2 Samba Unix/Linux SMB client library
3 net ads commands for Group Policy
5 Copyright (C) 2005-2008 Guenther Deschner
6 Copyright (C) 2009 Wilco Baan Hofman
8 Based on Guenther's work in net_ads_gpo.h (samba 3)
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "utils/net/net.h"
26 #include "lib/ldb/include/ldb.h"
27 #include "auth/auth.h"
28 #include "param/param.h"
29 #include "libcli/security/sddl.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "dsdb/common/util.h"
32 #include "lib/policy/policy.h"
34 static int net_gpo_list_all_usage(struct net_context *ctx, int argc, const char **argv)
36 d_printf("Syntax: net gpo listall [options]\n");
37 d_printf("For a list of available options, please type net gpo listall --help\n");
41 static int net_gpo_list_all(struct net_context *ctx, int argc, const char **argv)
43 struct gp_context *gp_ctx;
44 struct gp_object **gpo;
45 const char **gpo_flags;
49 rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
50 if (!NT_STATUS_IS_OK(rv)) {
51 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
55 rv = gp_list_all_gpos(gp_ctx, &gpo);
56 if (!NT_STATUS_IS_OK(rv)) {
57 DEBUG(0, ("Failed to list all GPO's: %s\n", get_friendly_nt_error_msg(rv)));
62 for (i = 0; gpo[i] != NULL; i++) {
63 gp_get_gpo_flags(gp_ctx, gpo[i]->flags, &gpo_flags);
65 d_printf("GPO : %s\n", gpo[i]->name);
66 d_printf("display name : %s\n", gpo[i]->display_name);
67 d_printf("path : %s\n", gpo[i]->file_sys_path);
68 d_printf("dn : %s\n", gpo[i]->dn);
69 d_printf("version : %d\n", gpo[i]->version);
70 if (gpo_flags[0] == NULL) {
71 d_printf("flags : NONE\n");
73 d_printf("flags : %s\n", gpo_flags[0]);
74 for (j = 1; gpo_flags[j] != NULL; j++) {
75 d_printf(" %s\n", gpo_flags[i]);
79 talloc_free(gpo_flags);
86 static int net_gpo_get_gpo_usage(struct net_context *ctx, int argc, const char **argv)
88 d_printf("Syntax: net gpo show <dn> [options]\n");
89 d_printf("For a list of available options, please type net gpo show --help\n");
93 static int net_gpo_get_gpo(struct net_context *ctx, int argc, const char **argv)
95 struct gp_context *gp_ctx;
96 struct gp_object *gpo;
97 const char **gpo_flags;
103 return net_gpo_get_gpo_usage(ctx, argc, argv);
107 rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
108 if (!NT_STATUS_IS_OK(rv)) {
109 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
113 rv = gp_get_gpo_info(gp_ctx, argv[0], &gpo);
114 if (!NT_STATUS_IS_OK(rv)) {
115 DEBUG(0, ("Failed to get GPO: %s\n", get_friendly_nt_error_msg(rv)));
120 gp_get_gpo_flags(gp_ctx, gpo->flags, &gpo_flags);
122 d_printf("GPO : %s\n", gpo->name);
123 d_printf("display name : %s\n", gpo->display_name);
124 d_printf("path : %s\n", gpo->file_sys_path);
125 d_printf("dn : %s\n", gpo->dn);
126 d_printf("version : %d\n", gpo->version);
127 if (gpo_flags[0] == NULL) {
128 d_printf("flags : NONE\n");
130 d_printf("flags : %s\n", gpo_flags[0]);
131 for (i = 1; gpo_flags[i] != NULL; i++) {
132 d_printf(" %s\n", gpo_flags[i]);
135 sddl = sddl_encode(gp_ctx, gpo->security_descriptor, samdb_domain_sid(gp_ctx->ldb_ctx));
137 d_printf("ACL : %s\n", sddl);
146 static int net_gpo_link_get_usage(struct net_context *ctx, int argc, const char **argv)
148 d_printf("Syntax: net gpo getlink <dn> [options]\n");
149 d_printf("For a list of available options, please type net gpo getlink --help\n");
153 static int net_gpo_link_get(struct net_context *ctx, int argc, const char **argv)
155 struct gp_context *gp_ctx;
156 struct gp_link **links;
159 const char **options;
162 return net_gpo_link_get_usage(ctx, argc, argv);
165 rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
166 if (!NT_STATUS_IS_OK(rv)) {
167 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
171 rv = gp_get_gplinks(gp_ctx, argv[0], &links);
172 if (!NT_STATUS_IS_OK(rv)) {
173 DEBUG(0, ("Failed to get gplinks: %s\n", get_friendly_nt_error_msg(rv)));
178 for (i = 0; links[i] != NULL; i++) {
179 gp_get_gplink_options(gp_ctx, links[i]->options, &options);
181 d_printf("GPO DN : %s\n", links[i]->dn);
182 if (options[0] == NULL) {
183 d_printf("Options : NONE\n");
185 d_printf("Options : %s\n", options[0]);
186 for (j = 1; options[j] != NULL; j++) {
187 d_printf(" : %s\n", options[j]);
192 talloc_free(options);
200 static int net_gpo_list_usage(struct net_context *ctx, int argc, const char **argv)
202 d_printf("Syntax: net gpo list <username> [options]\n");
203 d_printf("For a list of available options, please type net gpo list --help\n");
207 static int net_gpo_list(struct net_context *ctx, int argc, const char **argv)
209 struct gp_context *gp_ctx;
210 struct ldb_result *result;
211 struct auth_serversupplied_info *server_info;
212 struct auth_session_info *session_info;
213 DATA_BLOB dummy = { NULL, 0 };
218 struct auth_context *auth_context;
221 return net_gpo_list_usage(ctx, argc, argv);
224 status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
225 if (!NT_STATUS_IS_OK(status)) {
226 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
230 /* Find the user in the directory. We need extended DN's for group expansion
231 * in authsam_make_server_info */
232 rv = dsdb_search(gp_ctx->ldb_ctx,
235 ldb_get_default_basedn(gp_ctx->ldb_ctx),
238 DSDB_SEARCH_SHOW_EXTENDED_DN,
239 "(&(objectClass=user)(sAMAccountName=%s))", argv[0]);
240 if (rv != LDB_SUCCESS) {
241 DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv),ldb_errstring(gp_ctx->ldb_ctx)));
246 /* We expect exactly one record */
247 if (result->count != 1) {
248 DEBUG(0, ("Could not find SAM account with name %s\n", argv[0]));
253 /* We need the server info, as this will contain the groups of this
254 * user, needed for a token */
255 status = authsam_make_server_info(gp_ctx,
257 lpcfg_netbios_name(gp_ctx->lp_ctx),
258 lpcfg_sam_name(gp_ctx->lp_ctx),
259 ldb_get_default_basedn(gp_ctx->ldb_ctx),
264 if (!NT_STATUS_IS_OK(status)) {
265 DEBUG(0, ("Failed to make server information: %s\n", get_friendly_nt_error_msg(status)));
270 /* We do now need an auth context to create a session */
271 status = auth_context_create_from_ldb(gp_ctx, gp_ctx->ldb_ctx, &auth_context);
272 if (!NT_STATUS_IS_OK(status)) {
273 DEBUG(0, ("Failed to get an auth context: %s\n", get_friendly_nt_error_msg(status)));
278 /* The session info will contain the security token for this user */
279 status = auth_generate_session_info(gp_ctx, auth_context, server_info, 0, &session_info);
280 if (!NT_STATUS_IS_OK(status)) {
281 DEBUG(0, ("Failed to generate session information: %s\n", get_friendly_nt_error_msg(status)));
286 status = gp_list_gpos(gp_ctx, session_info->security_token, &gpos);
287 if (!NT_STATUS_IS_OK(status)) {
288 DEBUG(0, ("Failed to list gpos for user %s: %s\n", argv[0],
289 get_friendly_nt_error_msg(status)));
294 d_printf("GPO's for user %s:\n", argv[0]);
295 for (i = 0; gpos[i] != NULL; i++) {
296 d_printf("\t%s\n", gpos[i]);
303 static int net_gpo_link_set_usage(struct net_context *ctx, int argc, const char **argv)
305 d_printf("Syntax: net gpo setlink <container> <gpo> ['disable'] ['enforce'] [options]\n");
306 d_printf("For a list of available options, please type net gpo setlink --help\n");
310 static int net_gpo_link_set(struct net_context *ctx, int argc, const char **argv)
312 struct gp_link *gplink = talloc_zero(ctx, struct gp_link);
313 struct gp_context *gp_ctx;
318 return net_gpo_link_set_usage(ctx, argc, argv);
322 for (i = 2; i < argc; i++) {
323 if (strcmp(argv[i], "disable") == 0) {
324 gplink->options |= GPLINK_OPT_DISABLE;
326 if (strcmp(argv[i], "enforce") == 0) {
327 gplink->options |= GPLINK_OPT_ENFORCE;
331 gplink->dn = argv[1];
333 status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
334 if (!NT_STATUS_IS_OK(status)) {
335 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
339 status = gp_set_gplink(gp_ctx, argv[0], gplink);
340 if (!NT_STATUS_IS_OK(status)) {
341 DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status)));
344 d_printf("Set link on container.\nCurrent Group Policy links:\n");
346 /* Display current links */
347 net_gpo_link_get(ctx, 1, argv);
353 static int net_gpo_link_del_usage(struct net_context *ctx, int argc, const char **argv)
355 d_printf("Syntax: net gpo dellink <container> <gpo> [options]\n");
356 d_printf("For a list of available options, please type net gpo dellink --help\n");
360 static int net_gpo_link_del(struct net_context *ctx, int argc, const char **argv)
362 struct gp_context *gp_ctx;
366 return net_gpo_link_del_usage(ctx, argc, argv);
369 status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
370 if (!NT_STATUS_IS_OK(status)) {
371 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
375 status = gp_del_gplink(gp_ctx, argv[0], argv[1]);
376 if (!NT_STATUS_IS_OK(status)) {
377 DEBUG(0, ("Failed to delete gplink: %s\n", get_friendly_nt_error_msg(status)));
381 d_printf("Deleted gplink.\nCurrent Group Policy links:\n\n");
383 /* Display current links */
384 net_gpo_link_get(ctx, 1, argv);
390 static int net_gpo_inheritance_get_usage(struct net_context *ctx, int argc, const char **argv)
392 d_printf("Syntax: net gpo getinheritance <container> [options]\n");
393 d_printf("For a list of available options, please type net gpo getinheritance --help\n");
397 static int net_gpo_inheritance_get(struct net_context *ctx, int argc, const char **argv)
399 struct gp_context *gp_ctx;
400 enum gpo_inheritance inheritance;
404 return net_gpo_inheritance_get_usage(ctx, argc, argv);
407 status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
408 if (!NT_STATUS_IS_OK(status)) {
409 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
413 status = gp_get_inheritance(gp_ctx, argv[0], &inheritance);
414 if (!NT_STATUS_IS_OK(status)) {
415 DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status)));
420 if (inheritance == GPO_BLOCK_INHERITANCE) {
421 d_printf("container has GPO_BLOCK_INHERITANCE\n");
423 d_printf("container has GPO_INHERIT\n");
430 static int net_gpo_inheritance_set_usage(struct net_context *ctx, int argc, const char **argv)
432 d_printf("Syntax: net gpo setinheritance <container> <\"block\"|\"inherit\"> [options]\n");
433 d_printf("For a list of available options, please type net gpo setinheritance --help\n");
437 static int net_gpo_inheritance_set(struct net_context *ctx, int argc, const char **argv)
439 struct gp_context *gp_ctx;
440 enum gpo_inheritance inheritance;
444 return net_gpo_inheritance_set_usage(ctx, argc, argv);
447 if (strcmp(argv[1], "inherit") == 0) {
448 inheritance = GPO_INHERIT;
449 } else if (strcmp(argv[1], "block") == 0) {
450 inheritance = GPO_BLOCK_INHERITANCE;
452 return net_gpo_inheritance_set_usage(ctx, argc, argv);
455 status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
456 if (!NT_STATUS_IS_OK(status)) {
457 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status)));
461 status = gp_set_inheritance(gp_ctx, argv[0], inheritance);
462 if (!NT_STATUS_IS_OK(status)) {
463 DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status)));
468 /* Display current links */
469 net_gpo_inheritance_get(ctx, 1, argv);
474 static int net_gpo_fetch_usage(struct net_context *ctx, int argc, const char **argv)
476 d_printf("Syntax: net gpo fetch <container> [options]\n");
477 d_printf("For a list of available options, please type net gpo fetch --help\n");
481 static int net_gpo_fetch(struct net_context *ctx, int argc, const char **argv)
483 struct gp_context *gp_ctx;
484 struct gp_object *gpo;
489 return net_gpo_fetch_usage(ctx, argc, argv);
492 rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
493 if (!NT_STATUS_IS_OK(rv)) {
494 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
498 rv = gp_get_gpo_info(gp_ctx, argv[0], &gpo);
499 if (!NT_STATUS_IS_OK(rv)) {
500 DEBUG(0, ("Failed to get GPO: %s\n", get_friendly_nt_error_msg(rv)));
505 rv = gp_fetch_gpt(gp_ctx, gpo, &path);
506 if (!NT_STATUS_IS_OK(rv)) {
507 DEBUG(0, ("Failed to fetch GPO: %s\n", get_friendly_nt_error_msg(rv)));
511 d_printf("%s\n", path);
515 static int net_gpo_create_usage(struct net_context *ctx, int argc, const char **argv)
517 d_printf("Syntax: net gpo create <displayname> [options]\n");
518 d_printf("For a list of available options, please type net gpo create --help\n");
522 static int net_gpo_create(struct net_context *ctx, int argc, const char **argv)
524 struct gp_context *gp_ctx;
525 struct gp_object *gpo;
529 return net_gpo_create_usage(ctx, argc, argv);
532 rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
533 if (!NT_STATUS_IS_OK(rv)) {
534 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
538 rv = gp_create_gpo(gp_ctx, argv[0], &gpo);
539 if (!NT_STATUS_IS_OK(rv)) {
540 DEBUG(0, ("Failed to create GPO: %s\n", get_friendly_nt_error_msg(rv)));
549 static int net_gpo_set_acl_usage(struct net_context *ctx, int argc, const char **argv)
551 d_printf("Syntax: net gpo setacl <dn> <sddl> [options]\n");
552 d_printf("For a list of available options, please type net gpo setacl --help\n");
556 static int net_gpo_set_acl(struct net_context *ctx, int argc, const char **argv)
558 struct gp_context *gp_ctx;
559 struct security_descriptor *sd;
563 return net_gpo_set_acl_usage(ctx, argc, argv);
566 rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx);
567 if (!NT_STATUS_IS_OK(rv)) {
568 DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv)));
572 /* Convert sddl to security descriptor */
573 sd = sddl_decode(gp_ctx, argv[1], samdb_domain_sid(gp_ctx->ldb_ctx));
575 DEBUG(0, ("Invalid SDDL\n"));
580 rv = gp_set_acl(gp_ctx, argv[0], sd);
581 if (!NT_STATUS_IS_OK(rv)) {
582 DEBUG(0, ("Failed to set ACL on GPO: %s\n", get_friendly_nt_error_msg(rv)));
593 static const struct net_functable net_gpo_functable[] = {
594 { "listall", "List all GPO's on a DC\n", net_gpo_list_all, net_gpo_list_all_usage },
595 { "list", "List all active GPO's for a machine/user\n", net_gpo_list, net_gpo_list_usage },
596 { "show", "Show information for a GPO\n", net_gpo_get_gpo, net_gpo_get_gpo_usage },
597 { "getlink", "List gPLink of container\n", net_gpo_link_get, net_gpo_link_get_usage },
598 { "setlink", "Link a GPO to a container\n", net_gpo_link_set, net_gpo_link_set_usage },
599 { "dellink", "Delete GPO link from a container\n", net_gpo_link_del, net_gpo_link_del_usage },
600 { "getinheritance", "Get inheritance flag from a container\n", net_gpo_inheritance_get, net_gpo_inheritance_get_usage },
601 { "setinheritance", "Set inheritance flag on a container\n", net_gpo_inheritance_set, net_gpo_inheritance_set_usage },
602 { "fetch", "Download a GPO\n", net_gpo_fetch, net_gpo_fetch_usage },
603 { "create", "Create a GPO\n", net_gpo_create, net_gpo_create_usage },
604 { "setacl", "Set ACL on a GPO\n", net_gpo_set_acl, net_gpo_set_acl_usage },
608 int net_gpo_usage(struct net_context *ctx, int argc, const char **argv)
610 d_printf("Syntax: net gpo <command> [options]\n");
611 d_printf("For available commands, please type net gpo help\n");
615 int net_gpo(struct net_context *ctx, int argc, const char **argv)
617 return net_run_function(ctx, argc, argv, net_gpo_functable, net_gpo_usage);