1 # Unix SMB/CIFS implementation.
2 # Copyright Matthieu Patou <mat@matws.net> 2011
3 # Copyright Andrew Bartlett <abartlet@samba.org> 2008-2015
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program. If not, see <http://www.gnu.org/licenses/>.
20 from ldb import LdbError
21 from samba.ndr import ndr_unpack
22 from samba.dcerpc import misc
24 class DemoteException(Exception):
25 """Base element for demote errors"""
27 def __init__(self, value):
31 return "DemoteException: " + self.value
34 def remove_sysvol_references(samdb, rdn):
35 realm = samdb.domain_dns_name()
36 for s in ("CN=Enterprise,CN=Microsoft System Volumes,CN=System,CN=Configuration",
37 "CN=%s,CN=Microsoft System Volumes,CN=System,CN=Configuration" % realm,
38 "CN=Domain System Volumes (SYSVOL share),CN=File Replication Service,CN=System"):
40 samdb.delete(ldb.Dn(samdb,
41 "%s,%s,%s" % (str(rdn), s, str(samdb.get_root_basedn()))))
42 except ldb.LdbError, l:
45 def remove_dns_references(samdb, dnsHostName):
47 # Check we are using in-database DNS
48 zones = samdb.search(base="", scope=ldb.SCOPE_SUBTREE,
49 expression="(&(objectClass=dnsZone)(!(dc=RootDNSServers)))",
51 controls=["search_options:0:2"])
56 rec = samdb.dns_lookup(dnsHostName)
57 except RuntimeError as (enum, estr):
58 if enum == 0x000025F2: #WERR_DNS_ERROR_NAME_DOES_NOT_EXIST
60 raise DemoteException("lookup of %s failed: %s" % (dnsHostName, estr))
61 samdb.dns_replace(dnsHostName, [])
63 def offline_remove_server(samdb, server_dn,
64 remove_computer_obj=False,
65 remove_server_obj=False,
66 remove_sysvol_obj=False,
67 remove_dns_names=False):
68 res = samdb.search("",
69 scope=ldb.SCOPE_BASE, attrs=["dsServiceName"])
71 my_serviceName = res[0]["dsServiceName"][0]
73 # Confirm this is really a server object
74 msgs = samdb.search(base=server_dn,
75 attrs=["serverReference", "cn",
78 expression="(objectClass=server)")
80 dc_name = msgs[0]["cn"]
83 computer_dn = ldb.Dn(samdb, msgs[0]["serverReference"][0])
88 dnsHostName = msgs[0]["dnsHostName"][0]
93 # Remove the server DN
94 samdb.delete(server_dn)
96 if computer_dn is not None:
97 computer_msgs = samdb.search(base=computer_dn,
98 expression="objectclass=computer",
99 attrs=["msDS-KrbTgtLink",
101 scope=ldb.SCOPE_BASE)
102 if "rIDSetReferences" in computer_msgs[0]:
103 samdb.delete(computer_msgs[0]["rIDSetReferences"][0])
104 if "msDS-KrbTgtLink" in computer_msgs[0]:
105 samdb.delete(computer_msgs[0]["msDS-KrbTgtLink"][0])
107 if remove_computer_obj:
108 # Delete the computer tree
109 samdb.delete(computer_dn, ["tree_delete:0"])
111 if "dnsHostName" in msgs[0]:
112 dnsHostName = msgs[0]["dnsHostName"][0]
114 if dnsHostName is not None and remove_dns_names:
115 remove_dns_references(samdb, dnsHostName)
117 if remove_sysvol_obj:
118 remove_sysvol_references(samdb, "CN=%s" % dc_name)
120 def offline_remove_ntds_dc(samdb, ntds_dn,
121 remove_computer_obj=False,
122 remove_server_obj=False,
123 remove_connection_obj=False,
124 seize_stale_fsmo=False,
125 remove_sysvol_obj=False,
126 remove_dns_names=False):
127 res = samdb.search("",
128 scope=ldb.SCOPE_BASE, attrs=["dsServiceName"])
130 my_serviceName = res[0]["dsServiceName"][0]
131 server_dn = ntds_dn.parent()
134 msgs = samdb.search(base=ntds_dn, expression="objectClass=ntdsDSA",
135 attrs=["objectGUID"], scope=ldb.SCOPE_BASE)
136 except LdbError as (enum, estr):
137 if enum == ldb.ERR_NO_SUCH_OBJECT:
138 raise DemoteException("Given DN %s doesn't exist" % ntds_dn)
142 raise DemoteException("%s is not an ntdsda in %s"
143 % (ntds_dn, samdb.domain_dns_name()))
146 if (msg.dn.get_rdn_name() != "CN" or
147 msg.dn.get_rdn_value() != "NTDS Settings"):
148 raise DemoteException("Given DN (%s) wasn't the NTDS Settings DN" %
151 ntds_guid = ndr_unpack(misc.GUID, msg["objectGUID"][0])
153 if remove_connection_obj:
154 # Find any nTDSConnection objects with that DC as the fromServer.
155 # We use the GUID to avoid issues with any () chars in a server
157 stale_connections = samdb.search(base=samdb.get_config_basedn(),
158 expression="(&(objectclass=nTDSConnection)"
159 "(fromServer=<GUID=%s>))" % ntds_guid)
160 for conn in stale_connections:
161 samdb.delete(conn.dn)
164 stale_fsmo_roles = samdb.search(base="", scope=ldb.SCOPE_SUBTREE,
165 expression="(fsmoRoleOwner=<GUID=%s>))"
167 controls=["search_options:0:2"])
168 # Find any FSMO roles they have, give them to this server
170 for role in stale_fsmo_roles:
171 val = str(my_serviceName)
174 m['value'] = ldb.MessageElement(val, ldb.FLAG_MOD_REPLACE,
178 # Remove the NTDS setting tree
180 samdb.delete(ntds_dn, ["tree_delete:0"])
181 except LdbError as (enum, estr):
182 raise DemoteException("Failed to remove the DCs NTDS DSA object: %s"
185 offline_remove_server(samdb, server_dn,
186 remove_computer_obj=remove_computer_obj,
187 remove_server_obj=remove_server_obj,
188 remove_sysvol_obj=remove_sysvol_obj,
189 remove_dns_names=remove_dns_names)
192 def remove_dc(samdb, dc_name):
194 # TODO: Check if this is the last server
196 samdb.transaction_start()
198 msgs = samdb.search(base=samdb.get_config_basedn(),
199 attrs=["serverReference"],
200 expression="(&(objectClass=server)(cn=%s))"
201 % ldb.binary_encode(dc_name))
203 raise DemoteException("%s is not an AD DC in %s"
204 % (dc_name, samdb.domain_dns_name()))
205 server_dn = msgs[0].dn
207 ntds_dn = ldb.Dn(samdb, "CN=NTDS Settings")
208 ntds_dn.add_base(msgs[0].dn)
210 # Confirm this is really an ntdsDSA object
212 msgs = samdb.search(base=ntds_dn, attrs=[], scope=ldb.SCOPE_BASE,
213 expression="(objectClass=ntdsdsa)")
214 except LdbError as (enum, estr):
215 if enum == ldb.ERR_NO_SUCH_OBJECT:
216 offline_remove_server(samdb, msgs[0].dn,
217 remove_computer_obj=True,
218 remove_server_obj=True,
219 remove_sysvol_obj=True,
220 remove_dns_names=True)
222 samdb.transaction_commit()
227 offline_remove_ntds_dc(samdb, msgs[0].dn,
228 remove_computer_obj=True,
229 remove_server_obj=True,
230 remove_connection_obj=True,
231 seize_stale_fsmo=True,
232 remove_sysvol_obj=True,
233 remove_dns_names=True)
235 samdb.transaction_commit()
239 def offline_remove_dc_RemoveDsServer(samdb, ntds_dn):
241 samdb.start_transaction()
243 offline_remove_ntds_dc(samdb, ntds_dn)
245 samdb.commit_transaction()