libds:common Remove DS_DC_* domain functionality flags
[Samba/gebeck_regimport.git] / source4 / scripting / python / samba / netcmd / domainlevel.py
blob69e0afb6007eda5ca1cd33ce70428ba539b886b2
1 #!/usr/bin/python
3 # Raises domain and forest function levels
5 # Copyright Matthias Dieter Wallnoefer 2009
6 # Copyright Jelmer Vernooij 2009
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 # Notice: At the moment we have some more checks to do here on the special
23 # attributes (consider attribute "msDS-Behavior-Version). This is due to the
24 # fact that we on s4 LDB don't implement their change policy (only certain
25 # values, only increments possible...) yet.
27 import samba.getopt as options
28 import ldb
30 from samba.auth import system_session
31 from samba.netcmd import (
32 Command,
33 CommandError,
34 Option,
36 from samba.samdb import SamDB
37 from samba.dsdb import (
38 DS_DOMAIN_FUNCTION_2000,
39 DS_DOMAIN_FUNCTION_2003,
40 DS_DOMAIN_FUNCTION_2003_MIXED,
41 DS_DOMAIN_FUNCTION_2008,
42 DS_DOMAIN_FUNCTION_2008_R2,
45 class cmd_domainlevel(Command):
46 """Raises domain and forest function levels"""
48 synopsis = "(show | raise <options>)"
50 takes_optiongroups = {
51 "sambaopts": options.SambaOptions,
52 "credopts": options.CredentialsOptions,
53 "versionopts": options.VersionOptions,
56 takes_options = [
57 Option("-H", help="LDB URL for database or target server", type=str),
58 Option("--quiet", help="Be quiet", action="store_true"),
59 Option("--forest", type="choice", choices=["2003", "2008", "2008_R2"],
60 help="The forest function level (2003 | 2008 | 2008_R2)"),
61 Option("--domain", type="choice", choices=["2003", "2008", "2008_R2"],
62 help="The domain function level (2003 | 2008 | 2008_R2)"),
65 takes_args = ["subcommand"]
67 def run(self, subcommand, H=None, forest=None, domain=None, quiet=False,
68 credopts=None, sambaopts=None, versionopts=None):
69 lp = sambaopts.get_loadparm()
70 creds = credopts.get_credentials(lp)
72 samdb = SamDB(url=H, session_info=system_session(),
73 credentials=creds, lp=lp)
75 domain_dn = samdb.domain_dn()
77 res_forest = samdb.search("CN=Partitions,CN=Configuration," + domain_dn,
78 scope=ldb.SCOPE_BASE, attrs=["msDS-Behavior-Version"])
79 assert len(res_forest) == 1
81 res_domain = samdb.search(domain_dn, scope=ldb.SCOPE_BASE,
82 attrs=["msDS-Behavior-Version", "nTMixedDomain"])
83 assert len(res_domain) == 1
85 res_dc_s = samdb.search("CN=Sites,CN=Configuration," + domain_dn,
86 scope=ldb.SCOPE_SUBTREE, expression="(objectClass=nTDSDSA)",
87 attrs=["msDS-Behavior-Version"])
88 assert len(res_dc_s) >= 1
90 try:
91 level_forest = int(res_forest[0]["msDS-Behavior-Version"][0])
92 level_domain = int(res_domain[0]["msDS-Behavior-Version"][0])
93 level_domain_mixed = int(res_domain[0]["nTMixedDomain"][0])
95 min_level_dc = int(res_dc_s[0]["msDS-Behavior-Version"][0]) # Init value
96 for msg in res_dc_s:
97 if int(msg["msDS-Behavior-Version"][0]) < min_level_dc:
98 min_level_dc = int(msg["msDS-Behavior-Version"][0])
100 if level_forest < 0 or level_domain < 0:
101 raise CommandError("Domain and/or forest function level(s) is/are invalid. Correct them or reprovision!")
102 if min_level_dc < 0:
103 raise CommandError("Lowest function level of a DC is invalid. Correct this or reprovision!")
104 if level_forest > level_domain:
105 raise CommandError("Forest function level is higher than the domain level(s). Correct this or reprovision!")
106 if level_domain > min_level_dc:
107 raise CommandError("Domain function level is higher than the lowest function level of a DC. Correct this or reprovision!")
109 except KeyError:
110 raise CommandError("Could not retrieve the actual domain, forest level and/or lowest DC function level!")
112 if subcommand == "show":
113 self.message("Domain and forest function level for domain '%s'" % domain_dn)
114 if level_forest < DS_DOMAIN_FUNCTION_2003:
115 self.message("\nATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
116 if level_domain < DS_DOMAIN_FUNCTION_2003:
117 self.message("\nATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
118 if min_level_dc < DS_DOMAIN_FUNCTION_2003:
119 self.message("\nATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!")
121 self.message("")
123 if level_forest == DS_DOMAIN_FUNCTION_2000:
124 outstr = "2000"
125 elif level_forest == DS_DOMAIN_FUNCTION_2003_MIXED:
126 outstr = "2003 with mixed domains/interim (NT4 DC support)"
127 elif level_forest == DS_DOMAIN_FUNCTION_2003:
128 outstr = "2003"
129 elif level_forest == DS_DOMAIN_FUNCTION_2008:
130 outstr = "2008"
131 elif level_forest == DS_DOMAIN_FUNCTION_2008_R2:
132 outstr = "2008 R2"
133 else:
134 outstr = "higher than 2008 R2"
135 self.message("Forest function level: (Windows) " + outstr)
137 if level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0:
138 outstr = "2000 mixed (NT4 DC support)"
139 elif level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed == 0:
140 outstr = "2000"
141 elif level_domain == DS_DOMAIN_FUNCTION_2003_MIXED:
142 outstr = "2003 with mixed domains/interim (NT4 DC support)"
143 elif level_domain == DS_DOMAIN_FUNCTION_2003:
144 outstr = "2003"
145 elif level_domain == DS_DOMAIN_FUNCTION_2008:
146 outstr = "2008"
147 elif level_domain == DS_DOMAIN_FUNCTION_2008_R2:
148 outstr = "2008 R2"
149 else:
150 outstr = "higher than 2008 R2"
151 self.message("Domain function level: (Windows) " + outstr)
153 if min_level_dc == DS_DOMAIN_FUNCTION_2000:
154 outstr = "2000"
155 elif min_level_dc == DS_DOMAIN_FUNCTION_2003:
156 outstr = "2003"
157 elif min_level_dc == DS_DOMAIN_FUNCTION_2008:
158 outstr = "2008"
159 elif min_level_dc == DS_DOMAIN_FUNCTION_2008_R2:
160 outstr = "2008 R2"
161 else:
162 outstr = "higher than 2008 R2"
163 self.message("Lowest function level of a DC: (Windows) " + outstr)
165 elif subcommand == "raise":
166 msgs = []
168 if domain is not None:
169 if domain == "2003":
170 new_level_domain = DS_DOMAIN_FUNCTION_2003
171 elif domain == "2008":
172 new_level_domain = DS_DOMAIN_FUNCTION_2008
173 elif domain == "2008_R2":
174 new_level_domain = DS_DOMAIN_FUNCTION_2008_R2
176 if new_level_domain <= level_domain and level_domain_mixed == 0:
177 raise CommandError("Domain function level can't be smaller equal to the actual one!")
179 if new_level_domain > min_level_dc:
180 raise CommandError("Domain function level can't be higher than the lowest function level of a DC!")
182 # Deactivate mixed/interim domain support
183 if level_domain_mixed != 0:
184 # Directly on the base DN
185 m = ldb.Message()
186 m.dn = ldb.Dn(samdb, domain_dn)
187 m["nTMixedDomain"] = ldb.MessageElement("0",
188 ldb.FLAG_MOD_REPLACE, "nTMixedDomain")
189 samdb.modify(m)
190 # Under partitions
191 m = ldb.Message()
192 m.dn = ldb.Dn(samdb, "CN=" + lp.get("workgroup")
193 + ",CN=Partitions,CN=Configuration," + domain_dn)
194 m["nTMixedDomain"] = ldb.MessageElement("0",
195 ldb.FLAG_MOD_REPLACE, "nTMixedDomain")
196 try:
197 samdb.modify(m)
198 except LdbError, (num, _):
199 if num != ldb.ERR_UNWILLING_TO_PERFORM:
200 raise
202 # Directly on the base DN
203 m = ldb.Message()
204 m.dn = ldb.Dn(samdb, domain_dn)
205 m["msDS-Behavior-Version"]= ldb.MessageElement(
206 str(new_level_domain), ldb.FLAG_MOD_REPLACE,
207 "msDS-Behavior-Version")
208 samdb.modify(m)
209 # Under partitions
210 m = ldb.Message()
211 m.dn = ldb.Dn(samdb, "CN=" + lp.get("workgroup")
212 + ",CN=Partitions,CN=Configuration," + domain_dn)
213 m["msDS-Behavior-Version"]= ldb.MessageElement(
214 str(new_level_domain), ldb.FLAG_MOD_REPLACE,
215 "msDS-Behavior-Version")
216 try:
217 samdb.modify(m)
218 except LdbError, (num, _):
219 if num != ldb.ERR_UNWILLING_TO_PERFORM:
220 raise
222 level_domain = new_level_domain
223 msgs.append("Domain function level changed!")
225 if forest is not None:
226 if forest == "2003":
227 new_level_forest = DS_DOMAIN_FUNCTION_2003
228 elif forest == "2008":
229 new_level_forest = DS_DOMAIN_FUNCTION_2008
230 elif forest == "2008_R2":
231 new_level_forest = DS_DOMAIN_FUNCTION_2008_R2
232 if new_level_forest <= level_forest:
233 raise CommandError("Forest function level can't be smaller equal to the actual one!")
234 if new_level_forest > level_domain:
235 raise CommandError("Forest function level can't be higher than the domain function level(s). Please raise it/them first!")
236 m = ldb.Message()
237 m.dn = ldb.Dn(samdb, "CN=Partitions,CN=Configuration,"
238 + domain_dn)
239 m["msDS-Behavior-Version"]= ldb.MessageElement(
240 str(new_level_forest), ldb.FLAG_MOD_REPLACE,
241 "msDS-Behavior-Version")
242 samdb.modify(m)
243 msgs.append("Forest function level changed!")
244 msgs.append("All changes applied successfully!")
245 self.message("\n".join(msgs))
246 else:
247 raise CommandError("Wrong argument '%s'!" % subcommand)