s4-rodc: enable the DRS_GET_ALL_GROUP_MEMBERSHIP flag for RODC replication

[kai/samba.git] / source4 / scripting / python / samba / join.py

diff --git a/source4/scripting/python/samba/join.py b/source4/scripting/python/samba/join.py
index 1ead9261d81df657b6018ad59133f833f96bc245..deeedc5ad38f99885966fd2ca4ac44e2ed86b78a 100644 (file)
--- a/source4/scripting/python/samba/join.py
+++ b/source4/scripting/python/samba/join.py
@@ -309,7 +309,7 @@ class dc_join:
             "objectClass": "computer",
             "displayname": ctx.samname,
             "samaccountname" : ctx.samname,
-            "userAccountControl" : str(ctx.userAccountControl),
+            "userAccountControl" : str(ctx.userAccountControl | samba.dsdb.UF_ACCOUNTDISABLE),
             "dnshostname" : ctx.dnshostname}
         if ctx.behavior_version >= samba.dsdb.DS_DOMAIN_FUNCTION_2008:
             rec['msDS-SupportedEncryptionTypes'] = str(samba.dsdb.ENC_ALL_TYPES)
@@ -404,6 +404,13 @@ class dc_join:
         res = ctx.samdb.search(base=ctx.acct_dn, scope=ldb.SCOPE_BASE, attrs=["msDS-keyVersionNumber"])
         ctx.key_version_number = int(res[0]["msDS-keyVersionNumber"][0])
 
+        print("Enabling account")
+        m = ldb.Message()
+        m.dn = ldb.Dn(ctx.samdb, ctx.acct_dn)
+        m["userAccountControl"] = ldb.MessageElement(str(ctx.userAccountControl),
+                                                     ldb.FLAG_MOD_REPLACE,
+                                                     "userAccountControl")
+        ctx.samdb.modify(m)
 
     def join_provision(ctx):
         '''provision the local SAM'''
@@ -538,7 +545,8 @@ def join_RODC(server=None, creds=None, lp=None, site=None, netbios_name=None,
                            drsuapi.DRSUAPI_DRS_PER_SYNC |
                            drsuapi.DRSUAPI_DRS_GET_ANC |
                            drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
-                           drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
+                           drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING |
+                           drsuapi.DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP)
     ctx.do_join()