source4/setup/domainlevel

   1 #!/usr/bin/python
   2 #
   3 # Raises domain and forest function levels
   4 #
   5 # Copyright Matthias Dieter Wallnoefer 2009
   6 #
   7 # This program is free software; you can redistribute it and/or modify
   8 # it under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 3 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # This program is distributed in the hope that it will be useful,
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 #
  20
  21 import sys
  22
  23 # Find right directory when running from source tree
  24 sys.path.insert(0, "bin/python")
  25
  26 import samba.getopt as options
  27 import optparse
  28 import ldb
  29
  30 from samba.auth import system_session
  31 from samba.samdb import SamDB
  32 from samba import DS_DOMAIN_FUNCTION_2000, DS_DOMAIN_FUNCTION_2003
  33 from samba import DS_DOMAIN_FUNCTION_2003_MIXED, DS_DOMAIN_FUNCTION_2008
  34 from samba import DS_DOMAIN_FUNCTION_2008_R2
  35
  36 parser = optparse.OptionParser("domainlevel (show | raise <options>)")
  37 sambaopts = options.SambaOptions(parser)
  38 parser.add_option_group(sambaopts)
  39 parser.add_option_group(options.VersionOptions(parser))
  40 credopts = options.CredentialsOptions(parser)
  41 parser.add_option_group(credopts)
  42 parser.add_option("--quiet", help="Be quiet", action="store_true")
  43 parser.add_option("--forest",
  44   help="The forest function level (2000 | 2003 | 2008 | 2008_R2). We don't support mixed/interim (NT4 DC support) levels.", type=str)
  45 parser.add_option("--domain",
  46   help="The domain function level (2000 | 2003 | 2008 | 2008_R2). We don't support mixed/interim (NT4 DC support) levels.", type=str)
  47 opts, args = parser.parse_args()
  48
  49 #
  50 #  print a message if quiet is not set
  51 #
  52 def message(text):
  53         if not opts.quiet:
  54                 print text
  55
  56 if len(args) == 0:
  57         parser.print_usage()
  58         sys.exit(1)
  59
  60 lp = sambaopts.get_loadparm()
  61 creds = credopts.get_credentials(lp)
  62
  63 samdb = SamDB(url=lp.get("sam database"), session_info=system_session(),
  64               credentials=creds, lp=lp)
  65
  66 domain_dn = SamDB.domain_dn(samdb)
  67
  68 res_forest = samdb.search("CN=Partitions,CN=Configuration," + domain_dn,
  69   scope=ldb.SCOPE_BASE, attrs=["msDS-Behavior-Version"])
  70 assert(len(res_forest) == 1)
  71
  72 res_forest_mixed = samdb.search("CN=" + lp.get("workgroup") +
  73   ",CN=Partitions,CN=Configuration," + domain_dn,
  74   scope=ldb.SCOPE_BASE, attrs=["nTMixedDomain"])
  75 assert(len(res_forest_mixed) == 1)
  76
  77 res_domain = samdb.search(domain_dn, scope=ldb.SCOPE_BASE,
  78   attrs=["msDS-Behavior-Version", "nTMixedDomain"])
  79 assert(len(res_domain) == 1)
  80
  81 try:
  82         level_forest = int(res_forest[0]["msDS-Behavior-Version"][0])
  83         level_forest_mixed = int(res_forest_mixed[0]["nTMixedDomain"][0])
  84         level_domain = int(res_domain[0]["msDS-Behavior-Version"][0])
  85         level_domain_mixed = int(res_domain[0]["nTMixedDomain"][0])
  86
  87         if level_forest < 0 or level_domain < 0:
  88                 print "ERROR: Domain and/or forest functional level(s) is/are invalid. Correct them or reprovision!"
  89                 sys.exit(1)
  90         if level_forest > level_domain or (level_forest_mixed < level_domain_mixed):
  91                 print "ERROR: Forest function level is higher than the domain level(s). That can't be. Correct this or reprovision!"
  92                 sys.exit(1)
  93 except:
  94         print "ERROR: Could not retrieve the actual domain and forest level!"
  95         if args[0] == "show":
  96                 print "So the levels can't be displayed!"
  97         sys.exit(1)
  98
  99 if args[0] == "show":
 100         message("Domain and forest function level for domain '" + domain_dn + "'")
 101         if (level_forest == DS_DOMAIN_FUNCTION_2000 and level_forest_mixed != 0) or level_forest == DS_DOMAIN_FUNCTION_2003_MIXED:
 102                 message("\nATTENTION: You run SAMBA 4 on a mixed/interim (NT4 DC support) forest level. This isn't supported! Please raise!")
 103         if (level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0) or level_domain == DS_DOMAIN_FUNCTION_2003_MIXED:
 104                 message("\nATTENTION: You run SAMBA 4 on a mixed/interim (NT4 DC support) domain level. This isn't supported! Please raise!")
 105
 106         message("")
 107
 108         if level_forest == DS_DOMAIN_FUNCTION_2000 and level_forest_mixed != 0:
 109                 outstr = "2000 mixed (NT4 DC support)"
 110         elif level_forest == DS_DOMAIN_FUNCTION_2000 and level_forest_mixed == 0:
 111                 outstr = "2000"
 112         elif level_forest == DS_DOMAIN_FUNCTION_2003_MIXED:
 113                 outstr = "2003 interim (NT4 DC support)"
 114         elif level_forest == DS_DOMAIN_FUNCTION_2003:
 115                 outstr = "2003"
 116         elif level_forest == DS_DOMAIN_FUNCTION_2008:
 117                 outstr = "2008"
 118         elif level_forest == DS_DOMAIN_FUNCTION_2008_R2:
 119                 outstr = "2008 R2"
 120         else:
 121                 outstr = "higher than 2008 R2"
 122         message("Forest function level: (Windows) " + outstr)
 123
 124         if level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0:
 125                 outstr = "2000 mixed (NT4 DC support)"
 126         elif level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed == 0:
 127                 outstr = "2000"
 128         elif level_domain == DS_DOMAIN_FUNCTION_2003_MIXED:
 129                 outstr = "2003 interim (NT4 DC support)"
 130         elif level_domain == DS_DOMAIN_FUNCTION_2003:
 131                 outstr = "2003"
 132         elif level_domain == DS_DOMAIN_FUNCTION_2008:
 133                 outstr = "2008"
 134         elif level_domain == DS_DOMAIN_FUNCTION_2008_R2:
 135                 outstr = "2008 R2"
 136         else:
 137                 outstr = "higher than 2008 R2"
 138         message("Domain function level: (Windows) " + outstr)
 139
 140 elif args[0] == "raise":
 141         msgs = []
 142
 143         if opts.domain is not None:
 144                 arg = opts.domain
 145
 146                 if arg == "2000":
 147                         new_level_domain = DS_DOMAIN_FUNCTION_2000
 148                 elif arg == "2003":
 149                         new_level_domain = DS_DOMAIN_FUNCTION_2003
 150                 elif arg == "2008":
 151                         new_level_domain = DS_DOMAIN_FUNCTION_2008
 152                 elif arg == "2008_R2":
 153                         new_level_domain = DS_DOMAIN_FUNCTION_2008_R2
 154                 else:
 155                         print "ERROR: Wrong argument '" + arg + "'!"
 156                         sys.exit(1)
 157
 158                 if new_level_domain <= level_domain and level_domain_mixed == 0:
 159                         print "ERROR: Domain function level can't be smaller equal to the actual one!"
 160                         sys.exit(1)
 161
 162                 # Deactivate mixed/interim domain support
 163                 if level_domain_mixed != 0:
 164                         m = ldb.Message()
 165                         m.dn = ldb.Dn(samdb, domain_dn)
 166                         m["nTMixedDomain"] = ldb.MessageElement("0",
 167                           ldb.FLAG_MOD_REPLACE, "nTMixedDomain")
 168                         samdb.modify(m)
 169
 170                 m = ldb.Message()
 171                 m.dn = ldb.Dn(samdb, domain_dn)
 172                 m["msDS-Behavior-Version"]= ldb.MessageElement(
 173                   str(new_level_domain), ldb.FLAG_MOD_REPLACE,
 174                   "msDS-Behavior-Version")
 175                 samdb.modify(m)
 176
 177                 level_domain = new_level_domain
 178
 179                 msgs.append("Domain function level changed!")
 180
 181         if opts.forest is not None:
 182                 arg = opts.forest
 183
 184                 if arg == "2000":
 185                         new_level_forest = DS_DOMAIN_FUNCTION_2000
 186                 elif arg == "2003":
 187                         new_level_forest = DS_DOMAIN_FUNCTION_2003
 188                 elif arg == "2008":
 189                         new_level_forest = DS_DOMAIN_FUNCTION_2008
 190                 elif arg == "2008_R2":
 191                         new_level_forest = DS_DOMAIN_FUNCTION_2008_R2
 192                 else:
 193                         print "ERROR: Wrong argument '" + arg + "'!"
 194                         sys.exit(1)
 195
 196                 if new_level_forest <= level_forest and level_forest_mixed == 0:
 197                         print "ERROR: Forest function level can't be smaller equal to the actual one!"
 198                         sys.exit(1)
 199
 200                 if new_level_forest > level_domain:
 201                         print "ERROR: Forest function level can't be higher than the domain function level(s). Please raise it/them first!"
 202                         sys.exit(1)
 203
 204                 # Deactivate mixed/interim forest support
 205                 if level_forest_mixed != 0:
 206                         m = ldb.Message()
 207                         m.dn = ldb.Dn(samdb, "CN=" + lp.get("workgroup")
 208                           + ",CN=Partitions,CN=Configuration," + domain_dn)
 209                         m["nTMixedDomain"] = ldb.MessageElement("0",
 210                           ldb.FLAG_MOD_REPLACE, "nTMixedDomain")
 211                         samdb.modify(m)
 212
 213                 m = ldb.Message()
 214                 m.dn = ldb.Dn(samdb, "CN=Partitions,CN=Configuration,"
 215                   + domain_dn)
 216                 m["msDS-Behavior-Version"]= ldb.MessageElement(
 217                   str(new_level_forest), ldb.FLAG_MOD_REPLACE,
 218                   "msDS-Behavior-Version")
 219                 samdb.modify(m)
 220
 221                 msgs.append("Forest function level changed!")
 222
 223         msgs.append("All changes applied successfully!")
 224
 225         message("\n".join(msgs))
 226 else:
 227         print "ERROR: Wrong argument '" + args[0] + "'!"
 228         sys.exit(1)