892886c08c53ceceda7501ac594267bf5cf1394d
[gd/samba-autobuild/.git] / source4 / torture / rpc / testjoin.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    utility code to join/leave a domain
5
6    Copyright (C) Andrew Tridgell 2004
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /*
23   this code is used by other torture modules to join/leave a domain
24   as either a member, bdc or thru a trust relationship
25 */
26
27 #include "includes.h"
28 #include "torture/torture.h"
29 #include "system/time.h"
30 #include "lib/crypto/crypto.h"
31 #include "libnet/libnet.h"
32 #include "lib/cmdline/popt_common.h"
33 #include "lib/ldb/include/ldb.h"
34 #include "librpc/gen_ndr/ndr_samr_c.h"
35
36 #include "libcli/auth/libcli_auth.h"
37 #include "torture/rpc/rpc.h"
38 #include "libcli/security/security.h"
39 #include "param/param.h"
40
41 struct test_join {
42         struct dcerpc_pipe *p;
43         struct policy_handle user_handle;
44         struct libnet_JoinDomain *libnet_r;
45         struct dom_sid *dom_sid;
46         const char *dom_netbios_name;
47         const char *dom_dns_name;
48         struct dom_sid *user_sid;
49         struct GUID user_guid;
50         const char *netbios_name;
51 };
52
53
54 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, 
55                                   struct policy_handle *handle, const char *name)
56 {
57         NTSTATUS status;
58         struct samr_DeleteUser d;
59         struct policy_handle user_handle;
60         uint32_t rid;
61         struct samr_LookupNames n;
62         struct lsa_String sname;
63         struct samr_OpenUser r;
64
65         sname.string = name;
66
67         n.in.domain_handle = handle;
68         n.in.num_names = 1;
69         n.in.names = &sname;
70
71         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
72         if (NT_STATUS_IS_OK(status)) {
73                 rid = n.out.rids.ids[0];
74         } else {
75                 return status;
76         }
77
78         r.in.domain_handle = handle;
79         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
80         r.in.rid = rid;
81         r.out.user_handle = &user_handle;
82
83         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
84         if (!NT_STATUS_IS_OK(status)) {
85                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
86                 return status;
87         }
88
89         d.in.user_handle = &user_handle;
90         d.out.user_handle = &user_handle;
91         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
92         if (!NT_STATUS_IS_OK(status)) {
93                 return status;
94         }
95
96         return NT_STATUS_OK;
97 }
98
99 /*
100   create a test user in the domain
101   an opaque pointer is returned. Pass it to torture_leave_domain() 
102   when finished
103 */
104
105 struct test_join *torture_create_testuser(struct torture_context *torture,
106                                           const char *username, 
107                                           const char *domain,
108                                           uint16_t acct_type,
109                                           const char **random_password)
110 {
111         NTSTATUS status;
112         struct samr_Connect c;
113         struct samr_CreateUser2 r;
114         struct samr_OpenDomain o;
115         struct samr_LookupDomain l;
116         struct samr_GetUserPwInfo pwp;
117         struct samr_SetUserInfo s;
118         union samr_UserInfo u;
119         struct policy_handle handle;
120         struct policy_handle domain_handle;
121         uint32_t access_granted;
122         uint32_t rid;
123         DATA_BLOB session_key;
124         struct lsa_String name;
125         
126         int policy_min_pw_len = 0;
127         struct test_join *join;
128         char *random_pw;
129         const char *dc_binding = torture_setting_string(torture, "dc_binding", NULL);
130
131         join = talloc(NULL, struct test_join);
132         if (join == NULL) {
133                 return NULL;
134         }
135
136         ZERO_STRUCTP(join);
137
138         printf("Connecting to SAMR\n");
139         
140         if (dc_binding) {
141                 status = dcerpc_pipe_connect(join,
142                                              &join->p,
143                                              dc_binding,
144                                              &ndr_table_samr,
145                                              cmdline_credentials, NULL, torture->lp_ctx);
146                                              
147         } else {
148                 status = torture_rpc_connection(torture, 
149                                                 &join->p, 
150                                                 &ndr_table_samr);
151         }
152         if (!NT_STATUS_IS_OK(status)) {
153                 return NULL;
154         }
155
156         c.in.system_name = NULL;
157         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
158         c.out.connect_handle = &handle;
159
160         status = dcerpc_samr_Connect(join->p, join, &c);
161         if (!NT_STATUS_IS_OK(status)) {
162                 const char *errstr = nt_errstr(status);
163                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
164                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
165                 }
166                 printf("samr_Connect failed - %s\n", errstr);
167                 return NULL;
168         }
169
170         printf("Opening domain %s\n", domain);
171
172         name.string = domain;
173         l.in.connect_handle = &handle;
174         l.in.domain_name = &name;
175
176         status = dcerpc_samr_LookupDomain(join->p, join, &l);
177         if (!NT_STATUS_IS_OK(status)) {
178                 printf("LookupDomain failed - %s\n", nt_errstr(status));
179                 goto failed;
180         }
181
182         talloc_steal(join, l.out.sid);
183         join->dom_sid = l.out.sid;
184         join->dom_netbios_name = talloc_strdup(join, domain);
185         if (!join->dom_netbios_name) goto failed;
186
187         o.in.connect_handle = &handle;
188         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
189         o.in.sid = l.out.sid;
190         o.out.domain_handle = &domain_handle;
191
192         status = dcerpc_samr_OpenDomain(join->p, join, &o);
193         if (!NT_STATUS_IS_OK(status)) {
194                 printf("OpenDomain failed - %s\n", nt_errstr(status));
195                 goto failed;
196         }
197
198         printf("Creating account %s\n", username);
199
200 again:
201         name.string = username;
202         r.in.domain_handle = &domain_handle;
203         r.in.account_name = &name;
204         r.in.acct_flags = acct_type;
205         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
206         r.out.user_handle = &join->user_handle;
207         r.out.access_granted = &access_granted;
208         r.out.rid = &rid;
209
210         status = dcerpc_samr_CreateUser2(join->p, join, &r);
211
212         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
213                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
214                 if (NT_STATUS_IS_OK(status)) {
215                         goto again;
216                 }
217         }
218
219         if (!NT_STATUS_IS_OK(status)) {
220                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
221                 goto failed;
222         }
223
224         join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
225
226         pwp.in.user_handle = &join->user_handle;
227
228         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
229         if (NT_STATUS_IS_OK(status)) {
230                 policy_min_pw_len = pwp.out.info.min_password_length;
231         }
232
233         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
234
235         printf("Setting account password '%s'\n", random_pw);
236
237         ZERO_STRUCT(u);
238         s.in.user_handle = &join->user_handle;
239         s.in.info = &u;
240         s.in.level = 24;
241
242         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
243         u.info24.pw_len = strlen(random_pw);
244
245         status = dcerpc_fetch_session_key(join->p, &session_key);
246         if (!NT_STATUS_IS_OK(status)) {
247                 printf("SetUserInfo level %u - no session key - %s\n",
248                        s.in.level, nt_errstr(status));
249                 torture_leave_domain(join);
250                 goto failed;
251         }
252
253         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
254
255         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
256         if (!NT_STATUS_IS_OK(status)) {
257                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
258                 goto failed;
259         }
260
261         ZERO_STRUCT(u);
262         s.in.user_handle = &join->user_handle;
263         s.in.info = &u;
264         s.in.level = 21;
265
266         u.info21.acct_flags = acct_type | ACB_PWNOEXP;
267         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
268
269         u.info21.comment.string = talloc_asprintf(join, 
270                                                   "Tortured by Samba4: %s", 
271                                                   timestring(join, time(NULL)));
272         
273         u.info21.full_name.string = talloc_asprintf(join, 
274                                                     "Torture account for Samba4: %s", 
275                                                     timestring(join, time(NULL)));
276         
277         u.info21.description.string = talloc_asprintf(join, 
278                                          "Samba4 torture account created by host %s: %s", 
279                                          lp_netbios_name(torture->lp_ctx), 
280                                          timestring(join, time(NULL)));
281
282         printf("Resetting ACB flags, force pw change time\n");
283
284         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
285         if (!NT_STATUS_IS_OK(status)) {
286                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
287                 goto failed;
288         }
289
290         if (random_password) {
291                 *random_password = random_pw;
292         }
293
294         return join;
295
296 failed:
297         torture_leave_domain(join);
298         return NULL;
299 }
300
301
302 _PUBLIC_ struct test_join *torture_join_domain(struct torture_context *tctx,
303                                                const char *machine_name, 
304                                       uint32_t acct_flags,
305                                       struct cli_credentials **machine_credentials)
306 {
307         NTSTATUS status;
308         struct libnet_context *libnet_ctx;
309         struct libnet_JoinDomain *libnet_r;
310         struct test_join *tj;
311         struct samr_SetUserInfo s;
312         union samr_UserInfo u;
313         
314         tj = talloc(NULL, struct test_join);
315         if (!tj) return NULL;
316
317         libnet_r = talloc(tj, struct libnet_JoinDomain);
318         if (!libnet_r) {
319                 talloc_free(tj);
320                 return NULL;
321         }
322         
323         libnet_ctx = libnet_context_init(NULL, tctx->lp_ctx);   
324         if (!libnet_ctx) {
325                 talloc_free(tj);
326                 return NULL;
327         }
328         
329         tj->libnet_r = libnet_r;
330                 
331         libnet_ctx->cred = cmdline_credentials;
332         libnet_r->in.binding = torture_setting_string(tctx, "binding", NULL);
333         if (!libnet_r->in.binding) {
334                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", torture_setting_string(tctx, "host", NULL));
335         }
336         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
337         libnet_r->in.netbios_name = machine_name;
338         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
339         if (!libnet_r->in.account_name) {
340                 talloc_free(tj);
341                 return NULL;
342         }
343         
344         libnet_r->in.acct_type = acct_flags;
345         libnet_r->in.recreate_account = true;
346
347         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
348         if (!NT_STATUS_IS_OK(status)) {
349                 if (libnet_r->out.error_string) {
350                         DEBUG(0, ("Domain join failed - %s\n", libnet_r->out.error_string));
351                 } else {
352                         DEBUG(0, ("Domain join failed - %s\n", nt_errstr(status)));
353                 }
354                 talloc_free(tj);
355                 return NULL;
356         }
357         tj->p = libnet_r->out.samr_pipe;
358         tj->user_handle = *libnet_r->out.user_handle;
359         tj->dom_sid = libnet_r->out.domain_sid;
360         talloc_steal(tj, libnet_r->out.domain_sid);
361         tj->dom_netbios_name    = libnet_r->out.domain_name;
362         talloc_steal(tj, libnet_r->out.domain_name);
363         tj->dom_dns_name        = libnet_r->out.realm;
364         talloc_steal(tj, libnet_r->out.realm);
365         tj->user_guid = libnet_r->out.account_guid;
366         tj->netbios_name = talloc_strdup(tj, machine_name);
367         if (!tj->netbios_name) {
368                 talloc_free(tj);
369                 return NULL;
370         }
371
372         ZERO_STRUCT(u);
373         s.in.user_handle = &tj->user_handle;
374         s.in.info = &u;
375         s.in.level = 21;
376
377         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
378         u.info21.comment.string = talloc_asprintf(tj, 
379                                                   "Tortured by Samba4: %s", 
380                                                   timestring(tj, time(NULL)));
381         u.info21.full_name.string = talloc_asprintf(tj, 
382                                                     "Torture account for Samba4: %s", 
383                                                     timestring(tj, time(NULL)));
384         
385         u.info21.description.string = talloc_asprintf(tj, 
386                                                       "Samba4 torture account created by host %s: %s", 
387                                                       lp_netbios_name(tctx->lp_ctx), timestring(tj, time(NULL)));
388
389         status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
390         if (!NT_STATUS_IS_OK(status)) {
391                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
392         }
393
394         *machine_credentials = cli_credentials_init(tj);
395         cli_credentials_set_conf(*machine_credentials, tctx->lp_ctx);
396         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
397         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
398         if (libnet_r->out.realm) {
399                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
400         }
401         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
402         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
403         if (acct_flags & ACB_SVRTRUST) {
404                 cli_credentials_set_secure_channel_type(*machine_credentials,
405                                                         SEC_CHAN_BDC);
406         } else if (acct_flags & ACB_WSTRUST) {
407                 cli_credentials_set_secure_channel_type(*machine_credentials,
408                                                         SEC_CHAN_WKSTA);
409         } else {
410                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
411                 talloc_free(*machine_credentials);
412                 return NULL;
413         }
414
415         return tj;
416 }
417
418 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join) 
419 {
420         return join->p;
421 }
422
423 struct policy_handle *torture_join_samr_user_policy(struct test_join *join) 
424 {
425         return &join->user_handle;
426 }
427
428 static NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
429 {
430         int rtn;
431         TALLOC_CTX *tmp_ctx;
432
433         struct ldb_dn *server_dn;
434         struct ldb_context *ldb_ctx;
435
436         char *remote_ldb_url; 
437          
438         /* Check if we are a domain controller. If not, exit. */
439         if (!libnet_r->out.server_dn_str) {
440                 return NT_STATUS_OK;
441         }
442
443         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
444         if (!tmp_ctx) {
445                 libnet_r->out.error_string = NULL;
446                 return NT_STATUS_NO_MEMORY;
447         }
448
449         ldb_ctx = ldb_init(tmp_ctx);
450         if (!ldb_ctx) {
451                 libnet_r->out.error_string = NULL;
452                 talloc_free(tmp_ctx);
453                 return NT_STATUS_NO_MEMORY;
454         }
455
456         /* Remove CN=Servers,... entry from the AD. */ 
457         server_dn = ldb_dn_new(tmp_ctx, ldb_ctx, libnet_r->out.server_dn_str);
458         if (! ldb_dn_validate(server_dn)) {
459                 libnet_r->out.error_string = NULL;
460                 talloc_free(tmp_ctx);
461                 return NT_STATUS_NO_MEMORY;
462         }
463
464         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
465         if (!remote_ldb_url) {
466                 libnet_r->out.error_string = NULL;
467                 talloc_free(tmp_ctx);
468                 return NT_STATUS_NO_MEMORY;
469         }
470
471         ldb_set_opaque(ldb_ctx, "credentials", cmdline_credentials);
472
473         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
474         if (rtn != 0) {
475                 libnet_r->out.error_string = NULL;
476                 talloc_free(tmp_ctx);
477                 return NT_STATUS_UNSUCCESSFUL;
478         }
479
480         rtn = ldb_delete(ldb_ctx, server_dn);
481         if (rtn != 0) {
482                 libnet_r->out.error_string = NULL;
483                 talloc_free(tmp_ctx);
484                 return NT_STATUS_UNSUCCESSFUL;
485         }
486
487         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
488
489         talloc_free(tmp_ctx); 
490         return NT_STATUS_OK;
491 }
492
493 /*
494   leave the domain, deleting the machine acct
495 */
496
497 _PUBLIC_ void torture_leave_domain(struct test_join *join)
498 {
499         struct samr_DeleteUser d;
500         NTSTATUS status;
501
502         if (!join) {
503                 return;
504         }
505         d.in.user_handle = &join->user_handle;
506         d.out.user_handle = &join->user_handle;
507                                         
508         /* Delete machine account */                                                                                                                                                                                                                                                                                                                    
509         status = dcerpc_samr_DeleteUser(join->p, join, &d);
510         if (!NT_STATUS_IS_OK(status)) {
511                 printf("Delete of machine account failed\n");
512         } else {
513                 printf("Delete of machine account was successful.\n");
514         }
515
516         if (join->libnet_r) {
517                 status = torture_leave_ads_domain(join, join->libnet_r);
518         }
519         
520         talloc_free(join);
521 }
522
523 /*
524   return the dom sid for a test join
525 */
526 _PUBLIC_ const struct dom_sid *torture_join_sid(struct test_join *join)
527 {
528         return join->dom_sid;
529 }
530
531 const struct dom_sid *torture_join_user_sid(struct test_join *join)
532 {
533         return join->user_sid;
534 }
535
536 const char *torture_join_netbios_name(struct test_join *join)
537 {
538         return join->netbios_name;
539 }
540
541 const struct GUID *torture_join_user_guid(struct test_join *join)
542 {
543         return &join->user_guid;
544 }
545
546 const char *torture_join_dom_netbios_name(struct test_join *join)
547 {
548         return join->dom_netbios_name;
549 }
550
551 const char *torture_join_dom_dns_name(struct test_join *join)
552 {
553         return join->dom_dns_name;
554 }
555
556 const char *torture_join_server_dn_str(struct test_join *join)
557 {
558         if (join->libnet_r) {
559                 return join->libnet_r->out.server_dn_str;
560         }
561         return NULL;
562 }
563
564
565 #if 0 /* Left as the documentation of the join process, but see new implementation in libnet_become_dc.c */
566 struct test_join_ads_dc {
567         struct test_join *join;
568 };
569
570 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name, 
571                                                     const char *domain,
572                                                     struct cli_credentials **machine_credentials)
573 {
574         struct test_join_ads_dc *join;
575
576         join = talloc(NULL, struct test_join_ads_dc);
577         if (join == NULL) {
578                 return NULL;
579         }
580
581         join->join = torture_join_domain(machine_name, 
582                                         ACB_SVRTRUST,
583                                         machine_credentials);
584
585         if (!join->join) {
586                 return NULL;
587         }
588
589 /* W2K: */
590         /* W2K: modify userAccountControl from 4096 to 532480 */
591         
592         /* W2K: modify RDN to OU=Domain Controllers and skip the $ from server name */
593
594         /* ask objectVersion of Schema Partition */
595
596         /* ask rIDManagerReferenz of the Domain Partition */
597
598         /* ask fsMORoleOwner of the RID-Manager$ object
599          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
600          */
601
602         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
603
604         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
605
606         /* ask for * of CN=Default-First-Site-Name, ... */
607
608         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition 
609          * attributes : distinguishedName, userAccountControl
610          */
611
612         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,... 
613          * should fail with noSuchObject
614          */
615
616         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,... 
617          *
618          * objectClass = server
619          * systemFlags = 50000000
620          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
621          */
622
623         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
624          * should fail with noSuchObject
625          */
626
627         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,... 
628          * attributes: ncName, dnsRoot
629          */
630
631         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
632          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
633          * should fail with attributeOrValueExists
634          */
635
636         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
637          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
638          */
639
640         /* DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
641          *
642          */
643
644         /* replicate CN=Schema,CN=Configuration,...
645          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
646          *
647          */
648
649         /* replicate CN=Configuration,...
650          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
651          *
652          */
653
654         /* replicate Domain Partition
655          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
656          *
657          */
658
659         /* call DsReplicaUpdateRefs() for all partitions like this:
660          *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
661          *           naming_context           : *
662          *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
663          *                     __ndr_size               : 0x000000ae (174)
664          *                     __ndr_size_sid           : 0x00000000 (0)
665          *                     guid                     : 00000000-0000-0000-0000-000000000000
666          *                     sid                      : S-0-0
667          *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
668          *           dest_dsa_dns_name        : *
669          *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
670          *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
671          *           options                  : 0x0000001c (28)
672          *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
673          *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
674          *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
675          *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
676          *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010      
677          *
678          * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
679          * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
680          */
681
682 /* W2K3: see libnet/libnet_become_dc.c */
683         return join;
684 }
685
686 #endif