r20251: I found out that the oid-prefix to uint32-id-prefix mapping is transferred
[jra/samba/.git] / source4 / libnet / libnet_become_dc.c
index 34022701d0ffa3f096de181471287fdd8b515a1a..742c92787ddf055ec0424977cf2692ac64b6903b 100644 (file)
 #include "dsdb/samdb/samdb.h"
 #include "dsdb/common/flags.h"
 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
+#include "libcli/security/security.h"
 
 struct libnet_BecomeDC_state {
        struct composite_context *creq;
 
        struct libnet_context *libnet;
 
+       struct dom_sid zero_sid;
+
        struct {
                struct cldap_socket *sock;
                struct cldap_netlogon io;
@@ -51,13 +54,17 @@ struct libnet_BecomeDC_state {
                struct dcerpc_pipe *pipe;
                struct drsuapi_DsBind bind_r;
                struct GUID bind_guid;
+               struct drsuapi_DsBindInfoCtr bind_info_ctr;
+               struct drsuapi_DsBindInfo28 local_info28;
+               struct drsuapi_DsBindInfo28 remote_info28;
                struct policy_handle bind_handle;
-       } drsuapi1;
+       } drsuapi1, drsuapi2, drsuapi3;
 
        struct {
                /* input */
                const char *dns_name;
                const char *netbios_name;
+               const struct dom_sid *sid;
 
                /* constructed */
                struct GUID guid;
@@ -95,6 +102,8 @@ struct libnet_BecomeDC_state {
                const char *computer_dn_str;
                const char *server_dn_str;
                const char *ntds_dn_str;
+               struct GUID ntds_guid;
+               struct GUID invocation_id;
                uint32_t user_account_control;
        } dest_dsa;
 
@@ -105,6 +114,19 @@ struct libnet_BecomeDC_state {
                uint32_t w2k3_update_revision;
        } ads_options;
 
+       struct becomeDC_partition {
+               struct drsuapi_DsReplicaObjectIdentifier nc;
+               struct GUID destination_dsa_guid;
+               struct GUID source_dsa_guid;
+               struct GUID source_dsa_invocation_id;
+               struct drsuapi_DsReplicaHighWaterMark highwatermark;
+               struct drsuapi_DsReplicaCoursorCtrEx *uptodateness_vector;
+               uint32_t replica_flags;
+
+               struct drsuapi_DsReplicaObjectListItemEx *first_object;
+               struct drsuapi_DsReplicaObjectListItemEx *last_object;
+       } schema_part, config_part, domain_part;
+
        struct becomeDC_fsmo {
                const char *dns_name;
                const char *server_dn_str;
@@ -333,7 +355,11 @@ static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state
        ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
                         "(objectClass=*)", attrs, &r);
        talloc_free(basedn);
-       if (ret != LDB_SUCCESS) {
+       if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+               /* w2k doesn't have this object */
+               s->ads_options.w2k3_update_revision = 0;
+               return NT_STATUS_OK;
+       } else if (ret != LDB_SUCCESS) {
                return NT_STATUS_LDAP(ret);
        } else if (r->count != 1) {
                talloc_free(r);
@@ -875,18 +901,25 @@ static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
 
        drsuapi->s = s;
 
-       binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[krb5,seal]", s->source_dsa.dns_name);
-       if (composite_nomem(binding_str, c)) return;
+       if (!drsuapi->binding) {
+               binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[krb5,seal]", s->source_dsa.dns_name);
+               if (composite_nomem(binding_str, c)) return;
 
-       c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
-       talloc_free(binding_str);
-       if (!composite_is_ok(c)) return;
+               c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
+               talloc_free(binding_str);
+               if (!composite_is_ok(c)) return;
+       }
 
        creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &dcerpc_table_drsuapi,
                                          s->libnet->cred, s->libnet->event_ctx);
        composite_continue(c, creq, recv_fn, s);
 }
 
+static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
+                                      struct becomeDC_drsuapi *drsuapi,
+                                      void (*recv_fn)(struct rpc_request *req));
+static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req);
+
 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
 {
        struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
@@ -896,9 +929,1032 @@ static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
        c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe);
        if (!composite_is_ok(c)) return;
 
+       becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv);
+}
+
+static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
+                                      struct becomeDC_drsuapi *drsuapi,
+                                      void (*recv_fn)(struct rpc_request *req))
+{
+       struct composite_context *c = s->creq;
+       struct rpc_request *req;
+       struct drsuapi_DsBindInfo28 *bind_info28;
+
+       GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid);
+
+       bind_info28                             = &drsuapi->local_info28;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
+       if (s->ads_options.domain_behavior_version == 2) {
+               /* TODO: find out how this is really triggered! */
+               bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
+       }
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_00100000;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
+#if 0 /* we don't support XPRESS compression yet */
+       bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
+#endif
+       bind_info28->site_guid                  = s->dest_dsa.site_guid;
+       if (s->ads_options.domain_behavior_version == 2) {
+               /* TODO: find out how this is really triggered! */
+               bind_info28->u1                         = 528;
+       } else {
+               bind_info28->u1                         = 516;
+       }
+       bind_info28->repl_epoch                 = 0;
+
+       drsuapi->bind_info_ctr.length           = 28;
+       drsuapi->bind_info_ctr.info.info28      = *bind_info28;
+
+       drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid;
+       drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr;
+       drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle;
+
+       req = dcerpc_drsuapi_DsBind_send(drsuapi->pipe, s, &drsuapi->bind_r);
+       composite_continue_rpc(c, req, recv_fn, s);
+}
+
+static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s,
+                                        struct becomeDC_drsuapi *drsuapi)
+{
+       if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) {
+               return drsuapi->bind_r.out.result;
+       }
+
+       ZERO_STRUCT(drsuapi->remote_info28);
+       if (drsuapi->bind_r.out.bind_info) {
+               switch (drsuapi->bind_r.out.bind_info->length) {
+               case 24: {
+                       struct drsuapi_DsBindInfo24 *info24;
+                       info24 = &drsuapi->bind_r.out.bind_info->info.info24;
+                       drsuapi->remote_info28.supported_extensions     = info24->supported_extensions;
+                       drsuapi->remote_info28.site_guid                = info24->site_guid;
+                       drsuapi->remote_info28.u1                       = info24->u1;
+                       drsuapi->remote_info28.repl_epoch               = 0;
+                       break;
+               }
+               case 28:
+                       drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28;
+                       break;
+               }
+       }
+
+       return WERR_OK;
+}
+
+static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s);
+
+static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+       WERROR status;
+
+       c->status = dcerpc_ndr_request_recv(req);
+       if (!composite_is_ok(c)) return;
+
+       status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1);
+       if (!W_ERROR_IS_OK(status)) {
+               composite_error(c, werror_to_ntstatus(status));
+               return;
+       }
+
+       becomeDC_drsuapi1_add_entry_send(s);
+}
+
+static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req);
+
+static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
+{
+       struct composite_context *c = s->creq;
+       struct rpc_request *req;
+       struct drsuapi_DsAddEntry *r;
+       struct drsuapi_DsReplicaObjectIdentifier *identifier;
+       uint32_t num_attrs, i = 0;
+       struct drsuapi_DsReplicaAttribute *attrs;
+       bool w2k3;
+
+       /* choose a random invocationId */
+       s->dest_dsa.invocation_id = GUID_random();
+
+       /*
+        * if the schema version indicates w2k3, then
+        * also send some w2k3 specific attributes
+        */
+       if (s->ads_options.schema_object_version >= 30) {
+               w2k3 = true;
+       } else {
+               w2k3 = false;
+       }
+
+       r = talloc_zero(s, struct drsuapi_DsAddEntry);
+       if (composite_nomem(r, c)) return;
+
+       /* setup identifier */
+       identifier              = talloc(r, struct drsuapi_DsReplicaObjectIdentifier);
+       if (composite_nomem(identifier, c)) return;
+       identifier->guid        = GUID_zero();
+       identifier->sid         = s->zero_sid;
+       identifier->dn          = talloc_asprintf(identifier, "CN=NTDS Settings,%s",
+                                                 s->dest_dsa.server_dn_str);
+       if (composite_nomem(identifier->dn, c)) return;
+
+       /* allocate attribute array */
+       num_attrs       = 11;
+       attrs           = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs);
+       if (composite_nomem(attrs, c)) return;
+
+       /* ntSecurityDescriptor */
+       {
+               struct drsuapi_DsAttributeValueSecurityDescriptor *vs;
+               struct security_descriptor *v;
+               struct dom_sid *domain_admins_sid;
+               const char *domain_admins_sid_str;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueSecurityDescriptor, 1);
+               if (composite_nomem(vs, c)) return;
+
+               domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS);
+               if (composite_nomem(domain_admins_sid, c)) return;
+
+               domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid);
+               if (composite_nomem(domain_admins_sid_str, c)) return;
+
+               v = security_descriptor_create(vs,
+                                              /* owner: domain admins */
+                                              domain_admins_sid_str,
+                                              /* owner group: domain admins */
+                                              domain_admins_sid_str,
+                                              /* authenticated users */
+                                              SID_NT_AUTHENTICATED_USERS,
+                                              SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                              SEC_STD_READ_CONTROL |
+                                              SEC_ADS_LIST |
+                                              SEC_ADS_READ_PROP |
+                                              SEC_ADS_LIST_OBJECT,
+                                              0,
+                                              /* domain admins */
+                                              domain_admins_sid_str,
+                                              SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                              SEC_STD_REQUIRED |
+                                              SEC_ADS_CREATE_CHILD |
+                                              SEC_ADS_LIST |
+                                              SEC_ADS_SELF_WRITE |
+                                              SEC_ADS_READ_PROP |
+                                              SEC_ADS_WRITE_PROP |
+                                              SEC_ADS_DELETE_TREE |
+                                              SEC_ADS_LIST_OBJECT |
+                                              SEC_ADS_CONTROL_ACCESS,
+                                              0,
+                                              /* system */
+                                              SID_NT_SYSTEM,
+                                              SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                              SEC_STD_REQUIRED |
+                                              SEC_ADS_CREATE_CHILD |
+                                              SEC_ADS_DELETE_CHILD |
+                                              SEC_ADS_LIST |
+                                              SEC_ADS_SELF_WRITE |
+                                              SEC_ADS_READ_PROP |
+                                              SEC_ADS_WRITE_PROP |
+                                              SEC_ADS_DELETE_TREE |
+                                              SEC_ADS_LIST_OBJECT |
+                                              SEC_ADS_CONTROL_ACCESS,
+                                              0,
+                                              /* end */
+                                              NULL);
+               if (composite_nomem(v, c)) return;
+
+               vs[0].sd                = v;
+
+               attrs[i].attid                                          = DRSUAPI_ATTRIBUTE_ntSecurityDescriptor;
+               attrs[i].value_ctr.security_descriptor.num_values       = 1;
+               attrs[i].value_ctr.security_descriptor.values           = vs;
+
+               i++;
+       }
+
+       /* objectClass: nTDSDSA */
+       {
+               struct drsuapi_DsAttributeValueObjectClassId *vs;
+               enum drsuapi_DsObjectClassId *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueObjectClassId, 1);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, enum drsuapi_DsObjectClassId, 1);
+               if (composite_nomem(v, c)) return;
+
+               /* value for nTDSDSA */
+               v[0]                    = 0x0017002F;
+
+               vs[0].objectClassId     = &v[0];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_objectClass;
+               attrs[i].value_ctr.object_class_id.num_values   = 1;
+               attrs[i].value_ctr.object_class_id.values       = vs;
+
+               i++;
+       }
+
+       /* objectCategory: CN=NTDS-DSA,CN=Schema,... */
+       {
+               struct drsuapi_DsAttributeValueDNString *vs;
+               struct drsuapi_DsReplicaObjectIdentifier3 *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 1);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 1);
+               if (composite_nomem(v, c)) return;
+
+               v[0].guid               = GUID_zero();
+               v[0].sid                = s->zero_sid;
+               v[0].dn                 = talloc_asprintf(v, "CN=NTDS-DSA,%s",
+                                                         s->forest.schema_dn_str);
+               if (composite_nomem(v->dn, c)) return;
+
+               vs[0].object            = &v[0];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_objectCategory;
+               attrs[i].value_ctr.dn_string.num_values         = 1;
+               attrs[i].value_ctr.dn_string.values             = vs;
+
+               i++;
+       }
+
+       /* invocationId: random guid */
+       {
+               struct drsuapi_DsAttributeValueGUID *vs;
+               struct GUID *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueGUID, 1);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, struct GUID, 1);
+               if (composite_nomem(v, c)) return;
+
+               v[0]                    = s->dest_dsa.invocation_id;
+
+               vs[0].guid              = &v[0];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_invocationId;
+               attrs[i].value_ctr.guid.num_values              = 1;
+               attrs[i].value_ctr.guid.values                  = vs;
+
+               i++;
+       }
+
+       /* hasMasterNCs: ... */
+       {
+               struct drsuapi_DsAttributeValueDNString *vs;
+               struct drsuapi_DsReplicaObjectIdentifier3 *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 3);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 3);
+               if (composite_nomem(v, c)) return;
+
+               v[0].guid               = GUID_zero();
+               v[0].sid                = s->zero_sid;
+               v[0].dn                 = s->forest.config_dn_str;
+
+               v[1].guid               = GUID_zero();
+               v[1].sid                = s->zero_sid;
+               v[1].dn                 = s->domain.dn_str;
+
+               v[2].guid               = GUID_zero();
+               v[2].sid                = s->zero_sid;
+               v[2].dn                 = s->forest.schema_dn_str;
+
+               vs[0].object            = &v[0];
+               vs[1].object            = &v[1];
+               vs[2].object            = &v[2];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_hasMasterNCs;
+               attrs[i].value_ctr.dn_string.num_values         = 3;
+               attrs[i].value_ctr.dn_string.values             = vs;
+
+               i++;
+       }
+
+       /* msDS-hasMasterNCs: ... */
+       if (w2k3) {
+               struct drsuapi_DsAttributeValueDNString *vs;
+               struct drsuapi_DsReplicaObjectIdentifier3 *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 3);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 3);
+               if (composite_nomem(v, c)) return;
+
+               v[0].guid               = GUID_zero();
+               v[0].sid                = s->zero_sid;
+               v[0].dn                 = s->forest.config_dn_str;
+
+               v[1].guid               = GUID_zero();
+               v[1].sid                = s->zero_sid;
+               v[1].dn                 = s->domain.dn_str;
+
+               v[2].guid               = GUID_zero();
+               v[2].sid                = s->zero_sid;
+               v[2].dn                 = s->forest.schema_dn_str;
+
+               vs[0].object            = &v[0];
+               vs[1].object            = &v[1];
+               vs[2].object            = &v[2];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_msDS_hasMasterNCs;
+               attrs[i].value_ctr.dn_string.num_values         = 3;
+               attrs[i].value_ctr.dn_string.values             = vs;
+
+               i++;
+       }
+
+       /* dMDLocation: CN=Schema,... */
+       {
+               struct drsuapi_DsAttributeValueDNString *vs;
+               struct drsuapi_DsReplicaObjectIdentifier3 *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 1);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 1);
+               if (composite_nomem(v, c)) return;
+
+               v[0].guid               = GUID_zero();
+               v[0].sid                = s->zero_sid;
+               v[0].dn                 = s->forest.schema_dn_str;
+
+               vs[0].object            = &v[0];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_dMDLocation;
+               attrs[i].value_ctr.dn_string.num_values         = 1;
+               attrs[i].value_ctr.dn_string.values             = vs;
+
+               i++;
+       }
+
+       /* msDS-HasDomainNCs: <domain_partition> */
+       if (w2k3) {
+               struct drsuapi_DsAttributeValueDNString *vs;
+               struct drsuapi_DsReplicaObjectIdentifier3 *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 1);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 1);
+               if (composite_nomem(v, c)) return;
+
+               v[0].guid               = GUID_zero();
+               v[0].sid                = s->zero_sid;
+               v[0].dn                 = s->domain.dn_str;
+
+               vs[0].object            = &v[0];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_msDS_HasDomainNCs;
+               attrs[i].value_ctr.dn_string.num_values         = 1;
+               attrs[i].value_ctr.dn_string.values             = vs;
+
+               i++;
+       }
+
+       /* msDS-Behavior-Version */
+       if (w2k3) {
+               struct drsuapi_DsAttributeValueUINT32 *vs;
+               uint32_t *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueUINT32, 1);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, uint32_t, 1);
+               if (composite_nomem(v, c)) return;
+
+               v[0]                    = DS_BEHAVIOR_WIN2003;
+
+               vs[0].value             = &v[0];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_msDS_Behavior_Version;
+               attrs[i].value_ctr.uint32.num_values            = 1;
+               attrs[i].value_ctr.uint32.values                = vs;
+
+               i++;
+       }
+
+       /* systemFlags */
+       {
+               struct drsuapi_DsAttributeValueUINT32 *vs;
+               uint32_t *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueUINT32, 1);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, uint32_t, 1);
+               if (composite_nomem(v, c)) return;
+
+               v[0]                    = SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE;
+
+               vs[0].value             = &v[0];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_systemFlags;
+               attrs[i].value_ctr.uint32.num_values            = 1;
+               attrs[i].value_ctr.uint32.values                = vs;
+
+               i++;
+       }
+
+       /* serverReference: ... */
+       {
+               struct drsuapi_DsAttributeValueDNString *vs;
+               struct drsuapi_DsReplicaObjectIdentifier3 *v;
+
+               vs = talloc_array(attrs, struct drsuapi_DsAttributeValueDNString, 1);
+               if (composite_nomem(vs, c)) return;
+
+               v = talloc_array(vs, struct drsuapi_DsReplicaObjectIdentifier3, 1);
+               if (composite_nomem(v, c)) return;
+
+               v[0].guid               = GUID_zero();
+               v[0].sid                = s->zero_sid;
+               v[0].dn                 = s->dest_dsa.computer_dn_str;
+
+               vs[0].object            = &v[0];
+
+               attrs[i].attid                                  = DRSUAPI_ATTRIBUTE_serverReference;
+               attrs[i].value_ctr.dn_string.num_values         = 1;
+               attrs[i].value_ctr.dn_string.values             = vs;
+
+               i++;
+       }
+
+       /* truncate the attribute list to the attribute count we have filled in */
+       num_attrs = i;
+
+       /* setup request structure */
+       r->in.bind_handle                                               = &s->drsuapi1.bind_handle;
+       r->in.level                                                     = 2;
+       r->in.req.req2.first_object.next_object                         = NULL;
+       r->in.req.req2.first_object.object.identifier                   = identifier;
+       r->in.req.req2.first_object.object.unknown1                     = 0x00000000;   
+       r->in.req.req2.first_object.object.attribute_ctr.num_attributes = num_attrs;
+       r->in.req.req2.first_object.object.attribute_ctr.attributes     = attrs;
+
+       req = dcerpc_drsuapi_DsAddEntry_send(s->drsuapi1.pipe, r, r);
+       composite_continue_rpc(c, req, becomeDC_drsuapi1_add_entry_recv, s);
+}
+
+static void becomeDC_drsuapi2_connect_recv(struct composite_context *req);
+
+static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+       struct drsuapi_DsAddEntry *r = talloc_get_type(req->ndr.struct_ptr,
+                                      struct drsuapi_DsAddEntry);
+
+       c->status = dcerpc_ndr_request_recv(req);
+       if (!composite_is_ok(c)) return;
+
+       if (!W_ERROR_IS_OK(r->out.result)) {
+               composite_error(c, werror_to_ntstatus(r->out.result));
+               return;
+       }
+
+       if (r->out.level == 3) {
+               if (r->out.ctr.ctr3.count != 1) {
+                       WERROR status;
+
+                       if (r->out.ctr.ctr3.level != 1) {
+                               composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
+                               return;
+                       }
+
+                       if (!r->out.ctr.ctr3.error) {
+                               composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
+                               return;
+                       }
+
+                       status = r->out.ctr.ctr3.error->info1.status;
+
+                       if (!r->out.ctr.ctr3.error->info1.info) {
+                               composite_error(c, werror_to_ntstatus(status));
+                               return;
+                       }
+
+                       /* see if we can get a more detailed error */
+                       switch (r->out.ctr.ctr3.error->info1.level) {
+                       case 1:
+                               status = r->out.ctr.ctr3.error->info1.info->error1.status;
+                               break;
+                       case 4:
+                       case 5:
+                       case 6:
+                       case 7:
+                               status = r->out.ctr.ctr3.error->info1.info->errorX.status;
+                               break;
+                       }
+
+                       composite_error(c, werror_to_ntstatus(status));
+                       return;
+               }
+
+               s->dest_dsa.ntds_guid   = r->out.ctr.ctr3.objects[0].guid;
+       } else if (r->out.level == 2) {
+               if (r->out.ctr.ctr2.count != 1) {
+                       composite_error(c, werror_to_ntstatus(r->out.ctr.ctr2.error.status));
+                       return;
+               }
+
+               s->dest_dsa.ntds_guid   = r->out.ctr.ctr2.objects[0].guid;
+       } else {
+               composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
+               return;
+       }
+
+       talloc_free(r);
+
+       becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv);
+}
+
+static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req);
+
+static void becomeDC_drsuapi2_connect_recv(struct composite_context *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+
+       c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe);
+       if (!composite_is_ok(c)) return;
+
+       becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv);
+}
+
+static void becomeDC_drsuapi3_connect_recv(struct composite_context *req);
+
+static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+       char *binding_str;
+       WERROR status;
+
+       c->status = dcerpc_ndr_request_recv(req);
+       if (!composite_is_ok(c)) return;
+
+       status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2);
+       if (!W_ERROR_IS_OK(status)) {
+               composite_error(c, werror_to_ntstatus(status));
+               return;
+       }
+
+       /* this avoids the epmapper lookup on the 2nd connection */
+       binding_str = dcerpc_binding_string(s, s->drsuapi2.binding);
+       if (composite_nomem(binding_str, c)) return;
+
+       c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi3.binding);
+       talloc_free(binding_str);
+       if (!composite_is_ok(c)) return;
+
+       becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv);
+}
+
+static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s);
+
+static void becomeDC_drsuapi3_connect_recv(struct composite_context *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+
+       c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe);
+       if (!composite_is_ok(c)) return;
+
+       becomeDC_drsuapi3_pull_schema_send(s);
+}
+
+static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s,
+                                                struct becomeDC_drsuapi *drsuapi_h,
+                                                struct becomeDC_drsuapi *drsuapi_p,
+                                                struct becomeDC_partition *partition,
+                                                void (*recv_fn)(struct rpc_request *req))
+{
+       struct composite_context *c = s->creq;
+       struct rpc_request *req;
+       struct drsuapi_DsGetNCChanges *r;
+
+       r = talloc(s, struct drsuapi_DsGetNCChanges);
+       if (composite_nomem(r, c)) return;
+
+       r->in.bind_handle       = &drsuapi_h->bind_handle;
+       if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) {
+               r->in.level                             = 8;
+               r->in.req.req8.destination_dsa_guid     = partition->destination_dsa_guid;
+               r->in.req.req8.source_dsa_invocation_id = partition->source_dsa_invocation_id;
+               r->in.req.req8.naming_context           = &partition->nc;
+               r->in.req.req8.highwatermark            = partition->highwatermark;
+               r->in.req.req8.uptodateness_vector      = partition->uptodateness_vector;
+               r->in.req.req8.replica_flags            = partition->replica_flags;
+               r->in.req.req8.max_object_count         = 133;
+               r->in.req.req8.max_ndr_size             = 1336811;
+               r->in.req.req8.unknown4                 = 0;
+               r->in.req.req8.h1                       = 0;
+               r->in.req.req8.unique_ptr1              = 0;
+               r->in.req.req8.unique_ptr2              = 0;
+               r->in.req.req8.mapping_ctr.num_mappings = 0;
+               r->in.req.req8.mapping_ctr.mappings     = NULL;
+       } else {
+               r->in.level                             = 5;
+               r->in.req.req5.destination_dsa_guid     = partition->destination_dsa_guid;
+               r->in.req.req5.source_dsa_invocation_id = partition->source_dsa_invocation_id;
+               r->in.req.req5.naming_context           = &partition->nc;
+               r->in.req.req5.highwatermark            = partition->highwatermark;
+               r->in.req.req5.uptodateness_vector      = partition->uptodateness_vector;
+               r->in.req.req5.replica_flags            = partition->replica_flags;
+               r->in.req.req5.max_object_count         = 133;
+               r->in.req.req5.max_ndr_size             = 1336770;
+               r->in.req.req5.unknown4                 = 0;
+               r->in.req.req5.h1                       = 0;
+       }
+
+DEBUG(0,("start NC[%s] tmp_highest_usn[%llu] highest_usn[%llu]\n",
+       partition->nc.dn,
+       partition->highwatermark.tmp_highest_usn,
+       partition->highwatermark.highest_usn));
+
+       /* 
+        * we should try to use the drsuapi_p->pipe here, as w2k3 does
+        * but it seems that some extra flags in the DCERPC Bind call
+        * are needed for it. Or the same KRB5 TGS is needed on both
+        * connections.
+        */
+       req = dcerpc_drsuapi_DsGetNCChanges_send(drsuapi_h->pipe, r, r);
+       composite_continue_rpc(c, req, recv_fn, s);
+}
+
+static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s,
+                                                  struct becomeDC_partition *partition,
+                                                  struct drsuapi_DsGetNCChanges *r)
+{
+       struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
+       struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
+       uint32_t out_level = 0;
+       struct GUID *source_dsa_guid;
+       struct GUID *source_dsa_invocation_id;
+       struct drsuapi_DsReplicaHighWaterMark *new_highwatermark;
+       struct drsuapi_DsReplicaObjectListItemEx *first_object;
+       struct drsuapi_DsReplicaObjectListItemEx *cur;
+
+       if (!W_ERROR_IS_OK(r->out.result)) {
+               return r->out.result;
+       }
+
+       if (r->out.level == 1) {
+               out_level = 1;
+               ctr1 = &r->out.ctr.ctr1;
+       } else if (r->out.level == 2) {
+               out_level = 1;
+               ctr1 = r->out.ctr.ctr2.ctr.mszip1.ctr1;
+       } else if (r->out.level == 6) {
+               out_level = 6;
+               ctr6 = &r->out.ctr.ctr6;
+       } else if (r->out.level == 7 &&
+                  r->out.ctr.ctr7.level == 6 &&
+                  r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP) {
+               out_level = 6;
+               ctr6 = r->out.ctr.ctr7.ctr.mszip6.ctr6;
+       } else {
+               return WERR_BAD_NET_RESP;
+       }
+
+       switch (out_level) {
+       case 1:
+               source_dsa_guid                 = &ctr1->source_dsa_guid;
+               source_dsa_invocation_id        = &ctr1->source_dsa_invocation_id;
+               new_highwatermark               = &ctr1->new_highwatermark;
+               first_object                    = ctr1->first_object;
+               break;
+       case 6:
+               source_dsa_guid                 = &ctr6->source_dsa_guid;
+               source_dsa_invocation_id        = &ctr6->source_dsa_invocation_id;
+               new_highwatermark               = &ctr6->new_highwatermark;
+               first_object                    = ctr6->first_object;
+               break;
+       }
+
+       partition->highwatermark                = *new_highwatermark;
+       partition->source_dsa_guid              = *source_dsa_guid;
+       partition->source_dsa_invocation_id     = *source_dsa_invocation_id;
+
+       if (!partition->first_object) {
+               partition->first_object = talloc_steal(s, first_object);
+       } else {
+               partition->last_object->next_object = talloc_steal(partition->last_object,
+                                                                  first_object);
+       }
+       for (cur = first_object; cur->next_object; cur = cur->next_object) {}
+       partition->last_object = cur;
+
+DEBUG(0,("end NC[%s] tmp_highest_usn[%llu] highest_usn[%llu]\n",
+       partition->nc.dn,
+       partition->highwatermark.tmp_highest_usn,
+       partition->highwatermark.highest_usn));
+
+       return WERR_OK;
+}
+
+static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req);
+
+static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s)
+{
+       s->schema_part.nc.guid  = GUID_zero();
+       s->schema_part.nc.sid   = s->zero_sid;
+       s->schema_part.nc.dn    = s->forest.schema_dn_str;
+
+       s->schema_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
+
+       s->schema_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
+
+       becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
+                                            becomeDC_drsuapi3_pull_schema_recv);
+}
+
+static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s);
+
+static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+       struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
+                                          struct drsuapi_DsGetNCChanges);
+       WERROR status;
+
+       c->status = dcerpc_ndr_request_recv(req);
+       if (!composite_is_ok(c)) return;
+
+       status = becomeDC_drsuapi_pull_partition_recv(s, &s->schema_part, r);
+       if (!W_ERROR_IS_OK(status)) {
+               composite_error(c, werror_to_ntstatus(status));
+               return;
+       }
+
+       talloc_free(r);
+
+       if (s->schema_part.highwatermark.tmp_highest_usn > s->schema_part.highwatermark.highest_usn) {
+               becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
+                                                    becomeDC_drsuapi3_pull_schema_recv);
+               return;
+       }
+
+       becomeDC_drsuapi3_pull_config_send(s);
+}
+
+static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req);
+
+static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s)
+{
+       s->config_part.nc.guid  = GUID_zero();
+       s->config_part.nc.sid   = s->zero_sid;
+       s->config_part.nc.dn    = s->forest.config_dn_str;
+
+       s->config_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
+
+       s->config_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
+
+       becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
+                                            becomeDC_drsuapi3_pull_config_recv);
+}
+
+static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+       struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
+                                          struct drsuapi_DsGetNCChanges);
+       WERROR status;
+
+       c->status = dcerpc_ndr_request_recv(req);
+       if (!composite_is_ok(c)) return;
+
+       status = becomeDC_drsuapi_pull_partition_recv(s, &s->config_part, r);
+       if (!W_ERROR_IS_OK(status)) {
+               composite_error(c, werror_to_ntstatus(status));
+               return;
+       }
+
+       talloc_free(r);
+
+       if (s->config_part.highwatermark.tmp_highest_usn > s->config_part.highwatermark.highest_usn) {
+               becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
+                                                    becomeDC_drsuapi3_pull_config_recv);
+               return;
+       }
+
        becomeDC_connect_ldap2(s);
 }
 
+static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req);
+
+static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s)
+{
+       s->domain_part.nc.guid  = GUID_zero();
+       s->domain_part.nc.sid   = s->zero_sid;
+       s->domain_part.nc.dn    = s->domain.dn_str;
+
+       s->domain_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
+
+       s->domain_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
+                                       | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
+
+       becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
+                                            becomeDC_drsuapi3_pull_domain_recv);
+}
+
+static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
+                                             struct becomeDC_drsuapi *drsuapi,
+                                             struct becomeDC_partition *partition,
+                                             void (*recv_fn)(struct rpc_request *req));
+static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req);
+
+static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+       struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
+                                          struct drsuapi_DsGetNCChanges);
+       WERROR status;
+
+       c->status = dcerpc_ndr_request_recv(req);
+       if (!composite_is_ok(c)) return;
+
+       status = becomeDC_drsuapi_pull_partition_recv(s, &s->domain_part, r);
+       if (!W_ERROR_IS_OK(status)) {
+               composite_error(c, werror_to_ntstatus(status));
+               return;
+       }
+
+       talloc_free(r);
+
+       if (s->domain_part.highwatermark.tmp_highest_usn > s->domain_part.highwatermark.highest_usn) {
+               becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
+                                                    becomeDC_drsuapi3_pull_domain_recv);
+               return;
+       }
+
+       becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->schema_part,
+                                         becomeDC_drsuapi2_update_refs_schema_recv);
+}
+
+static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
+                                             struct becomeDC_drsuapi *drsuapi,
+                                             struct becomeDC_partition *partition,
+                                             void (*recv_fn)(struct rpc_request *req))
+{
+       struct composite_context *c = s->creq;
+       struct rpc_request *req;
+       struct drsuapi_DsReplicaUpdateRefs *r;
+       const char *ntds_guid_str;
+       const char *ntds_dns_name;
+
+       r = talloc(s, struct drsuapi_DsReplicaUpdateRefs);
+       if (composite_nomem(r, c)) return;
+
+       ntds_guid_str = GUID_string(r, &s->dest_dsa.ntds_guid);
+       if (composite_nomem(ntds_guid_str, c)) return;
+
+       ntds_dns_name = talloc_asprintf(r, "%s._msdcs.%s",
+                                       ntds_guid_str,
+                                       s->domain.dns_name);
+       if (composite_nomem(ntds_dns_name, c)) return;
+
+       r->in.bind_handle               = &drsuapi->bind_handle;
+       r->in.level                     = 1;
+       r->in.req.req1.naming_context   = &partition->nc;
+       r->in.req.req1.dest_dsa_dns_name= ntds_dns_name;
+       r->in.req.req1.dest_dsa_guid    = s->dest_dsa.ntds_guid;
+       r->in.req.req1.options          = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
+                                       | DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
+                                       | DRSUAPI_DS_REPLICA_UPDATE_0x00000010;
+
+       req = dcerpc_drsuapi_DsReplicaUpdateRefs_send(drsuapi->pipe, r, r);
+       composite_continue_rpc(c, req, recv_fn, s);
+}
+
+static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req);
+
+static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+       struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
+                                          struct drsuapi_DsReplicaUpdateRefs);
+
+       c->status = dcerpc_ndr_request_recv(req);
+       if (!composite_is_ok(c)) return;
+
+       if (!W_ERROR_IS_OK(r->out.result)) {
+               composite_error(c, werror_to_ntstatus(r->out.result));
+               return;
+       }
+
+       talloc_free(r);
+
+       becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->config_part,
+                                         becomeDC_drsuapi2_update_refs_config_recv);
+}
+
+static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req);
+
+static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+       struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
+                                          struct drsuapi_DsReplicaUpdateRefs);
+
+       c->status = dcerpc_ndr_request_recv(req);
+       if (!composite_is_ok(c)) return;
+
+       if (!W_ERROR_IS_OK(r->out.result)) {
+               composite_error(c, werror_to_ntstatus(r->out.result));
+               return;
+       }
+
+       talloc_free(r);
+
+       becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->domain_part,
+                                         becomeDC_drsuapi2_update_refs_domain_recv);
+}
+
+static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req)
+{
+       struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
+                                         struct libnet_BecomeDC_state);
+       struct composite_context *c = s->creq;
+       struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
+                                          struct drsuapi_DsReplicaUpdateRefs);
+
+       c->status = dcerpc_ndr_request_recv(req);
+       if (!composite_is_ok(c)) return;
+
+       if (!W_ERROR_IS_OK(r->out.result)) {
+               composite_error(c, werror_to_ntstatus(r->out.result));
+               return;
+       }
+
+       talloc_free(r);
+
+       /* TODO: use DDNS updates and register dns names */
+       composite_done(c);
+}
+
 static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s)
 {
        int ret;
@@ -984,11 +2040,16 @@ static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s)
        }
 
        ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn);
-       talloc_free(r);
        if (ret != LDB_SUCCESS) {
+               talloc_free(r);
                return NT_STATUS_LDAP(ret);
        }
 
+       s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
+       NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
+
+       talloc_free(r);
+
        return NT_STATUS_OK;
 }
 
@@ -1005,7 +2066,7 @@ static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s)
        c->status = becomeDC_ldap2_move_computer(s);
        if (!composite_is_ok(c)) return;
 
-       composite_error(c, NT_STATUS_NOT_IMPLEMENTED);
+       becomeDC_drsuapi3_pull_domain_send(s);
 }
 
 struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
@@ -1028,6 +2089,8 @@ struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLO
        if (composite_nomem(s->domain.dns_name, c)) return c;
        s->domain.netbios_name  = talloc_strdup(s, r->in.domain_netbios_name);
        if (composite_nomem(s->domain.netbios_name, c)) return c;
+       s->domain.sid           = dom_sid_dup(s, r->in.domain_sid);
+       if (composite_nomem(s->domain.sid, c)) return c;
 
        /* Source DSA input */
        s->source_dsa.address   = talloc_strdup(s, r->in.source_dsa_address);