Add 'net rpc join' to match the ADS equiv.
authorAndrew Bartlett <abartlet@samba.org>
Tue, 4 Dec 2001 05:03:03 +0000 (05:03 +0000)
committerAndrew Bartlett <abartlet@samba.org>
Tue, 4 Dec 2001 05:03:03 +0000 (05:03 +0000)
This kills off the offending code in smbpasswd -j -Uab%c

In the process we have changed from unsing compelatly random passwords
to random, 15 char ascii strings.  While this does produce a decrese in
entropy, it is still vastly greater than we need, considering the application.

In the meantime this allows us to actually *type* the machine account
password duruign debugging.

This code also adds a 'check' step to the join, confirming that the
stored password does indeed do somthing of value :-)

Andrew Bartlett
(This used to be commit c0b7ee6ee547dc7ff798eaf8cb63fbe344073029)

source3/Makefile.in
source3/libsmb/pwd_cache.c
source3/libsmb/smbencrypt.c
source3/utils/net_rpc.c
source3/utils/net_rpc_join.c [new file with mode: 0644]
source3/utils/smbpasswd.c

index 8c121fea0d56aae65c70f9df03af943be391d77e..37217c953af1cf67d9e26a33a42977e052c64a6c 100644 (file)
@@ -320,7 +320,10 @@ CLIENT_OBJ = client/client.o client/clitar.o \
              $(READLINE_OBJ)
 
 NET_OBJ = utils/net.o utils/net_ads.o utils/net_rap.o utils/net_rpc.o \
-       $(LIBSMB_OBJ) $(PARAM_OBJ) $(UBIQX_OBJ) $(LIB_OBJ)
+       utils/net_rpc_join.o \
+       $(LIBSMB_OBJ) $(LIBMSRPC_OBJ) $(RPC_PARSE_OBJ) $(PASSDB_OBJ) \
+       $(GROUPDB_OBJ) $(PARAM_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) \
+       $(NECESSARY_BECAUSE_SAMBA_DEPENDENCIES_ARE_SO_BROKEN_OBJ)
 
 CUPS_OBJ = client/smbspool.o $(PARAM_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) $(LIB_OBJ)
 
index 3c3d5cb741c3382240a2fc1440e836bee0185a05..94045882238d8dd7c58a212b43b472f9ddb70077 100644 (file)
@@ -135,6 +135,7 @@ void pwd_set_cleartext(struct pwd_info *pwd, char *clr)
        pwd->cleartext = True;
        pwd->null_pwd  = False;
        pwd->crypted   = False;
+       pwd_make_lm_nt_16(pwd, clr);
 }
 
 /****************************************************************************
@@ -147,6 +148,7 @@ void pwd_get_cleartext(struct pwd_info *pwd, char *clr)
                fstrcpy(clr, pwd->password);
        else
                clr[0] = 0;
+
 }
 
 /****************************************************************************
index 2e274553628e0d5ce58090fc4bfbf6e7435edf68..b0fecd1c192de9b7c0eb56e4483968d3ae343100 100644 (file)
@@ -262,27 +262,20 @@ void SMBsesskeygen_ntv1(const uchar kr[16],
 }
 
 /***********************************************************
- encode a password buffer
+ encode a password buffer.  The caller gets to figure out 
+ what to put in it.
 ************************************************************/
-BOOL encode_pw_buffer(char buffer[516], const char *new_pass,
-                     int new_pw_len, BOOL nt_pass_set)
+BOOL encode_pw_buffer(char buffer[516], char *new_pw, int new_pw_length)
 {
        generate_random_buffer((unsigned char *)buffer, 516, True);
 
-       if (nt_pass_set) {
-               new_pw_len *= 2;
-               push_ucs2(NULL, &buffer[512 - new_pw_len], new_pass,
-                         new_pw_len, 0);
-       } else {
-               push_ascii(&buffer[512 - new_pw_len], new_pass,
-                          new_pw_len, 0);
-       }
+       memcpy(&buffer[512 - new_pw_length], new_pw, new_pw_length);
 
        /* 
         * The length of the new password is in the last 4 bytes of
         * the data buffer.
         */
-       SIVAL(buffer, 512, new_pw_len);
+       SIVAL(buffer, 512, new_pw_length);
 
        return True;
 }
index db4c0c881dc9b0bec2bd6566693889376f994399..e3e1d4fc709a753e8299d1d5ad7c7312d24a326e 100644 (file)
 
 int net_rpc_usage(int argc, const char **argv) 
 {
-       d_printf("\nNot implemented\n");
+       d_printf("  net rpc join \tto join a domin \n");
        return -1;
 }
 
 int net_rpc(int argc, const char **argv)
 {
        struct functable func[] = {
+               {"join", net_rpc_join},
                {NULL, NULL}
        };
        return net_run_function(argc, argv, func, net_rpc_usage);
diff --git a/source3/utils/net_rpc_join.c b/source3/utils/net_rpc_join.c
new file mode 100644 (file)
index 0000000..11e878f
--- /dev/null
@@ -0,0 +1,311 @@
+/* 
+   Samba Unix/Linux SMB client library 
+   Version 3.0
+   Distributed SMB/CIFS Server Management Utility 
+   Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
+   Copyright (C) Tim Potter     2001
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
+#include "includes.h"
+#include "../utils/net.h"
+
+/* Macro for checking RPC error codes to make things more readable */
+
+#define CHECK_RPC_ERR(rpc, msg) \
+        if (!NT_STATUS_IS_OK(result = rpc)) { \
+                DEBUG(0, (msg ": %s\n", get_nt_error_msg(result))); \
+                goto done; \
+        }
+
+#define CHECK_RPC_ERR_DEBUG(rpc, debug_args) \
+        if (!NT_STATUS_IS_OK(result = rpc)) { \
+                DEBUG(0, debug_args); \
+                goto done; \
+        }
+
+/*********************************************************
+Join a domain using the administrator username and password
+**********************************************************/
+
+int net_rpc_join(int argc, const char **argv) 
+{
+
+       extern pstring global_myname;
+
+       /* libsmb variables */
+
+       struct cli_state *cli;
+       fstring acct_name;
+       TALLOC_CTX *mem_ctx;
+        uint32 acb_info;
+
+       /* rpc variables */
+
+       POLICY_HND lsa_pol, sam_pol, domain_pol, user_pol;
+       DOM_SID domain_sid;
+       uint32 user_rid;
+
+       /* Password stuff */
+
+       char *clear_trust_password = NULL;
+       fstring ucs2_trust_password;
+       int ucs2_pw_len;
+       uchar stored_md4_trust_password[16];
+       uchar pwbuf[516], sess_key[16];
+       SAM_USERINFO_CTR ctr;
+       SAM_USER_INFO_24 p24;
+       SAM_USER_INFO_10 p10;
+
+       /* Misc */
+
+       NTSTATUS result;
+       int retval = 1;
+       fstring domain;
+       
+       /* Connect to remote machine */
+
+       if (!(cli = net_make_ipc_connection(NET_FLAGS_PDC))) 
+               return 1;
+
+       if (!(mem_ctx = talloc_init())) {
+               DEBUG(0, ("Could not initialise talloc context\n"));
+               goto done;
+       }
+
+       /* Fetch domain sid */
+
+       if (!cli_nt_session_open(cli, PIPE_LSARPC)) {
+               DEBUG(0, ("Error connecting to SAM pipe\n"));
+               goto done;
+       }
+
+
+       CHECK_RPC_ERR(cli_lsa_open_policy(cli, mem_ctx, True,
+                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
+                                         &lsa_pol),
+                     "error opening lsa policy handle");
+
+       CHECK_RPC_ERR(cli_lsa_query_info_policy(cli, mem_ctx, &lsa_pol,
+                                               5, domain, &domain_sid),
+                     "error querying info policy");
+
+       cli_lsa_close(cli, mem_ctx, &lsa_pol);
+
+       cli_nt_session_close(cli); /* Done with this pipe */
+
+       /* Create domain user */
+
+       if (!cli_nt_session_open(cli, PIPE_SAMR)) {
+               DEBUG(0, ("Error connecting to SAM pipe\n"));
+               goto done;
+       }
+
+       CHECK_RPC_ERR(cli_samr_connect(cli, mem_ctx, 
+                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
+                                      &sam_pol),
+                     "could not connect to SAM database");
+
+       
+       CHECK_RPC_ERR(cli_samr_open_domain(cli, mem_ctx, &sam_pol,
+                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
+                                          &domain_sid, &domain_pol),
+                     "could not open domain");
+
+       /* Create domain user */
+
+       fstrcpy(acct_name, global_myname);
+       fstrcat(acct_name, "$");
+
+       strlower(acct_name);
+
+        acb_info = (lp_server_role() == ROLE_DOMAIN_BDC) ? ACB_SVRTRUST :
+                ACB_WSTRUST;
+
+       {
+               uint32 unknown = 0xe005000b;
+
+               result = cli_samr_create_dom_user(cli, mem_ctx, &domain_pol,
+                                                 acct_name, acb_info,
+                                                 unknown, &user_pol, 
+                                                 &user_rid);
+
+               /* We *must* do this.... don't ask... */
+
+               CHECK_RPC_ERR_DEBUG(cli_samr_close(cli, mem_ctx, &user_pol), ("error closing user policy"));
+               result = NT_STATUS_USER_EXISTS;
+       }       
+
+       if (NT_STATUS_EQUAL(result, NT_STATUS_USER_EXISTS)) {
+               uint32 num_rids, *name_types, *user_rids;
+               uint32 flags = 0x3e8;
+               char *names;
+               
+               /* Look up existing rid */
+               
+               names = (char *)&acct_name[0];
+
+               CHECK_RPC_ERR_DEBUG(
+                       cli_samr_lookup_names(cli, mem_ctx,
+                                             &domain_pol, flags,
+                                             1, &names, &num_rids,
+                                             &user_rids, &name_types),
+                       ("error looking up rid for user %s: %s\n",
+                        acct_name, get_nt_error_msg(result)));
+
+               if (name_types[0] != SID_NAME_USER) {
+                       DEBUG(0, ("%s is not a user account\n", acct_name));
+                       goto done;
+               }
+
+               user_rid = user_rids[0];
+               
+               /* Open handle on user */
+
+               CHECK_RPC_ERR_DEBUG(
+                       cli_samr_open_user(cli, mem_ctx, &domain_pol,
+                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
+                                          user_rid, &user_pol),
+                       ("could not re-open existing user %s: %s\n",
+                        acct_name, get_nt_error_msg(result)));
+               
+       } else if (!NT_STATUS_IS_OK(result)) {
+               DEBUG(0, ("error creating domain user: %s\n",
+                         get_nt_error_msg(result)));
+               goto done;
+       }
+
+       /* Create a random machine account password */
+
+       clear_trust_password = generate_random_str(15);
+       clear_trust_password = strdup("samba2");
+       
+       ucs2_pw_len = push_ucs2(NULL, ucs2_trust_password, 
+                               clear_trust_password, 
+                               sizeof(ucs2_trust_password), 0);
+                 
+#if DEBUG_PASSWORD
+       DEBUG(100, ("machine password is being set to:\n"));
+       dump_data(100, clear_trust_password, 6);
+
+       DEBUG(100, ("machine password unicode is (len %d):\n", ucs2_pw_len));
+       dump_data(100, ucs2_trust_password, ucs2_pw_len);
+
+#endif
+
+       encode_pw_buffer((char *)pwbuf, ucs2_trust_password,
+                        ucs2_pw_len);
+
+       /* Set password on machine account */
+
+       ZERO_STRUCT(ctr);
+       ZERO_STRUCT(p24);
+
+       init_sam_user_info24(&p24, (char *)pwbuf,24);
+
+       ctr.switch_value = 24;
+       ctr.info.id24 = &p24;
+
+       /* I don't think this is quite the right place for this
+          calculation.  It should be moved somewhere where the credentials
+          are calculated. )-: */
+
+       mdfour(sess_key, cli->pwd.smb_nt_pwd, 16);
+
+       CHECK_RPC_ERR(cli_samr_set_userinfo(cli, mem_ctx, &user_pol, 24, 
+                                           sess_key, &ctr),
+                     "error setting trust account password");
+
+       /* Why do we have to try to (re-)set the ACB to be the same as what
+          we passed in the samr_create_dom_user() call?  When a NT
+          workstation is joined to a domain by an administrator the
+          acb_info is set to 0x80.  For a normal user with "Add
+          workstations to the domain" rights the acb_info is 0x84.  I'm
+          not sure whether it is supposed to make a difference or not.  NT
+          seems to cope with either value so don't bomb out if the set
+          userinfo2 level 0x10 fails.  -tpot */
+
+       ZERO_STRUCT(ctr);
+       ctr.switch_value = 0x10;
+       ctr.info.id10 = &p10;
+
+       init_sam_user_info10(&p10, acb_info);
+
+       /* Ignoring the return value is necessary for joining a domain
+          as a normal user with "Add workstation to domain" privilege. */
+
+       result = cli_samr_set_userinfo2(cli, mem_ctx, &user_pol, 0x10, 
+                                       sess_key, &ctr);
+
+       /* Now store the secret in the secrets database */
+
+       strupper(domain);
+
+       secrets_init();
+
+       if (!secrets_store_domain_sid(domain, &domain_sid)) {
+               DEBUG(0, ("error storing domain sid for %s\n", domain));
+               goto done;
+       }
+
+       if (!secrets_store_machine_password(clear_trust_password)) {
+               DEBUG(0, ("error storing plaintext domain secrets for %s\n", domain));
+       }
+
+       /* Now check the whole process from top-to-bottom */
+
+       cli_samr_close(cli, mem_ctx, &user_pol);
+
+       cli_nt_session_close(cli); /* Done with this pipe */
+
+       if (!cli_nt_session_open(cli, PIPE_NETLOGON)) {
+               DEBUG(0, ("Error connecting to NETLOGON pipe\n"));
+               goto done;
+       }
+
+       if (!secrets_fetch_trust_account_password(domain, 
+                                                 stored_md4_trust_password, NULL)) {
+               DEBUG(0, ("Could not reterive secrets we just stored!"));
+               goto done;
+       }
+       
+       CHECK_RPC_ERR(cli_nt_setup_creds(cli, stored_md4_trust_password),
+                         "error in domain join verification");
+       
+       retval = 0;             /* Success! */
+       
+done:
+       /* Close down pipe - this will clean up open policy handles */
+
+       if (cli->nt_pipe_fnum)
+               cli_nt_session_close(cli);
+
+       /* Display success or failure */
+
+       if (retval != 0) {
+               trust_password_delete(domain);
+               fprintf(stderr,"Unable to join domain %s.\n",domain);
+       } else {
+               printf("Joined domain %s.\n",domain);
+       }
+       
+       cli_shutdown(cli);
+
+       SAFE_FREE(clear_trust_password);
+
+       return retval;
+}
+
+
index 8d50b94a0a1f2180e8f23d930565442926e914e7..92136bea7a163500d2a754059618a9b48855cd19 100644 (file)
@@ -121,298 +121,6 @@ unable to join domain.\n");
        return (int)ret;
 }
 
-/* Initialise client credentials for authenticated pipe access */
-
-void init_rpcclient_creds(struct ntuser_creds *creds, char* username,
-                         char* domain, char* password)
-{
-       ZERO_STRUCTP(creds);
-       
-       if (lp_encrypted_passwords()) {
-               pwd_make_lm_nt_16(&creds->pwd, password);
-       } else {
-               pwd_set_cleartext(&creds->pwd, password);
-       }
-
-       fstrcpy(creds->user_name, username);
-       fstrcpy(creds->domain, domain);
-}
-
-/*********************************************************
-Join a domain using the administrator username and password
-**********************************************************/
-
-/* Macro for checking RPC error codes to make things more readable */
-
-#define CHECK_RPC_ERR(rpc, msg) \
-        if (!NT_STATUS_IS_OK(result = rpc)) { \
-                DEBUG(0, (msg ": %s\n", get_nt_error_msg(result))); \
-                goto done; \
-        }
-
-#define CHECK_RPC_ERR_DEBUG(rpc, debug_args) \
-        if (!NT_STATUS_IS_OK(result = rpc)) { \
-                DEBUG(0, debug_args); \
-                goto done; \
-        }
-
-static int join_domain_byuser(char *domain, char *remote_machine,
-                             char *username, char *password)
-{
-       /* libsmb variables */
-
-       struct nmb_name calling, called;
-       struct ntuser_creds creds;
-       struct cli_state cli;
-       fstring dest_host, acct_name;
-       struct in_addr dest_ip;
-       TALLOC_CTX *mem_ctx;
-        uint32 acb_info;
-
-       /* rpc variables */
-
-       POLICY_HND lsa_pol, sam_pol, domain_pol, user_pol;
-       DOM_SID domain_sid;
-       uint32 user_rid;
-
-       /* Password stuff */
-
-       char *machine_pwd;
-       int plen = 0;
-       uchar pwbuf[516], ntpw[16], sess_key[16];
-       SAM_USERINFO_CTR ctr;
-       SAM_USER_INFO_24 p24;
-       SAM_USER_INFO_10 p10;
-
-       /* Misc */
-
-       NTSTATUS result;
-       int retval = 1;
-
-       /* Connect to remote machine */
-
-       ZERO_STRUCT(cli);
-       ZERO_STRUCT(creds);
-
-       if (!(mem_ctx = talloc_init())) {
-               DEBUG(0, ("Could not initialise talloc context\n"));
-               goto done;
-       }
-
-       if (!cli_initialise(&cli)) {
-               DEBUG(0, ("Could not initialise client structure\n"));
-               goto done;
-       }
-
-       init_rpcclient_creds(&creds, username, domain, password);
-       cli_init_creds(&cli, &creds);
-
-       if (!resolve_srv_name(remote_machine, dest_host, &dest_ip)) {
-               DEBUG(0, ("Could not resolve name %s\n", remote_machine));
-               goto done;
-       }
-
-       make_nmb_name(&called, dns_to_netbios_name(dest_host), 0x20);
-       make_nmb_name(&calling, dns_to_netbios_name(global_myname), 0);
-
-       if (!cli_establish_connection(&cli, dest_host, &dest_ip, &calling, 
-                                     &called, "IPC$", "IPC", False, True)) {
-               DEBUG(0, ("Error connecting to %s\n", dest_host));
-               goto done;
-       }
-
-       /* Fetch domain sid */
-
-       if (!cli_nt_session_open(&cli, PIPE_LSARPC)) {
-               DEBUG(0, ("Error connecting to SAM pipe\n"));
-               goto done;
-       }
-
-
-       CHECK_RPC_ERR(cli_lsa_open_policy(&cli, mem_ctx, True,
-                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
-                                         &lsa_pol),
-                     "error opening lsa policy handle");
-
-       CHECK_RPC_ERR(cli_lsa_query_info_policy(&cli, mem_ctx, &lsa_pol,
-                                               5, domain, &domain_sid),
-                     "error querying info policy");
-
-       cli_lsa_close(&cli, mem_ctx, &lsa_pol);
-
-       cli_nt_session_close(&cli); /* Done with this pipe */
-
-       /* Create domain user */
-
-       if (!cli_nt_session_open(&cli, PIPE_SAMR)) {
-               DEBUG(0, ("Error connecting to SAM pipe\n"));
-               goto done;
-       }
-
-       CHECK_RPC_ERR(cli_samr_connect(&cli, mem_ctx, 
-                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
-                                      &sam_pol),
-                     "could not connect to SAM database");
-
-       
-       CHECK_RPC_ERR(cli_samr_open_domain(&cli, mem_ctx, &sam_pol,
-                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
-                                          &domain_sid, &domain_pol),
-                     "could not open domain");
-
-       /* Create domain user */
-
-       fstrcpy(acct_name, global_myname);
-       fstrcat(acct_name, "$");
-
-       strlower(acct_name);
-
-        acb_info = (lp_server_role() == ROLE_DOMAIN_BDC) ? ACB_SVRTRUST :
-                ACB_WSTRUST;
-
-       {
-               uint32 unknown = 0xe005000b;
-
-               result = cli_samr_create_dom_user(&cli, mem_ctx, &domain_pol,
-                                                 acct_name, acb_info,
-                                                 unknown, &user_pol, 
-                                                 &user_rid);
-
-               /* We *must* do this.... don't ask... */
-
-               CHECK_RPC_ERR_DEBUG(cli_samr_close(&cli, mem_ctx, &user_pol), ("error closing user policy"));
-               result = NT_STATUS_USER_EXISTS;
-       }       
-
-       if (NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_USER_EXISTS)) {
-               uint32 num_rids, *name_types, *user_rids;
-               uint32 flags = 0x3e8;
-               char *names;
-               
-               /* Look up existing rid */
-               
-               names = (char *)&acct_name[0];
-
-               CHECK_RPC_ERR_DEBUG(
-                       cli_samr_lookup_names(&cli, mem_ctx,
-                                             &domain_pol, flags,
-                                             1, &names, &num_rids,
-                                             &user_rids, &name_types),
-                       ("error looking up rid for user %s: %s\n",
-                        acct_name, get_nt_error_msg(result)));
-
-               if (name_types[0] != SID_NAME_USER) {
-                       DEBUG(0, ("%s is not a user account\n", acct_name));
-                       goto done;
-               }
-
-               user_rid = user_rids[0];
-               
-               /* Open handle on user */
-
-               CHECK_RPC_ERR_DEBUG(
-                       cli_samr_open_user(&cli, mem_ctx, &domain_pol,
-                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
-                                          user_rid, &user_pol),
-                       ("could not re-open existing user %s: %s\n",
-                        acct_name, get_nt_error_msg(result)));
-               
-       } else if (!NT_STATUS_IS_OK(result)) {
-               DEBUG(0, ("error creating domain user: %s\n",
-                         get_nt_error_msg(result)));
-               goto done;
-       }
-
-       /* Create a random machine account password */
-
-       {
-               UNISTR2 upw;    /* Unicode password */
-
-               upw.buffer = (uint16 *)talloc_zero(mem_ctx, 0xc * 
-                                                  sizeof(uint16));
-
-               upw.uni_str_len = 0xc;
-               upw.uni_max_len = 0xc;
-
-               machine_pwd = (char *)upw.buffer;
-               plen = upw.uni_str_len * 2;
-               generate_random_buffer((unsigned char *)machine_pwd, plen, True);
-
-               encode_pw_buffer((char *)pwbuf, machine_pwd, plen, False);
-
-               nt_owf_genW(&upw, ntpw);
-       }
-
-       /* Set password on machine account */
-
-       ZERO_STRUCT(ctr);
-       ZERO_STRUCT(p24);
-
-       init_sam_user_info24(&p24, (char *)pwbuf,24);
-
-       ctr.switch_value = 24;
-       ctr.info.id24 = &p24;
-
-       /* I don't think this is quite the right place for this
-          calculation.  It should be moved somewhere where the credentials
-          are calculated. )-: */
-
-       mdfour(sess_key, cli.pwd.smb_nt_pwd, 16);
-
-       CHECK_RPC_ERR(cli_samr_set_userinfo(&cli, mem_ctx, &user_pol, 24, 
-                                           sess_key, &ctr),
-                     "error setting trust account password");
-
-       /* Why do we have to try to (re-)set the ACB to be the same as what
-          we passed in the samr_create_dom_user() call?  When a NT
-          workstation is joined to a domain by an administrator the
-          acb_info is set to 0x80.  For a normal user with "Add
-          workstations to the domain" rights the acb_info is 0x84.  I'm
-          not sure whether it is supposed to make a difference or not.  NT
-          seems to cope with either value so don't bomb out if the set
-          userinfo2 level 0x10 fails.  -tpot */
-
-       ZERO_STRUCT(ctr);
-       ctr.switch_value = 0x10;
-       ctr.info.id10 = &p10;
-
-       init_sam_user_info10(&p10, acb_info);
-
-       /* Ignoring the return value is necessary for joining a domain
-          as a normal user with "Add workstation to domain" privilege. */
-
-       result = cli_samr_set_userinfo2(&cli, mem_ctx, &user_pol, 0x10, 
-                                       sess_key, &ctr);
-
-       /* Now store the secret in the secrets database */
-
-       strupper(domain);
-
-       if (!secrets_store_domain_sid(domain, &domain_sid) ||
-           !secrets_store_trust_account_password(domain, ntpw)) {
-               DEBUG(0, ("error storing domain secrets\n"));
-               goto done;
-       }
-
-       retval = 0;             /* Success! */
-
- done:
-       /* Close down pipe - this will clean up open policy handles */
-
-       if (cli.nt_pipe_fnum)
-               cli_nt_session_close(&cli);
-
-       /* Display success or failure */
-
-       if (retval != 0) {
-               trust_password_delete(domain);
-               fprintf(stderr,"Unable to join domain %s.\n",domain);
-       } else {
-               printf("Joined domain %s.\n",domain);
-       }
-       
-       return retval;
-}
 
 static void set_line_buffering(FILE *f)
 {
@@ -657,8 +365,9 @@ static int process_root(int argc, char *argv[])
                                        pstrcpy(user_password, pass);
                        }
                                
-                       return join_domain_byuser(new_domain, remote_machine,
-                                                 user_name, user_password);
+                       d_printf("use net rpc join to do this now.\n");
+                       return 1;
+                       
                } else {
 
                        /* Or just with the server manager? */