56a0fccde4cabf6b49da00aa1b630c2eea93cc32
[kai/samba-autobuild/.git] / source4 / torture / rpc / testjoin.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    utility code to join/leave a domain
5
6    Copyright (C) Andrew Tridgell 2004
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /*
23   this code is used by other torture modules to join/leave a domain
24   as either a member, bdc or thru a trust relationship
25 */
26
27 #include "includes.h"
28 #include "torture/torture.h"
29 #include "system/time.h"
30 #include "lib/crypto/crypto.h"
31 #include "libnet/libnet.h"
32 #include "lib/cmdline/popt_common.h"
33 #include "lib/ldb/include/ldb.h"
34 #include "librpc/gen_ndr/ndr_samr_c.h"
35
36 #include "libcli/auth/libcli_auth.h"
37 #include "torture/rpc/rpc.h"
38 #include "libcli/security/security.h"
39
40 struct test_join {
41         struct dcerpc_pipe *p;
42         struct policy_handle user_handle;
43         struct libnet_JoinDomain *libnet_r;
44         struct dom_sid *dom_sid;
45         const char *dom_netbios_name;
46         const char *dom_dns_name;
47         struct dom_sid *user_sid;
48         struct GUID user_guid;
49         const char *netbios_name;
50 };
51
52
53 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, 
54                                   struct policy_handle *handle, const char *name)
55 {
56         NTSTATUS status;
57         struct samr_DeleteUser d;
58         struct policy_handle user_handle;
59         uint32_t rid;
60         struct samr_LookupNames n;
61         struct lsa_String sname;
62         struct samr_OpenUser r;
63
64         sname.string = name;
65
66         n.in.domain_handle = handle;
67         n.in.num_names = 1;
68         n.in.names = &sname;
69
70         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
71         if (NT_STATUS_IS_OK(status)) {
72                 rid = n.out.rids.ids[0];
73         } else {
74                 return status;
75         }
76
77         r.in.domain_handle = handle;
78         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
79         r.in.rid = rid;
80         r.out.user_handle = &user_handle;
81
82         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
83         if (!NT_STATUS_IS_OK(status)) {
84                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
85                 return status;
86         }
87
88         d.in.user_handle = &user_handle;
89         d.out.user_handle = &user_handle;
90         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
91         if (!NT_STATUS_IS_OK(status)) {
92                 return status;
93         }
94
95         return NT_STATUS_OK;
96 }
97
98 /*
99   create a test user in the domain
100   an opaque pointer is returned. Pass it to torture_leave_domain() 
101   when finished
102 */
103
104 struct test_join *torture_create_testuser(struct torture_context *torture,
105                                           const char *username, 
106                                           const char *domain,
107                                           uint16_t acct_type,
108                                           const char **random_password)
109 {
110         NTSTATUS status;
111         struct samr_Connect c;
112         struct samr_CreateUser2 r;
113         struct samr_OpenDomain o;
114         struct samr_LookupDomain l;
115         struct samr_GetUserPwInfo pwp;
116         struct samr_SetUserInfo s;
117         union samr_UserInfo u;
118         struct policy_handle handle;
119         struct policy_handle domain_handle;
120         uint32_t access_granted;
121         uint32_t rid;
122         DATA_BLOB session_key;
123         struct lsa_String name;
124         
125         int policy_min_pw_len = 0;
126         struct test_join *join;
127         char *random_pw;
128         const char *dc_binding = lp_parm_string(-1, "torture", "dc_binding");
129
130         join = talloc(NULL, struct test_join);
131         if (join == NULL) {
132                 return NULL;
133         }
134
135         ZERO_STRUCTP(join);
136
137         printf("Connecting to SAMR\n");
138         
139         if (dc_binding) {
140                 status = dcerpc_pipe_connect(join,
141                                              &join->p,
142                                              dc_binding,
143                                              &ndr_table_samr,
144                                              cmdline_credentials, NULL);
145                                              
146         } else {
147                 status = torture_rpc_connection(torture, 
148                                                 &join->p, 
149                                                 &ndr_table_samr);
150         }
151         if (!NT_STATUS_IS_OK(status)) {
152                 return NULL;
153         }
154
155         c.in.system_name = NULL;
156         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
157         c.out.connect_handle = &handle;
158
159         status = dcerpc_samr_Connect(join->p, join, &c);
160         if (!NT_STATUS_IS_OK(status)) {
161                 const char *errstr = nt_errstr(status);
162                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
163                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
164                 }
165                 printf("samr_Connect failed - %s\n", errstr);
166                 return NULL;
167         }
168
169         printf("Opening domain %s\n", domain);
170
171         name.string = domain;
172         l.in.connect_handle = &handle;
173         l.in.domain_name = &name;
174
175         status = dcerpc_samr_LookupDomain(join->p, join, &l);
176         if (!NT_STATUS_IS_OK(status)) {
177                 printf("LookupDomain failed - %s\n", nt_errstr(status));
178                 goto failed;
179         }
180
181         talloc_steal(join, l.out.sid);
182         join->dom_sid = l.out.sid;
183         join->dom_netbios_name = talloc_strdup(join, domain);
184         if (!join->dom_netbios_name) goto failed;
185
186         o.in.connect_handle = &handle;
187         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
188         o.in.sid = l.out.sid;
189         o.out.domain_handle = &domain_handle;
190
191         status = dcerpc_samr_OpenDomain(join->p, join, &o);
192         if (!NT_STATUS_IS_OK(status)) {
193                 printf("OpenDomain failed - %s\n", nt_errstr(status));
194                 goto failed;
195         }
196
197         printf("Creating account %s\n", username);
198
199 again:
200         name.string = username;
201         r.in.domain_handle = &domain_handle;
202         r.in.account_name = &name;
203         r.in.acct_flags = acct_type;
204         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
205         r.out.user_handle = &join->user_handle;
206         r.out.access_granted = &access_granted;
207         r.out.rid = &rid;
208
209         status = dcerpc_samr_CreateUser2(join->p, join, &r);
210
211         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
212                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
213                 if (NT_STATUS_IS_OK(status)) {
214                         goto again;
215                 }
216         }
217
218         if (!NT_STATUS_IS_OK(status)) {
219                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
220                 goto failed;
221         }
222
223         join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
224
225         pwp.in.user_handle = &join->user_handle;
226
227         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
228         if (NT_STATUS_IS_OK(status)) {
229                 policy_min_pw_len = pwp.out.info.min_password_length;
230         }
231
232         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
233
234         printf("Setting account password '%s'\n", random_pw);
235
236         ZERO_STRUCT(u);
237         s.in.user_handle = &join->user_handle;
238         s.in.info = &u;
239         s.in.level = 24;
240
241         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
242         u.info24.pw_len = strlen(random_pw);
243
244         status = dcerpc_fetch_session_key(join->p, &session_key);
245         if (!NT_STATUS_IS_OK(status)) {
246                 printf("SetUserInfo level %u - no session key - %s\n",
247                        s.in.level, nt_errstr(status));
248                 torture_leave_domain(join);
249                 goto failed;
250         }
251
252         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
253
254         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
255         if (!NT_STATUS_IS_OK(status)) {
256                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
257                 goto failed;
258         }
259
260         ZERO_STRUCT(u);
261         s.in.user_handle = &join->user_handle;
262         s.in.info = &u;
263         s.in.level = 21;
264
265         u.info21.acct_flags = acct_type | ACB_PWNOEXP;
266         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
267
268         u.info21.comment.string = talloc_asprintf(join, 
269                                                   "Tortured by Samba4: %s", 
270                                                   timestring(join, time(NULL)));
271         
272         u.info21.full_name.string = talloc_asprintf(join, 
273                                                     "Torture account for Samba4: %s", 
274                                                     timestring(join, time(NULL)));
275         
276         u.info21.description.string = talloc_asprintf(join, 
277                                          "Samba4 torture account created by host %s: %s", 
278                                          lp_netbios_name(), timestring(join, time(NULL)));
279
280         printf("Resetting ACB flags, force pw change time\n");
281
282         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
283         if (!NT_STATUS_IS_OK(status)) {
284                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
285                 goto failed;
286         }
287
288         if (random_password) {
289                 *random_password = random_pw;
290         }
291
292         return join;
293
294 failed:
295         torture_leave_domain(join);
296         return NULL;
297 }
298
299
300 _PUBLIC_ struct test_join *torture_join_domain(const char *machine_name, 
301                                       uint32_t acct_flags,
302                                       struct cli_credentials **machine_credentials)
303 {
304         NTSTATUS status;
305         struct libnet_context *libnet_ctx;
306         struct libnet_JoinDomain *libnet_r;
307         struct test_join *tj;
308         struct samr_SetUserInfo s;
309         union samr_UserInfo u;
310         
311         tj = talloc(NULL, struct test_join);
312         if (!tj) return NULL;
313
314         libnet_r = talloc(tj, struct libnet_JoinDomain);
315         if (!libnet_r) {
316                 talloc_free(tj);
317                 return NULL;
318         }
319         
320         libnet_ctx = libnet_context_init(NULL); 
321         if (!libnet_ctx) {
322                 talloc_free(tj);
323                 return NULL;
324         }
325         
326         tj->libnet_r = libnet_r;
327                 
328         libnet_ctx->cred = cmdline_credentials;
329         libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
330         if (!libnet_r->in.binding) {
331                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(-1, "torture", "host"));
332         }
333         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
334         libnet_r->in.netbios_name = machine_name;
335         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
336         if (!libnet_r->in.account_name) {
337                 talloc_free(tj);
338                 return NULL;
339         }
340         
341         libnet_r->in.acct_type = acct_flags;
342         libnet_r->in.recreate_account = True;
343
344         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
345         if (!NT_STATUS_IS_OK(status)) {
346                 if (libnet_r->out.error_string) {
347                         DEBUG(0, ("Domain join failed - %s\n", libnet_r->out.error_string));
348                 } else {
349                         DEBUG(0, ("Domain join failed - %s\n", nt_errstr(status)));
350                 }
351                 talloc_free(tj);
352                 return NULL;
353         }
354         tj->p = libnet_r->out.samr_pipe;
355         tj->user_handle = *libnet_r->out.user_handle;
356         tj->dom_sid = libnet_r->out.domain_sid;
357         talloc_steal(tj, libnet_r->out.domain_sid);
358         tj->dom_netbios_name    = libnet_r->out.domain_name;
359         talloc_steal(tj, libnet_r->out.domain_name);
360         tj->dom_dns_name        = libnet_r->out.realm;
361         talloc_steal(tj, libnet_r->out.realm);
362         tj->user_guid = libnet_r->out.account_guid;
363         tj->netbios_name = talloc_strdup(tj, machine_name);
364         if (!tj->netbios_name) {
365                 talloc_free(tj);
366                 return NULL;
367         }
368
369         ZERO_STRUCT(u);
370         s.in.user_handle = &tj->user_handle;
371         s.in.info = &u;
372         s.in.level = 21;
373
374         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
375         u.info21.comment.string = talloc_asprintf(tj, 
376                                                   "Tortured by Samba4: %s", 
377                                                   timestring(tj, time(NULL)));
378         u.info21.full_name.string = talloc_asprintf(tj, 
379                                                     "Torture account for Samba4: %s", 
380                                                     timestring(tj, time(NULL)));
381         
382         u.info21.description.string = talloc_asprintf(tj, 
383                                                       "Samba4 torture account created by host %s: %s", 
384                                                       lp_netbios_name(), timestring(tj, time(NULL)));
385
386         status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
387         if (!NT_STATUS_IS_OK(status)) {
388                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
389         }
390
391         *machine_credentials = cli_credentials_init(tj);
392         cli_credentials_set_conf(*machine_credentials);
393         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
394         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
395         if (libnet_r->out.realm) {
396                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
397         }
398         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
399         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
400         if (acct_flags & ACB_SVRTRUST) {
401                 cli_credentials_set_secure_channel_type(*machine_credentials,
402                                                         SEC_CHAN_BDC);
403         } else if (acct_flags & ACB_WSTRUST) {
404                 cli_credentials_set_secure_channel_type(*machine_credentials,
405                                                         SEC_CHAN_WKSTA);
406         } else {
407                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
408                 talloc_free(*machine_credentials);
409                 return NULL;
410         }
411
412         return tj;
413 }
414
415 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join) 
416 {
417         return join->p;
418 }
419
420 struct policy_handle *torture_join_samr_user_policy(struct test_join *join) 
421 {
422         return &join->user_handle;
423 }
424
425 static NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
426 {
427         int rtn;
428         TALLOC_CTX *tmp_ctx;
429
430         struct ldb_dn *server_dn;
431         struct ldb_context *ldb_ctx;
432
433         char *remote_ldb_url; 
434          
435         /* Check if we are a domain controller. If not, exit. */
436         if (!libnet_r->out.server_dn_str) {
437                 return NT_STATUS_OK;
438         }
439
440         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
441         if (!tmp_ctx) {
442                 libnet_r->out.error_string = NULL;
443                 return NT_STATUS_NO_MEMORY;
444         }
445
446         ldb_ctx = ldb_init(tmp_ctx);
447         if (!ldb_ctx) {
448                 libnet_r->out.error_string = NULL;
449                 talloc_free(tmp_ctx);
450                 return NT_STATUS_NO_MEMORY;
451         }
452
453         /* Remove CN=Servers,... entry from the AD. */ 
454         server_dn = ldb_dn_new(tmp_ctx, ldb_ctx, libnet_r->out.server_dn_str);
455         if (! ldb_dn_validate(server_dn)) {
456                 libnet_r->out.error_string = NULL;
457                 talloc_free(tmp_ctx);
458                 return NT_STATUS_NO_MEMORY;
459         }
460
461         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
462         if (!remote_ldb_url) {
463                 libnet_r->out.error_string = NULL;
464                 talloc_free(tmp_ctx);
465                 return NT_STATUS_NO_MEMORY;
466         }
467
468         ldb_set_opaque(ldb_ctx, "credentials", cmdline_credentials);
469
470         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
471         if (rtn != 0) {
472                 libnet_r->out.error_string = NULL;
473                 talloc_free(tmp_ctx);
474                 return NT_STATUS_UNSUCCESSFUL;
475         }
476
477         rtn = ldb_delete(ldb_ctx, server_dn);
478         if (rtn != 0) {
479                 libnet_r->out.error_string = NULL;
480                 talloc_free(tmp_ctx);
481                 return NT_STATUS_UNSUCCESSFUL;
482         }
483
484         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
485
486         talloc_free(tmp_ctx); 
487         return NT_STATUS_OK;
488 }
489
490 /*
491   leave the domain, deleting the machine acct
492 */
493
494 _PUBLIC_ void torture_leave_domain(struct test_join *join)
495 {
496         struct samr_DeleteUser d;
497         NTSTATUS status;
498
499         if (!join) {
500                 return;
501         }
502         d.in.user_handle = &join->user_handle;
503         d.out.user_handle = &join->user_handle;
504                                         
505         /* Delete machine account */                                                                                                                                                                                                                                                                                                                    
506         status = dcerpc_samr_DeleteUser(join->p, join, &d);
507         if (!NT_STATUS_IS_OK(status)) {
508                 printf("Delete of machine account failed\n");
509         } else {
510                 printf("Delete of machine account was successful.\n");
511         }
512
513         if (join->libnet_r) {
514                 status = torture_leave_ads_domain(join, join->libnet_r);
515         }
516         
517         talloc_free(join);
518 }
519
520 /*
521   return the dom sid for a test join
522 */
523 _PUBLIC_ const struct dom_sid *torture_join_sid(struct test_join *join)
524 {
525         return join->dom_sid;
526 }
527
528 const struct dom_sid *torture_join_user_sid(struct test_join *join)
529 {
530         return join->user_sid;
531 }
532
533 const char *torture_join_netbios_name(struct test_join *join)
534 {
535         return join->netbios_name;
536 }
537
538 const struct GUID *torture_join_user_guid(struct test_join *join)
539 {
540         return &join->user_guid;
541 }
542
543 const char *torture_join_dom_netbios_name(struct test_join *join)
544 {
545         return join->dom_netbios_name;
546 }
547
548 const char *torture_join_dom_dns_name(struct test_join *join)
549 {
550         return join->dom_dns_name;
551 }
552
553
554 #if 0 /* Left as the documentation of the join process, but see new implementation in libnet_become_dc.c */
555 struct test_join_ads_dc {
556         struct test_join *join;
557 };
558
559 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name, 
560                                                     const char *domain,
561                                                     struct cli_credentials **machine_credentials)
562 {
563         struct test_join_ads_dc *join;
564
565         join = talloc(NULL, struct test_join_ads_dc);
566         if (join == NULL) {
567                 return NULL;
568         }
569
570         join->join = torture_join_domain(machine_name, 
571                                         ACB_SVRTRUST,
572                                         machine_credentials);
573
574         if (!join->join) {
575                 return NULL;
576         }
577
578 /* W2K: */
579         /* W2K: modify userAccountControl from 4096 to 532480 */
580         
581         /* W2K: modify RDN to OU=Domain Controllers and skip the $ from server name */
582
583         /* ask objectVersion of Schema Partition */
584
585         /* ask rIDManagerReferenz of the Domain Partition */
586
587         /* ask fsMORoleOwner of the RID-Manager$ object
588          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
589          */
590
591         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
592
593         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
594
595         /* ask for * of CN=Default-First-Site-Name, ... */
596
597         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition 
598          * attributes : distinguishedName, userAccountControl
599          */
600
601         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,... 
602          * should fail with noSuchObject
603          */
604
605         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,... 
606          *
607          * objectClass = server
608          * systemFlags = 50000000
609          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
610          */
611
612         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
613          * should fail with noSuchObject
614          */
615
616         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,... 
617          * attributes: ncName, dnsRoot
618          */
619
620         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
621          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
622          * should fail with attributeOrValueExists
623          */
624
625         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
626          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
627          */
628
629         /* DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
630          *
631          */
632
633         /* replicate CN=Schema,CN=Configuration,...
634          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
635          *
636          */
637
638         /* replicate CN=Configuration,...
639          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
640          *
641          */
642
643         /* replicate Domain Partition
644          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
645          *
646          */
647
648         /* call DsReplicaUpdateRefs() for all partitions like this:
649          *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
650          *           naming_context           : *
651          *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
652          *                     __ndr_size               : 0x000000ae (174)
653          *                     __ndr_size_sid           : 0x00000000 (0)
654          *                     guid                     : 00000000-0000-0000-0000-000000000000
655          *                     sid                      : S-0-0
656          *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
657          *           dest_dsa_dns_name        : *
658          *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
659          *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
660          *           options                  : 0x0000001c (28)
661          *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
662          *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
663          *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
664          *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
665          *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010      
666          *
667          * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
668          * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
669          */
670
671 /* W2K3: see libnet/libnet_become_dc.c */
672         return join;
673 }
674
675 #endif