3 # Raises domain and forest function levels
5 # Copyright Matthias Dieter Wallnoefer 2009
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
21 # Notice: At the moment we have some more checks to do here on the special
22 # attributes (consider attribute "msDS-Behavior-Version). This is due to the
23 # fact that we on s4 LDB don't implement their change policy (only certain
24 # values, only increments possible...) yet.
28 # Find right directory when running from source tree
29 sys
.path
.insert(0, "bin/python")
31 import samba
.getopt
as options
35 from samba
.auth
import system_session
36 from samba
.samdb
import SamDB
37 from samba
import DS_DOMAIN_FUNCTION_2000
, DS_DOMAIN_FUNCTION_2003
38 from samba
import DS_DOMAIN_FUNCTION_2003_MIXED
, DS_DOMAIN_FUNCTION_2008
39 from samba
import DS_DOMAIN_FUNCTION_2008_R2
40 from samba
import DS_DC_FUNCTION_2000
, DS_DC_FUNCTION_2003
, DS_DC_FUNCTION_2008
41 from samba
import DS_DC_FUNCTION_2008_R2
43 parser
= optparse
.OptionParser("domainlevel (show | raise <options>)")
44 sambaopts
= options
.SambaOptions(parser
)
45 parser
.add_option_group(sambaopts
)
46 parser
.add_option_group(options
.VersionOptions(parser
))
47 credopts
= options
.CredentialsOptions(parser
)
48 parser
.add_option_group(credopts
)
49 parser
.add_option("-H", help="LDB URL for database or target server", type=str)
50 parser
.add_option("--quiet", help="Be quiet", action
="store_true")
51 parser
.add_option("--forest", type="choice",
52 choices
=["2003", "2008", "2008_R2"],
53 help="The forest function level (2003 | 2008 | 2008_R2)")
54 parser
.add_option("--domain", type="choice",
55 choices
=["2003", "2008", "2008_R2"],
56 help="The domain function level (2003 | 2008 | 2008_R2)")
57 opts
, args
= parser
.parse_args()
60 # print a message if quiet is not set
70 lp
= sambaopts
.get_loadparm()
71 creds
= credopts
.get_credentials(lp
)
73 if opts
.H
is not None:
76 url
= lp
.get("sam database")
78 samdb
= SamDB(url
=url
, session_info
=system_session(), credentials
=creds
, lp
=lp
)
80 domain_dn
= SamDB
.domain_dn(samdb
)
82 res_forest
= samdb
.search("CN=Partitions,CN=Configuration," + domain_dn
,
83 scope
=ldb
.SCOPE_BASE
, attrs
=["msDS-Behavior-Version"])
84 assert(len(res_forest
) == 1)
86 res_domain
= samdb
.search(domain_dn
, scope
=ldb
.SCOPE_BASE
,
87 attrs
=["msDS-Behavior-Version", "nTMixedDomain"])
88 assert(len(res_domain
) == 1)
90 res_dc_s
= samdb
.search("CN=Sites,CN=Configuration," + domain_dn
,
91 scope
=ldb
.SCOPE_SUBTREE
, expression
="(objectClass=nTDSDSA)",
92 attrs
=["msDS-Behavior-Version"])
93 assert(len(res_dc_s
) >= 1)
96 level_forest
= int(res_forest
[0]["msDS-Behavior-Version"][0])
97 level_domain
= int(res_domain
[0]["msDS-Behavior-Version"][0])
98 level_domain_mixed
= int(res_domain
[0]["nTMixedDomain"][0])
100 min_level_dc
= int(res_dc_s
[0]["msDS-Behavior-Version"][0]) # Init value
102 if int(msg
["msDS-Behavior-Version"][0]) < min_level_dc
:
103 min_level_dc
= int(msg
["msDS-Behavior-Version"][0])
105 if level_forest
< 0 or level_domain
< 0:
106 print >>sys
.stderr
, "ERROR: Domain and/or forest function level(s) is/are invalid. Correct them or reprovision!"
109 print >>sys
.stderr
, "ERROR: Lowest function level of a DC is invalid. Correct this or reprovision!"
111 if level_forest
> level_domain
:
112 print >>sys
.stderr
, "ERROR: Forest function level is higher than the domain level(s). Correct this or reprovision!"
114 if level_domain
> min_level_dc
:
115 print >>sys
.stderr
, "ERROR: Domain function level is higher than the lowest function level of a DC. Correct this or reprovision!"
119 print >>sys
.stderr
, "ERROR: Could not retrieve the actual domain, forest level and/or lowest DC function level!"
120 if args
[0] == "show":
121 print >>sys
.stderr
, "So the levels can't be displayed!"
124 if args
[0] == "show":
125 message("Domain and forest function level for domain '" + domain_dn
+ "'")
126 if level_forest
< DS_DOMAIN_FUNCTION_2003
:
127 message("\nATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
128 if level_domain
< DS_DOMAIN_FUNCTION_2003
:
129 message("\nATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
130 if min_level_dc
< DS_DC_FUNCTION_2003
:
131 message("\nATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!")
135 if level_forest
== DS_DOMAIN_FUNCTION_2000
:
137 elif level_forest
== DS_DOMAIN_FUNCTION_2003_MIXED
:
138 outstr
= "2003 with mixed domains/interim (NT4 DC support)"
139 elif level_forest
== DS_DOMAIN_FUNCTION_2003
:
141 elif level_forest
== DS_DOMAIN_FUNCTION_2008
:
143 elif level_forest
== DS_DOMAIN_FUNCTION_2008_R2
:
146 outstr
= "higher than 2008 R2"
147 message("Forest function level: (Windows) " + outstr
)
149 if level_domain
== DS_DOMAIN_FUNCTION_2000
and level_domain_mixed
!= 0:
150 outstr
= "2000 mixed (NT4 DC support)"
151 elif level_domain
== DS_DOMAIN_FUNCTION_2000
and level_domain_mixed
== 0:
153 elif level_domain
== DS_DOMAIN_FUNCTION_2003_MIXED
:
154 outstr
= "2003 with mixed domains/interim (NT4 DC support)"
155 elif level_domain
== DS_DOMAIN_FUNCTION_2003
:
157 elif level_domain
== DS_DOMAIN_FUNCTION_2008
:
159 elif level_domain
== DS_DOMAIN_FUNCTION_2008_R2
:
162 outstr
= "higher than 2008 R2"
163 message("Domain function level: (Windows) " + outstr
)
165 if min_level_dc
== DS_DC_FUNCTION_2000
:
167 elif min_level_dc
== DS_DC_FUNCTION_2003
:
169 elif min_level_dc
== DS_DC_FUNCTION_2008
:
171 elif min_level_dc
== DS_DC_FUNCTION_2008_R2
:
174 outstr
= "higher than 2008 R2"
175 message("Lowest function level of a DC: (Windows) " + outstr
)
177 elif args
[0] == "raise":
180 if opts
.domain
is not None:
184 new_level_domain
= DS_DOMAIN_FUNCTION_2003
186 new_level_domain
= DS_DOMAIN_FUNCTION_2008
187 elif arg
== "2008_R2":
188 new_level_domain
= DS_DOMAIN_FUNCTION_2008_R2
190 if new_level_domain
<= level_domain
and level_domain_mixed
== 0:
191 print >>sys
.stderr
, "ERROR: Domain function level can't be smaller equal to the actual one!"
194 if new_level_domain
> min_level_dc
:
195 print >>sys
.stderr
, "ERROR: Domain function level can't be higher than the lowest function level of a DC!"
198 # Deactivate mixed/interim domain support
199 if level_domain_mixed
!= 0:
201 m
.dn
= ldb
.Dn(samdb
, domain_dn
)
202 m
["nTMixedDomain"] = ldb
.MessageElement("0",
203 ldb
.FLAG_MOD_REPLACE
, "nTMixedDomain")
207 m
.dn
= ldb
.Dn(samdb
, domain_dn
)
208 m
["msDS-Behavior-Version"]= ldb
.MessageElement(
209 str(new_level_domain
), ldb
.FLAG_MOD_REPLACE
,
210 "msDS-Behavior-Version")
213 level_domain
= new_level_domain
215 msgs
.append("Domain function level changed!")
217 if opts
.forest
is not None:
221 new_level_forest
= DS_DOMAIN_FUNCTION_2003
223 new_level_forest
= DS_DOMAIN_FUNCTION_2008
224 elif arg
== "2008_R2":
225 new_level_forest
= DS_DOMAIN_FUNCTION_2008_R2
227 if new_level_forest
<= level_forest
:
228 print >>sys
.stderr
, "ERROR: Forest function level can't be smaller equal to the actual one!"
231 if new_level_forest
> level_domain
:
232 print >>sys
.stderr
, "ERROR: Forest function level can't be higher than the domain function level(s). Please raise it/them first!"
236 m
.dn
= ldb
.Dn(samdb
, "CN=Partitions,CN=Configuration,"
238 m
["msDS-Behavior-Version"]= ldb
.MessageElement(
239 str(new_level_forest
), ldb
.FLAG_MOD_REPLACE
,
240 "msDS-Behavior-Version")
243 msgs
.append("Forest function level changed!")
245 msgs
.append("All changes applied successfully!")
247 message("\n".join(msgs
))
249 print >>sys
.stderr
, "ERROR: Wrong argument '" + args
[0] + "'!"