3 # Raises domain and forest function levels
5 # Copyright Matthias Dieter Wallnoefer 2009
6 # Copyright Jelmer Vernooij 2009
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 # Notice: At the moment we have some more checks to do here on the special
23 # attributes (consider attribute "msDS-Behavior-Version). This is due to the
24 # fact that we on s4 LDB don't implement their change policy (only certain
25 # values, only increments possible...) yet.
27 import samba
.getopt
as options
30 from samba
.auth
import system_session
31 from samba
.netcmd
import (
36 from samba
.samdb
import SamDB
38 DS_DOMAIN_FUNCTION_2000
,
39 DS_DOMAIN_FUNCTION_2003
,
40 DS_DOMAIN_FUNCTION_2003_MIXED
,
41 DS_DOMAIN_FUNCTION_2008
,
42 DS_DOMAIN_FUNCTION_2008_R2
,
46 DS_DC_FUNCTION_2008_R2
,
49 class cmd_domainlevel(Command
):
50 """Raises domain and forest function levels."""
52 synopsis
= "(show | raise <options>)"
54 takes_optiongroups
= {
55 "sambaopts": options
.SambaOptions
,
56 "credopts": options
.CredentialsOptions
,
57 "versionopts": options
.VersionOptions
,
61 Option("-H", help="LDB URL for database or target server", type=str),
62 Option("--quiet", help="Be quiet", action
="store_true"),
63 Option("--forest", type="choice", choices
=["2003", "2008", "2008_R2"],
64 help="The forest function level (2003 | 2008 | 2008_R2)"),
65 Option("--domain", type="choice", choices
=["2003", "2008", "2008_R2"],
66 help="The domain function level (2003 | 2008 | 2008_R2)"),
69 takes_args
= ["subcommand"]
71 def run(self
, subcommand
, H
=None, forest
=None, domain
=None, quiet
=False,
72 credopts
=None, sambaopts
=None, versionopts
=None):
73 lp
= sambaopts
.get_loadparm()
74 creds
= credopts
.get_credentials(lp
)
79 url
= lp
.get("sam database")
81 samdb
= SamDB(url
=url
, session_info
=system_session(),
82 credentials
=creds
, lp
=lp
)
84 domain_dn
= SamDB
.domain_dn(samdb
)
86 res_forest
= samdb
.search("CN=Partitions,CN=Configuration," + domain_dn
,
87 scope
=ldb
.SCOPE_BASE
, attrs
=["msDS-Behavior-Version"])
88 assert(len(res_forest
) == 1)
90 res_domain
= samdb
.search(domain_dn
, scope
=ldb
.SCOPE_BASE
,
91 attrs
=["msDS-Behavior-Version", "nTMixedDomain"])
92 assert(len(res_domain
) == 1)
94 res_dc_s
= samdb
.search("CN=Sites,CN=Configuration," + domain_dn
,
95 scope
=ldb
.SCOPE_SUBTREE
, expression
="(objectClass=nTDSDSA)",
96 attrs
=["msDS-Behavior-Version"])
97 assert(len(res_dc_s
) >= 1)
100 level_forest
= int(res_forest
[0]["msDS-Behavior-Version"][0])
101 level_domain
= int(res_domain
[0]["msDS-Behavior-Version"][0])
102 level_domain_mixed
= int(res_domain
[0]["nTMixedDomain"][0])
104 min_level_dc
= int(res_dc_s
[0]["msDS-Behavior-Version"][0]) # Init value
106 if int(msg
["msDS-Behavior-Version"][0]) < min_level_dc
:
107 min_level_dc
= int(msg
["msDS-Behavior-Version"][0])
109 if level_forest
< 0 or level_domain
< 0:
110 raise CommandError("Domain and/or forest function level(s) is/are invalid. Correct them or reprovision!")
112 raise CommandError("Lowest function level of a DC is invalid. Correct this or reprovision!")
113 if level_forest
> level_domain
:
114 raise CommandError("Forest function level is higher than the domain level(s). Correct this or reprovision!")
115 if level_domain
> min_level_dc
:
116 raise CommandError("Domain function level is higher than the lowest function level of a DC. Correct this or reprovision!")
119 raise CommandError("Could not retrieve the actual domain, forest level and/or lowest DC function level!")
121 if subcommand
== "show":
122 self
.message("Domain and forest function level for domain '" + domain_dn
+ "'")
123 if level_forest
< DS_DOMAIN_FUNCTION_2003
:
124 self
.message("\nATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
125 if level_domain
< DS_DOMAIN_FUNCTION_2003
:
126 self
.message("\nATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
127 if min_level_dc
< DS_DC_FUNCTION_2003
:
128 self
.message("\nATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!")
132 if level_forest
== DS_DOMAIN_FUNCTION_2000
:
134 elif level_forest
== DS_DOMAIN_FUNCTION_2003_MIXED
:
135 outstr
= "2003 with mixed domains/interim (NT4 DC support)"
136 elif level_forest
== DS_DOMAIN_FUNCTION_2003
:
138 elif level_forest
== DS_DOMAIN_FUNCTION_2008
:
140 elif level_forest
== DS_DOMAIN_FUNCTION_2008_R2
:
143 outstr
= "higher than 2008 R2"
144 self
.message("Forest function level: (Windows) " + outstr
)
146 if level_domain
== DS_DOMAIN_FUNCTION_2000
and level_domain_mixed
!= 0:
147 outstr
= "2000 mixed (NT4 DC support)"
148 elif level_domain
== DS_DOMAIN_FUNCTION_2000
and level_domain_mixed
== 0:
150 elif level_domain
== DS_DOMAIN_FUNCTION_2003_MIXED
:
151 outstr
= "2003 with mixed domains/interim (NT4 DC support)"
152 elif level_domain
== DS_DOMAIN_FUNCTION_2003
:
154 elif level_domain
== DS_DOMAIN_FUNCTION_2008
:
156 elif level_domain
== DS_DOMAIN_FUNCTION_2008_R2
:
159 outstr
= "higher than 2008 R2"
160 self
.message("Domain function level: (Windows) " + outstr
)
162 if min_level_dc
== DS_DC_FUNCTION_2000
:
164 elif min_level_dc
== DS_DC_FUNCTION_2003
:
166 elif min_level_dc
== DS_DC_FUNCTION_2008
:
168 elif min_level_dc
== DS_DC_FUNCTION_2008_R2
:
171 outstr
= "higher than 2008 R2"
172 self
.message("Lowest function level of a DC: (Windows) " + outstr
)
174 elif subcommand
== "raise":
177 if domain
is not None:
179 new_level_domain
= DS_DOMAIN_FUNCTION_2003
180 elif domain
== "2008":
181 new_level_domain
= DS_DOMAIN_FUNCTION_2008
182 elif domain
== "2008_R2":
183 new_level_domain
= DS_DOMAIN_FUNCTION_2008_R2
185 if new_level_domain
<= level_domain
and level_domain_mixed
== 0:
186 raise CommandError("Domain function level can't be smaller equal to the actual one!")
188 if new_level_domain
> min_level_dc
:
189 raise CommandError("Domain function level can't be higher than the lowest function level of a DC!")
191 # Deactivate mixed/interim domain support
192 if level_domain_mixed
!= 0:
194 m
.dn
= ldb
.Dn(samdb
, domain_dn
)
195 m
["nTMixedDomain"] = ldb
.MessageElement("0",
196 ldb
.FLAG_MOD_REPLACE
, "nTMixedDomain")
199 m
.dn
= ldb
.Dn(samdb
, domain_dn
)
200 m
["msDS-Behavior-Version"]= ldb
.MessageElement(
201 str(new_level_domain
), ldb
.FLAG_MOD_REPLACE
,
202 "msDS-Behavior-Version")
204 level_domain
= new_level_domain
205 msgs
.append("Domain function level changed!")
207 if forest
is not None:
209 new_level_forest
= DS_DOMAIN_FUNCTION_2003
210 elif forest
== "2008":
211 new_level_forest
= DS_DOMAIN_FUNCTION_2008
212 elif forest
== "2008_R2":
213 new_level_forest
= DS_DOMAIN_FUNCTION_2008_R2
214 if new_level_forest
<= level_forest
:
215 raise CommandError("Forest function level can't be smaller equal to the actual one!")
216 if new_level_forest
> level_domain
:
217 raise CommandError("Forest function level can't be higher than the domain function level(s). Please raise it/them first!")
219 m
.dn
= ldb
.Dn(samdb
, "CN=Partitions,CN=Configuration,"
221 m
["msDS-Behavior-Version"]= ldb
.MessageElement(
222 str(new_level_forest
), ldb
.FLAG_MOD_REPLACE
,
223 "msDS-Behavior-Version")
225 msgs
.append("Forest function level changed!")
226 msgs
.append("All changes applied successfully!")
227 self
.message("\n".join(msgs
))
229 raise CommandError("Wrong argument '%s'!" % subcommand
)