2 Samba Unix/Linux SMB client library
3 net ads commands for Group Policy
4 Copyright (C) 2005-2008 Guenther Deschner (gd@samba.org)
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "utils/net.h"
25 static int net_ads_gpo_refresh(struct net_context
*c
, int argc
, const char **argv
)
30 const char *dn
= NULL
;
31 struct GROUP_POLICY_OBJECT
*gpo_list
= NULL
;
32 struct GROUP_POLICY_OBJECT
*read_list
= NULL
;
35 struct GROUP_POLICY_OBJECT
*gpo
;
37 struct nt_user_token
*token
= NULL
;
39 if (argc
< 1 || c
->display_usage
) {
41 "net ads gpo refresh <username|machinename>\n"
42 " Lists all GPOs assigned to an account and "
44 " username\tUser to refresh GPOs for\n"
45 " machinename\tMachine to refresh GPOs for\n"));
49 mem_ctx
= talloc_init("net_ads_gpo_refresh");
50 if (mem_ctx
== NULL
) {
54 status
= ads_startup(c
, false, &ads
);
55 if (!ADS_ERR_OK(status
)) {
56 d_printf(_("failed to connect AD server: %s\n"), ads_errstr(status
));
60 status
= ads_find_samaccount(ads
, mem_ctx
, argv
[0], &uac
, &dn
);
61 if (!ADS_ERR_OK(status
)) {
62 d_printf(_("failed to find samaccount for %s\n"), argv
[0]);
66 if (uac
& UF_WORKSTATION_TRUST_ACCOUNT
) {
67 flags
|= GPO_LIST_FLAG_MACHINE
;
70 d_printf(_("\n%s: '%s' has dn: '%s'\n\n"),
71 (uac
& UF_WORKSTATION_TRUST_ACCOUNT
) ? _("machine") : _("user"),
74 d_printf(_("* fetching token "));
75 if (uac
& UF_WORKSTATION_TRUST_ACCOUNT
) {
76 status
= gp_get_machine_token(ads
, mem_ctx
, NULL
, dn
, &token
);
78 status
= ads_get_sid_token(ads
, mem_ctx
, dn
, &token
);
81 if (!ADS_ERR_OK(status
)) {
82 d_printf(_("failed: %s\n"), ads_errstr(status
));
85 d_printf(_("finished\n"));
87 d_printf(_("* fetching GPO List "));
88 status
= ads_get_gpo_list(ads
, mem_ctx
, dn
, flags
, token
, &gpo_list
);
89 if (!ADS_ERR_OK(status
)) {
90 d_printf(_("failed: %s\n"),
94 d_printf(_("finished\n"));
96 d_printf(_("* Refreshing Group Policy Data "));
97 if (!NT_STATUS_IS_OK(result
= check_refresh_gpo_list(ads
, mem_ctx
,
98 cache_path(GPO_CACHE_DIR
),
102 d_printf(_("failed: %s\n"), nt_errstr(result
));
105 d_printf(_("finished\n"));
107 d_printf(_("* storing GPO list to registry "));
110 WERROR werr
= gp_reg_state_store(mem_ctx
, flags
, dn
,
112 if (!W_ERROR_IS_OK(werr
)) {
113 d_printf(_("failed: %s\n"), win_errstr(werr
));
118 d_printf(_("finished\n"));
120 if (c
->opt_verbose
) {
122 d_printf(_("* dumping GPO list\n"));
124 for (gpo
= gpo_list
; gpo
; gpo
= gpo
->next
) {
126 dump_gpo(ads
, mem_ctx
, gpo
, 0);
128 char *server
, *share
, *nt_path
, *unix_path
;
130 d_printf("--------------------------------------\n");
131 d_printf("Name:\t\t\t%s\n", gpo
->display_name
);
132 d_printf("LDAP GPO version:\t%d (user: %d, machine: %d)\n",
134 GPO_VERSION_USER(gpo
->version
),
135 GPO_VERSION_MACHINE(gpo
->version
));
137 result
= gpo_explode_filesyspath(mem_ctx
, gpo
->file_sys_path
,
138 &server
, &share
, &nt_path
,
140 if (!NT_STATUS_IS_OK(result
)) {
141 d_printf("got: %s\n", nt_errstr(result
));
144 d_printf("GPO stored on server: %s, share: %s\n", server
, share
);
145 d_printf("\tremote path:\t%s\n", nt_path
);
146 d_printf("\tlocal path:\t%s\n", unix_path
);
151 d_printf(_("* re-reading GPO list from registry "));
154 WERROR werr
= gp_reg_state_read(mem_ctx
, flags
,
155 &token
->user_sids
[0],
157 if (!W_ERROR_IS_OK(werr
)) {
158 d_printf(_("failed: %s\n"), win_errstr(werr
));
163 d_printf(_("finished\n"));
165 if (c
->opt_verbose
) {
167 d_printf(_("* dumping GPO list from registry\n"));
169 for (gpo
= read_list
; gpo
; gpo
= gpo
->next
) {
171 dump_gpo(ads
, mem_ctx
, gpo
, 0);
174 char *server
, *share
, *nt_path
, *unix_path
;
176 d_printf("--------------------------------------\n");
177 d_printf("Name:\t\t\t%s\n", gpo
->display_name
);
178 d_printf("LDAP GPO version:\t%d (user: %d, machine: %d)\n",
180 GPO_VERSION_USER(gpo
->version
),
181 GPO_VERSION_MACHINE(gpo
->version
));
183 result
= gpo_explode_filesyspath(mem_ctx
, gpo
->file_sys_path
,
184 &server
, &share
, &nt_path
,
186 if (!NT_STATUS_IS_OK(result
)) {
187 d_printf("got: %s\n", nt_errstr(result
));
190 d_printf("GPO stored on server: %s, share: %s\n", server
, share
);
191 d_printf("\tremote path:\t%s\n", nt_path
);
192 d_printf("\tlocal path:\t%s\n", unix_path
);
199 talloc_destroy(mem_ctx
);
203 static int net_ads_gpo_list_all(struct net_context
*c
, int argc
, const char **argv
)
207 LDAPMessage
*res
= NULL
;
209 LDAPMessage
*msg
= NULL
;
210 struct GROUP_POLICY_OBJECT gpo
;
213 const char *attrs
[] = {
219 "gPCMachineExtensionNames",
220 "gPCUserExtensionNames",
221 "ntSecurityDescriptor",
225 if (c
->display_usage
) {
226 d_printf(_("Usage:\n"
227 "net ads gpo listall\n"
228 " List all GPOs on the DC\n"));
232 mem_ctx
= talloc_init("net_ads_gpo_list_all");
233 if (mem_ctx
== NULL
) {
237 status
= ads_startup(c
, false, &ads
);
238 if (!ADS_ERR_OK(status
)) {
242 status
= ads_do_search_all_sd_flags(ads
, ads
->config
.bind_path
,
244 "(objectclass=groupPolicyContainer)",
246 DACL_SECURITY_INFORMATION
,
249 if (!ADS_ERR_OK(status
)) {
250 d_printf(_("search failed: %s\n"), ads_errstr(status
));
254 num_reply
= ads_count_replies(ads
, res
);
256 d_printf(_("Got %d replies\n\n"), num_reply
);
258 /* dump the results */
259 for (msg
= ads_first_entry(ads
, res
);
261 msg
= ads_next_entry(ads
, msg
)) {
263 if ((dn
= ads_get_dn(ads
, mem_ctx
, msg
)) == NULL
) {
267 status
= ads_parse_gpo(ads
, mem_ctx
, msg
, dn
, &gpo
);
269 if (!ADS_ERR_OK(status
)) {
270 d_printf(_("ads_parse_gpo failed: %s\n"),
275 dump_gpo(ads
, mem_ctx
, &gpo
, 0);
279 ads_msgfree(ads
, res
);
281 TALLOC_FREE(mem_ctx
);
287 static int net_ads_gpo_list(struct net_context
*c
, int argc
, const char **argv
)
291 LDAPMessage
*res
= NULL
;
293 const char *dn
= NULL
;
296 struct GROUP_POLICY_OBJECT
*gpo_list
;
297 struct nt_user_token
*token
= NULL
;
299 if (argc
< 1 || c
->display_usage
) {
300 d_printf(_("Usage:\n"
301 "net ads gpo list <username|machinename>\n"
302 " Lists all GPOs for machine/user\n"
303 " username\tUser to list GPOs for\n"
304 " machinename\tMachine to list GPOs for\n"));
308 mem_ctx
= talloc_init("net_ads_gpo_list");
309 if (mem_ctx
== NULL
) {
313 status
= ads_startup(c
, false, &ads
);
314 if (!ADS_ERR_OK(status
)) {
318 status
= ads_find_samaccount(ads
, mem_ctx
, argv
[0], &uac
, &dn
);
319 if (!ADS_ERR_OK(status
)) {
323 if (uac
& UF_WORKSTATION_TRUST_ACCOUNT
) {
324 flags
|= GPO_LIST_FLAG_MACHINE
;
327 d_printf(_("%s: '%s' has dn: '%s'\n"),
328 (uac
& UF_WORKSTATION_TRUST_ACCOUNT
) ? _("machine") : _("user"),
331 if (uac
& UF_WORKSTATION_TRUST_ACCOUNT
) {
332 status
= gp_get_machine_token(ads
, mem_ctx
, NULL
, dn
, &token
);
334 status
= ads_get_sid_token(ads
, mem_ctx
, dn
, &token
);
337 if (!ADS_ERR_OK(status
)) {
341 status
= ads_get_gpo_list(ads
, mem_ctx
, dn
, flags
, token
, &gpo_list
);
342 if (!ADS_ERR_OK(status
)) {
346 dump_gpo_list(ads
, mem_ctx
, gpo_list
, 0);
349 ads_msgfree(ads
, res
);
351 talloc_destroy(mem_ctx
);
358 static int net_ads_gpo_apply(struct net_context
*c
, int argc
, const char **argv
)
363 const char *dn
= NULL
;
364 struct GROUP_POLICY_OBJECT
*gpo_list
;
367 struct nt_user_token
*token
= NULL
;
368 const char *filter
= NULL
;
370 if (argc
< 1 || c
->display_usage
) {
372 "net ads gpo apply <username|machinename>\n"
373 " Apply GPOs for machine/user\n"
374 " username\tUsername to apply GPOs for\n"
375 " machinename\tMachine to apply GPOs for\n");
379 mem_ctx
= talloc_init("net_ads_gpo_apply");
380 if (mem_ctx
== NULL
) {
385 filter
= cse_gpo_name_to_guid_string(argv
[1]);
388 status
= ads_startup(c
, false, &ads
);
389 if (!ADS_ERR_OK(status
)) {
390 d_printf("got: %s\n", ads_errstr(status
));
394 status
= ads_find_samaccount(ads
, mem_ctx
, argv
[0], &uac
, &dn
);
395 if (!ADS_ERR_OK(status
)) {
396 d_printf("failed to find samaccount for %s: %s\n",
397 argv
[0], ads_errstr(status
));
401 if (uac
& UF_WORKSTATION_TRUST_ACCOUNT
) {
402 flags
|= GPO_LIST_FLAG_MACHINE
;
405 if (c
->opt_verbose
) {
406 flags
|= GPO_INFO_FLAG_VERBOSE
;
409 d_printf("%s: '%s' has dn: '%s'\n",
410 (uac
& UF_WORKSTATION_TRUST_ACCOUNT
) ? "machine" : "user",
413 if (uac
& UF_WORKSTATION_TRUST_ACCOUNT
) {
414 status
= gp_get_machine_token(ads
, mem_ctx
, NULL
, dn
, &token
);
416 status
= ads_get_sid_token(ads
, mem_ctx
, dn
, &token
);
419 if (!ADS_ERR_OK(status
)) {
423 status
= ads_get_gpo_list(ads
, mem_ctx
, dn
, flags
, token
, &gpo_list
);
424 if (!ADS_ERR_OK(status
)) {
428 status
= gpo_process_gpo_list(ads
, mem_ctx
, token
, gpo_list
,
430 if (!ADS_ERR_OK(status
)) {
431 d_printf("failed to process gpo list: %s\n",
438 talloc_destroy(mem_ctx
);
443 static int net_ads_gpo_link_get(struct net_context
*c
, int argc
, const char **argv
)
448 struct GP_LINK gp_link
;
450 if (argc
< 1 || c
->display_usage
) {
451 d_printf(_("Usage:\n"
452 "net ads gpo linkget <container>\n"
453 " Lists gPLink of a containter\n"
454 " container\tContainer to get link for\n"));
458 mem_ctx
= talloc_init("add_gpo_link");
459 if (mem_ctx
== NULL
) {
463 status
= ads_startup(c
, false, &ads
);
464 if (!ADS_ERR_OK(status
)) {
468 status
= ads_get_gpo_link(ads
, mem_ctx
, argv
[0], &gp_link
);
469 if (!ADS_ERR_OK(status
)) {
470 d_printf(_("get link for %s failed: %s\n"), argv
[0],
475 dump_gplink(ads
, mem_ctx
, &gp_link
);
478 talloc_destroy(mem_ctx
);
484 static int net_ads_gpo_link_add(struct net_context
*c
, int argc
, const char **argv
)
491 if (argc
< 2 || c
->display_usage
) {
492 d_printf(_("Usage:\n"
493 "net ads gpo linkadd <linkdn> <gpodn> [options]\n"
494 " Link a container to a GPO\n"
495 " linkdn\tContainer to link to a GPO\n"
496 " gpodn\tGPO to link container to\n"));
497 d_printf(_("note: DNs must be provided properly escaped.\n"
498 "See RFC 4514 for details\n"));
502 mem_ctx
= talloc_init("add_gpo_link");
503 if (mem_ctx
== NULL
) {
508 gpo_opt
= atoi(argv
[2]);
511 status
= ads_startup(c
, false, &ads
);
512 if (!ADS_ERR_OK(status
)) {
516 status
= ads_add_gpo_link(ads
, mem_ctx
, argv
[0], argv
[1], gpo_opt
);
517 if (!ADS_ERR_OK(status
)) {
518 d_printf(_("link add failed: %s\n"), ads_errstr(status
));
523 talloc_destroy(mem_ctx
);
531 static int net_ads_gpo_link_delete(struct net_context
*c
, int argc
, const char **argv
)
537 if (argc
< 2 || c
->display_usage
) {
539 "net ads gpo linkdelete <linkdn> <gpodn>\n"
540 " Delete a GPO link\n"
541 " <linkdn>\tContainer to delete GPO from\n"
542 " <gpodn>\tGPO to delete from container\n");
546 mem_ctx
= talloc_init("delete_gpo_link");
547 if (mem_ctx
== NULL
) {
551 status
= ads_startup(c
, false, &ads
);
552 if (!ADS_ERR_OK(status
)) {
556 status
= ads_delete_gpo_link(ads
, mem_ctx
, argv
[0], argv
[1]);
557 if (!ADS_ERR_OK(status
)) {
558 d_printf("delete link failed: %s\n", ads_errstr(status
));
563 talloc_destroy(mem_ctx
);
571 static int net_ads_gpo_get_gpo(struct net_context
*c
, int argc
, const char **argv
)
576 struct GROUP_POLICY_OBJECT gpo
;
578 if (argc
< 1 || c
->display_usage
) {
579 d_printf(_("Usage:\n"
580 "net ads gpo getgpo <gpo>\n"
581 " List speciefied GPO\n"
582 " gpo\t\tGPO to list\n"));
586 mem_ctx
= talloc_init("ads_gpo_get_gpo");
587 if (mem_ctx
== NULL
) {
591 status
= ads_startup(c
, false, &ads
);
592 if (!ADS_ERR_OK(status
)) {
596 if (strnequal(argv
[0], "CN={", strlen("CN={"))) {
597 status
= ads_get_gpo(ads
, mem_ctx
, argv
[0], NULL
, NULL
, &gpo
);
599 status
= ads_get_gpo(ads
, mem_ctx
, NULL
, argv
[0], NULL
, &gpo
);
602 if (!ADS_ERR_OK(status
)) {
603 d_printf(_("get gpo for [%s] failed: %s\n"), argv
[0],
608 dump_gpo(ads
, mem_ctx
, &gpo
, 1);
611 talloc_destroy(mem_ctx
);
617 int net_ads_gpo(struct net_context
*c
, int argc
, const char **argv
)
619 struct functable func
[] = {
625 "Apply GPO to container",
626 "net ads gpo apply\n"
627 " Apply GPO to container"
634 N_("List specified GPO"),
635 N_("net ads gpo getgpo\n"
636 " List specified GPO")
640 net_ads_gpo_link_add
,
642 N_("Link a container to a GPO"),
643 N_("net ads gpo linkadd\n"
644 " Link a container to a GPO")
649 net_ads_gpo_link_delete
,
651 "Delete GPO link from a container",
652 "net ads gpo linkdelete\n"
653 " Delete GPO link from a container"
658 net_ads_gpo_link_get
,
660 N_("Lists gPLink of containter"),
661 N_("net ads gpo linkget\n"
662 " Lists gPLink of containter")
668 N_("Lists all GPOs for machine/user"),
669 N_("net ads gpo list\n"
670 " Lists all GPOs for machine/user")
674 net_ads_gpo_list_all
,
676 N_("Lists all GPOs on a DC"),
677 N_("net ads gpo listall\n"
678 " Lists all GPOs on a DC")
684 N_("Lists all GPOs assigned to an account and "
686 N_("net ads gpo refresh\n"
687 " Lists all GPOs assigned to an account and "
690 {NULL
, NULL
, 0, NULL
, NULL
}
693 return net_run_function(c
, argc
, argv
, "net ads gpo", func
);
696 #endif /* HAVE_ADS */