source4/setup/domainlevel

   1 #!/usr/bin/python
   2 #
   3 # Raises domain and forest function levels
   4 #
   5 # Copyright Matthias Dieter Wallnoefer 2009
   6 #
   7 # This program is free software; you can redistribute it and/or modify
   8 # it under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 3 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # This program is distributed in the hope that it will be useful,
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 #
  20
  21 # Notice: At the moment we have some more checks to do here on the special
  22 # attributes (consider attribute "msDS-Behavior-Version). This is due to the
  23 # fact that we on s4 LDB don't implement their change policy (only certain
  24 # values, only increments possible...) yet.
  25
  26 import sys
  27
  28 # Find right directory when running from source tree
  29 sys.path.insert(0, "bin/python")
  30
  31 import samba.getopt as options
  32 import optparse
  33 import ldb
  34
  35 from samba.auth import system_session
  36 from samba.samdb import SamDB
  37 from samba import DS_DOMAIN_FUNCTION_2000, DS_DOMAIN_FUNCTION_2003
  38 from samba import DS_DOMAIN_FUNCTION_2003_MIXED, DS_DOMAIN_FUNCTION_2008
  39 from samba import DS_DOMAIN_FUNCTION_2008_R2
  40 from samba import DS_DC_FUNCTION_2000, DS_DC_FUNCTION_2003, DS_DC_FUNCTION_2008
  41 from samba import DS_DC_FUNCTION_2008_R2
  42
  43 parser = optparse.OptionParser("domainlevel (show | raise <options>)")
  44 sambaopts = options.SambaOptions(parser)
  45 parser.add_option_group(sambaopts)
  46 parser.add_option_group(options.VersionOptions(parser))
  47 credopts = options.CredentialsOptions(parser)
  48 parser.add_option_group(credopts)
  49 parser.add_option("-H", help="LDB URL for database or target server", type=str)
  50 parser.add_option("--quiet", help="Be quiet", action="store_true")
  51 parser.add_option("--forest", type="choice",
  52   choices=["2003", "2008", "2008_R2"],
  53   help="The forest function level (2003 | 2008 | 2008_R2)")
  54 parser.add_option("--domain", type="choice",
  55   choices=["2003", "2008", "2008_R2"],
  56   help="The domain function level (2003 | 2008 | 2008_R2)")
  57 opts, args = parser.parse_args()
  58
  59 #
  60 #  print a message if quiet is not set
  61 #
  62 def message(text):
  63         if not opts.quiet:
  64                 print text
  65
  66 if len(args) == 0:
  67         parser.print_usage()
  68         sys.exit(1)
  69
  70 lp = sambaopts.get_loadparm()
  71 creds = credopts.get_credentials(lp)
  72
  73 if opts.H is not None:
  74         url = opts.H
  75 else:
  76         url = lp.get("sam database")
  77
  78 samdb = SamDB(url=url, session_info=system_session(), credentials=creds, lp=lp)
  79
  80 domain_dn = SamDB.domain_dn(samdb)
  81
  82 res_forest = samdb.search("CN=Partitions,CN=Configuration," + domain_dn,
  83   scope=ldb.SCOPE_BASE, attrs=["msDS-Behavior-Version"])
  84 assert(len(res_forest) == 1)
  85
  86 res_domain = samdb.search(domain_dn, scope=ldb.SCOPE_BASE,
  87   attrs=["msDS-Behavior-Version", "nTMixedDomain"])
  88 assert(len(res_domain) == 1)
  89
  90 res_dc_s = samdb.search("CN=Sites,CN=Configuration," + domain_dn,
  91   scope=ldb.SCOPE_SUBTREE, expression="(objectClass=nTDSDSA)",
  92   attrs=["msDS-Behavior-Version"])
  93 assert(len(res_dc_s) >= 1)
  94
  95 try:
  96         level_forest = int(res_forest[0]["msDS-Behavior-Version"][0])
  97         level_domain = int(res_domain[0]["msDS-Behavior-Version"][0])
  98         level_domain_mixed = int(res_domain[0]["nTMixedDomain"][0])
  99
 100         min_level_dc = int(res_dc_s[0]["msDS-Behavior-Version"][0]) # Init value
 101         for msg in res_dc_s:
 102                 if int(msg["msDS-Behavior-Version"][0]) < min_level_dc:
 103                         min_level_dc = int(msg["msDS-Behavior-Version"][0])
 104
 105         if level_forest < 0 or level_domain < 0:
 106                 print >>sys.stderr, "ERROR: Domain and/or forest function level(s) is/are invalid. Correct them or reprovision!"
 107                 sys.exit(1)
 108         if min_level_dc < 0:
 109                 print >>sys.stderr, "ERROR: Lowest function level of a DC is invalid. Correct this or reprovision!"
 110                 sys.exit(1)
 111         if level_forest > level_domain:
 112                 print >>sys.stderr, "ERROR: Forest function level is higher than the domain level(s). Correct this or reprovision!"
 113                 sys.exit(1)
 114         if level_domain > min_level_dc:
 115                 print >>sys.stderr, "ERROR: Domain function level is higher than the lowest function level of a DC. Correct this or reprovision!"
 116                 sys.exit(1)
 117
 118 except KeyError:
 119         print >>sys.stderr, "ERROR: Could not retrieve the actual domain, forest level and/or lowest DC function level!"
 120         if args[0] == "show":
 121                 print >>sys.stderr, "So the levels can't be displayed!"
 122         sys.exit(1)
 123
 124 if args[0] == "show":
 125         message("Domain and forest function level for domain '" + domain_dn + "'")
 126         if level_forest < DS_DOMAIN_FUNCTION_2003:
 127                 message("\nATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
 128         if level_domain < DS_DOMAIN_FUNCTION_2003:
 129                 message("\nATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
 130         if min_level_dc < DS_DC_FUNCTION_2003:
 131                 message("\nATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!")
 132
 133         message("")
 134
 135         if level_forest == DS_DOMAIN_FUNCTION_2000:
 136                 outstr = "2000"
 137         elif level_forest == DS_DOMAIN_FUNCTION_2003_MIXED:
 138                 outstr = "2003 with mixed domains/interim (NT4 DC support)"
 139         elif level_forest == DS_DOMAIN_FUNCTION_2003:
 140                 outstr = "2003"
 141         elif level_forest == DS_DOMAIN_FUNCTION_2008:
 142                 outstr = "2008"
 143         elif level_forest == DS_DOMAIN_FUNCTION_2008_R2:
 144                 outstr = "2008 R2"
 145         else:
 146                 outstr = "higher than 2008 R2"
 147         message("Forest function level: (Windows) " + outstr)
 148
 149         if level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0:
 150                 outstr = "2000 mixed (NT4 DC support)"
 151         elif level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed == 0:
 152                 outstr = "2000"
 153         elif level_domain == DS_DOMAIN_FUNCTION_2003_MIXED:
 154                 outstr = "2003 with mixed domains/interim (NT4 DC support)"
 155         elif level_domain == DS_DOMAIN_FUNCTION_2003:
 156                 outstr = "2003"
 157         elif level_domain == DS_DOMAIN_FUNCTION_2008:
 158                 outstr = "2008"
 159         elif level_domain == DS_DOMAIN_FUNCTION_2008_R2:
 160                 outstr = "2008 R2"
 161         else:
 162                 outstr = "higher than 2008 R2"
 163         message("Domain function level: (Windows) " + outstr)
 164
 165         if min_level_dc == DS_DC_FUNCTION_2000:
 166                 outstr = "2000"
 167         elif min_level_dc == DS_DC_FUNCTION_2003:
 168                 outstr = "2003"
 169         elif min_level_dc == DS_DC_FUNCTION_2008:
 170                 outstr = "2008"
 171         elif min_level_dc == DS_DC_FUNCTION_2008_R2:
 172                 outstr = "2008 R2"
 173         else:
 174                 outstr = "higher than 2008 R2"
 175         message("Lowest function level of a DC: (Windows) " + outstr)
 176
 177 elif args[0] == "raise":
 178         msgs = []
 179
 180         if opts.domain is not None:
 181                 arg = opts.domain
 182
 183                 if arg == "2003":
 184                         new_level_domain = DS_DOMAIN_FUNCTION_2003
 185                 elif arg == "2008":
 186                         new_level_domain = DS_DOMAIN_FUNCTION_2008
 187                 elif arg == "2008_R2":
 188                         new_level_domain = DS_DOMAIN_FUNCTION_2008_R2
 189
 190                 if new_level_domain <= level_domain and level_domain_mixed == 0:
 191                         print >>sys.stderr, "ERROR: Domain function level can't be smaller equal to the actual one!"
 192                         sys.exit(1)
 193
 194                 if new_level_domain > min_level_dc:
 195                         print >>sys.stderr, "ERROR: Domain function level can't be higher than the lowest function level of a DC!"
 196                         sys.exit(1)
 197
 198                 # Deactivate mixed/interim domain support
 199                 if level_domain_mixed != 0:
 200                         m = ldb.Message()
 201                         m.dn = ldb.Dn(samdb, domain_dn)
 202                         m["nTMixedDomain"] = ldb.MessageElement("0",
 203                           ldb.FLAG_MOD_REPLACE, "nTMixedDomain")
 204                         samdb.modify(m)
 205
 206                 m = ldb.Message()
 207                 m.dn = ldb.Dn(samdb, domain_dn)
 208                 m["msDS-Behavior-Version"]= ldb.MessageElement(
 209                   str(new_level_domain), ldb.FLAG_MOD_REPLACE,
 210                   "msDS-Behavior-Version")
 211                 samdb.modify(m)
 212
 213                 level_domain = new_level_domain
 214
 215                 msgs.append("Domain function level changed!")
 216
 217         if opts.forest is not None:
 218                 arg = opts.forest
 219
 220                 if arg == "2003":
 221                         new_level_forest = DS_DOMAIN_FUNCTION_2003
 222                 elif arg == "2008":
 223                         new_level_forest = DS_DOMAIN_FUNCTION_2008
 224                 elif arg == "2008_R2":
 225                         new_level_forest = DS_DOMAIN_FUNCTION_2008_R2
 226
 227                 if new_level_forest <= level_forest:
 228                         print >>sys.stderr, "ERROR: Forest function level can't be smaller equal to the actual one!"
 229                         sys.exit(1)
 230
 231                 if new_level_forest > level_domain:
 232                         print >>sys.stderr, "ERROR: Forest function level can't be higher than the domain function level(s). Please raise it/them first!"
 233                         sys.exit(1)
 234
 235                 m = ldb.Message()
 236                 m.dn = ldb.Dn(samdb, "CN=Partitions,CN=Configuration,"
 237                   + domain_dn)
 238                 m["msDS-Behavior-Version"]= ldb.MessageElement(
 239                   str(new_level_forest), ldb.FLAG_MOD_REPLACE,
 240                   "msDS-Behavior-Version")
 241                 samdb.modify(m)
 242
 243                 msgs.append("Forest function level changed!")
 244
 245         msgs.append("All changes applied successfully!")
 246
 247         message("\n".join(msgs))
 248 else:
 249         print >>sys.stderr, "ERROR: Wrong argument '" + args[0] + "'!"
 250         sys.exit(1)