Samba4 torture account created by host %s: %s",
357 lp_netbios_name(), timestring(tj, time(NULL)));
359 status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
360 if (!NT_STATUS_IS_OK(status)) {
361 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
364 *machine_credentials = cli_credentials_init(tj);
365 cli_credentials_set_conf(*machine_credentials);
366 cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
367 cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
368 if (libnet_r->out.realm) {
369 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
371 cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
372 cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
373 if (acct_flags & ACB_SVRTRUST) {
374 cli_credentials_set_secure_channel_type(*machine_credentials,
376 } else if (acct_flags & ACB_WSTRUST) {
377 cli_credentials_set_secure_channel_type(*machine_credentials,
380 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
381 talloc_free(*machine_credentials);
388 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
393 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
395 return &join->user_handle;
398 NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
403 struct ldb_dn *server_dn;
404 struct ldb_context *ldb_ctx;
406 char *remote_ldb_url;
408 /* Check if we are a domain controller. If not, exit. */
409 if (!libnet_r->out.server_dn_str) {
413 tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
415 libnet_r->out.error_string = NULL;
416 return NT_STATUS_NO_MEMORY;
419 ldb_ctx = ldb_init(tmp_ctx);
421 libnet_r->out.error_string = NULL;
422 talloc_free(tmp_ctx);
423 return NT_STATUS_NO_MEMORY;
426 /* Remove CN=Servers,... entry from the AD. */
427 server_dn = ldb_dn_new(tmp_ctx, ldb_ctx, libnet_r->out.server_dn_str);
428 if (! ldb_dn_validate(server_dn)) {
429 libnet_r->out.error_string = NULL;
430 talloc_free(tmp_ctx);
431 return NT_STATUS_NO_MEMORY;
434 remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
435 if (!remote_ldb_url) {
436 libnet_r->out.error_string = NULL;
437 talloc_free(tmp_ctx);
438 return NT_STATUS_NO_MEMORY;
441 ldb_set_opaque(ldb_ctx, "credentials", cmdline_credentials);
443 rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
445 libnet_r->out.error_string = NULL;
446 talloc_free(tmp_ctx);
447 return NT_STATUS_UNSUCCESSFUL;
450 rtn = ldb_delete(ldb_ctx, server_dn);
452 libnet_r->out.error_string = NULL;
453 talloc_free(tmp_ctx);
454 return NT_STATUS_UNSUCCESSFUL;
457 DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
459 talloc_free(tmp_ctx);
464 leave the domain, deleting the machine acct
467 _PUBLIC_ void torture_leave_domain(struct test_join *join)
469 struct samr_DeleteUser d;
475 d.in.user_handle = &join->user_handle;
476 d.out.user_handle = &join->user_handle;
478 /* Delete machine account */
479 status = dcerpc_samr_DeleteUser(join->p, join, &d);
480 if (!NT_STATUS_IS_OK(status)) {
481 printf("Delete of machine account failed\n");
483 printf("Delete of machine account was successful.\n");
486 if (join->libnet_r) {
487 status = torture_leave_ads_domain(join, join->libnet_r);
494 return the dom sid for a test join
496 _PUBLIC_ const struct dom_sid *torture_join_sid(struct test_join *join)
498 return join->dom_sid;
501 const struct dom_sid *torture_join_user_sid(struct test_join *join)
503 return join->user_sid;
507 struct test_join_ads_dc {
508 struct test_join *join;
511 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
513 struct cli_credentials **machine_credentials)
515 struct test_join_ads_dc *join;
517 join = talloc(NULL, struct test_join_ads_dc);
522 join->join = torture_join_domain(machine_name,
524 machine_credentials);
531 /* W2K: modify userAccountControl from 4096 to 532480 */
533 /* W2K: modify RDN to OU=Domain Controllers and skip the $ from server name */
535 /* ask objectVersion of Schema Partition */
537 /* ask rIDManagerReferenz of the Domain Partition */
539 /* ask fsMORoleOwner of the RID-Manager$ object
540 * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
543 /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
545 /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
547 /* ask for * of CN=Default-First-Site-Name, ... */
549 /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
550 * attributes : distinguishedName, userAccountControl
553 /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
554 * should fail with noSuchObject
557 /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
559 * objectClass = server
560 * systemFlags = 50000000
561 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
564 /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
565 * should fail with noSuchObject
568 /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
569 * attributes: ncName, dnsRoot
572 /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
573 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
574 * should fail with attributeOrValueExists
577 /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
578 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
581 /* DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
585 /* replicate CN=Schema,CN=Configuration,...
586 * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
590 /* replicate CN=Configuration,...
591 * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
595 /* replicate Domain Partition
596 * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
600 /* call DsReplicaUpdateRefs() for all partitions like this:
601 * req1: struct drsuapi_DsReplicaUpdateRefsRequest1
603 * naming_context: struct drsuapi_DsReplicaObjectIdentifier
604 * __ndr_size : 0x000000ae (174)
605 * __ndr_size_sid : 0x00000000 (0)
606 * guid : 00000000-0000-0000-0000-000000000000
608 * dn : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
609 * dest_dsa_dns_name : *
610 * dest_dsa_dns_name : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
611 * dest_dsa_guid : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
612 * options : 0x0000001c (28)
613 * 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
614 * 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
615 * 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
616 * 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
617 * 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
619 * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
620 * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
626 * - using nbt name<1C> request and a samlogon mailslot request
628 * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
631 * Open 1st LDAP connection to the DC using admin credentials
635 * LDAP search 1st LDAP connection:
638 * basedn: CN=Configuration,<domain_partition>
640 * filter: (cn=Partitions)
641 * attrs: msDS-Behavior-Version
643 * CN=Partitions,CN=Configuration,<domain_partition>
644 * msDS-Behavior-Version: 0
648 * LDAP search 1st LDAP connection:
650 * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
653 * basedn: CN=Schema,CN=Configuration,<domain_partition>
655 * filter: (cn=Partitions)
656 * attrs: msDS-Behavior-Version
663 * LDAP search 1st LDAP connection:
666 * basedn: <domain_partition>
668 * filter: (objectClass=*)
669 * attrs: msDS-Behavior-Version
672 * msDS-Behavior-Version: 0
676 * LDAP search 1st LDAP connection:
679 * basedn: CN=Schema,CN=Configuration,<domain_partition>
681 * filter: (objectClass=*)
682 * attrs: objectVersion
684 * CN=Schema,CN=Configuration,<domain_partition>
689 * LDAP search 1st LDAP connection:
694 * filter: (objectClass=*)
695 * attrs: defaultNamingContext
699 * defaultNamingContext: <domain_partition>
700 * dnsHostName: <dns_host_name>
703 /* START: Infrastructure FSMO */
705 * LDAP search 1st LDAP connection:
708 * basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
710 * filter: (objectClass=*)
713 * CN=Infrastructure,<domain_partition>
717 * LDAP search 1st LDAP connection:
720 * basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
722 * filter: (objectClass=*)
725 * CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
730 * LDAP search 1st LDAP connection:
733 * basedn: CN=Infrastructure,<domain_partition>
735 * filter: (objectClass=*)
736 * attrs: fSMORoleOwner
738 * CN=Infrastructure,<domain_partition>
739 * fSMORoleOwner: CN=NTDS Settings,<infrastructure_fsmo_server_object>
743 * LDAP search 1st LDAP connection:
746 * basedn: <infrastructure_fsmo_server_object>
748 * filter: (objectClass=*)
751 * <infrastructure_fsmo_server_object>
752 * dnsHostName: <dns_host_name>
756 * LDAP search 1st LDAP connection:
759 * basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
761 * filter: (objectClass=*)
764 * CN=NTDS Settings,<infrastructure_fsmo_server_object>
765 * objectGUID: <object_guid>
767 /* END: Infrastructure FSMO */
769 /* START: RID Manager FSMO */
771 * LDAP search 1st LDAP connection:
774 * basedn: <domain_partition>
776 * filter: (objectClass=*)
777 * attrs: rIDManagerReference
780 * rIDManagerReference: CN=RID Manager$,CN=System,<domain_partition>
784 * LDAP search 1st LDAP connection:
787 * basedn: CN=RID Manager$,CN=System,<domain_partition>
789 * filter: (objectClass=*)
790 * attrs: fSMORoleOwner
792 * CN=Infrastructure,<domain_partition>
793 * fSMORoleOwner: CN=NTDS Settings,<rid_manager_fsmo_server_object>
797 * LDAP search 1st LDAP connection:
800 * basedn: <rid_manager_fsmo_server_object>
802 * filter: (objectClass=*)
805 * <rid_manager_fsmo_server_object>
806 * dnsHostName: <dns_host_name>
810 * LDAP search 1st LDAP connection:
813 * basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
815 * filter: (objectClass=*)
816 * attrs: msDs-ReplicationEpoch
818 * CN=NTDS Settings,<rid_manager_fsmo_server_object>
820 /* END: RID Manager FSMO */
823 * LDAP search 1st LDAP connection:
826 * basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
828 * filter: (objectClass=*)
831 * CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
834 * cn: <new_dc_site_name>
835 * distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
841 * showInAdvancedViewOnly: TRUE
842 * name: <new_dc_site_name>
843 * objectGUID: <object_guid>
844 * systemFlags: 1107296256 <0x42000000>
845 * objectCategory: CN=Site,C=Schema,CN=Configuration,<domain_partition>
849 * LDAP search 1st LDAP connection:
852 * basedn: <domain_partition>
854 * filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
855 * attrs: distinguishedName
858 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
859 * distinguishedName: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
860 * userAccoountControl: 4096 <0x1000>
864 * LDAP search 1st LDAP connection:
867 * basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
869 * filter: (objectClass=*)
873 * <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
877 * LDAP search 1st LDAP connection:
880 * basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
882 * filter: (objectClass=*)
883 * attrs: serverReferenceBL
886 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
890 * LDAP add 1st LDAP connection:
893 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
894 * objectClass: server
895 * systemFlags: 50000000 <0x2FAF080>
896 * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
902 * LDAP search 1st LDAP connection:
905 * basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
907 * filter: (objectClass=*)
911 * <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
915 * LDAP search 1st LDAP connection:
918 * basedn: CN=Partitions,CN=Configuration,<domain_partition>
920 * filter: (nCName=<domain_partition>)
923 * controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
925 * <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
926 * nCName: <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
927 * dnsRoot: <domain_dns_name>
931 * LDAP modify 1st LDAP connection:
934 * CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
935 * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
937 * <attributeOrValueExist>
941 * LDAP modify 1st LDAP connection:
944 * CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
945 * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
951 * Open 1st DRSUAPI connection to the DC using admin credentials
952 * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
953 * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
957 * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
958 * on the 1st DRSUAPI connection
962 * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
963 * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
964 * on the 2nd connection
968 * replicate CN=Schema,CN=Configuration,...
969 * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
973 * replicate CN=Configuration,...
974 * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
978 * LDAP unbind in the 1st LDAP connection
982 * Open 2nd LDAP connection to the DC using admin credentials
984 /* ldap modify userAccountControl from 4096 to 532480 */
986 /* ldap modify RDN to OU=Domain Controllers and skip the $ from server name */
989 * replicate Domain Partition
990 * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
993 /* call DsReplicaUpdateRefs() for all partitions like this:
994 * req1: struct drsuapi_DsReplicaUpdateRefsRequest1
996 * naming_context: struct drsuapi_DsReplicaObjectIdentifier
997 * __ndr_size : 0x000000ae (174)
998 * __ndr_size_sid : 0x00000000 (0)
999 * guid : 00000000-0000-0000-0000-000000000000
1001 * dn : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
1002 * dest_dsa_dns_name : *
1003 * dest_dsa_dns_name : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
1004 * dest_dsa_guid : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
1005 * options : 0x0000001c (28)
1006 * 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
1007 * 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
1008 * 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
1009 * 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
1010 * 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
1012 * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
1013 * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
1014 * on the 2nd!!! DRSUAPI connection
1018 * Windows does opens the 4th and 5th DRSUAPI connection...
1019 * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
1020 * on the 4th connection
1022 * and then 2 full replications of the domain partition on the 5th connection
1023 * with the bind_handle from the 4th connection
1028 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
1032 torture_leave_domain(join->join);