3 # Raises domain and forest function levels
5 # Copyright Matthias Dieter Wallnoefer 2009
6 # Copyright Jelmer Vernooij 2009
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 # Notice: At the moment we have some more checks to do here on the special
23 # attributes (consider attribute "msDS-Behavior-Version). This is due to the
24 # fact that we on s4 LDB don't implement their change policy (only certain
25 # values, only increments possible...) yet.
27 import samba
.getopt
as options
30 from samba
.auth
import system_session
31 from samba
.netcmd
import (
36 from samba
.samdb
import SamDB
37 from samba
.dsdb
import (
38 DS_DOMAIN_FUNCTION_2000
,
39 DS_DOMAIN_FUNCTION_2003
,
40 DS_DOMAIN_FUNCTION_2003_MIXED
,
41 DS_DOMAIN_FUNCTION_2008
,
42 DS_DOMAIN_FUNCTION_2008_R2
,
45 class cmd_domainlevel(Command
):
46 """Raises domain and forest function levels"""
48 synopsis
= "(show | raise <options>)"
50 takes_optiongroups
= {
51 "sambaopts": options
.SambaOptions
,
52 "credopts": options
.CredentialsOptions
,
53 "versionopts": options
.VersionOptions
,
57 Option("-H", help="LDB URL for database or target server", type=str),
58 Option("--quiet", help="Be quiet", action
="store_true"),
59 Option("--forest", type="choice", choices
=["2003", "2008", "2008_R2"],
60 help="The forest function level (2003 | 2008 | 2008_R2)"),
61 Option("--domain", type="choice", choices
=["2003", "2008", "2008_R2"],
62 help="The domain function level (2003 | 2008 | 2008_R2)"),
65 takes_args
= ["subcommand"]
67 def run(self
, subcommand
, H
=None, forest
=None, domain
=None, quiet
=False,
68 credopts
=None, sambaopts
=None, versionopts
=None):
69 lp
= sambaopts
.get_loadparm()
70 creds
= credopts
.get_credentials(lp
)
72 samdb
= SamDB(url
=H
, session_info
=system_session(),
73 credentials
=creds
, lp
=lp
)
75 domain_dn
= samdb
.domain_dn()
77 res_forest
= samdb
.search("CN=Partitions,CN=Configuration," + domain_dn
,
78 scope
=ldb
.SCOPE_BASE
, attrs
=["msDS-Behavior-Version"])
79 assert len(res_forest
) == 1
81 res_domain
= samdb
.search(domain_dn
, scope
=ldb
.SCOPE_BASE
,
82 attrs
=["msDS-Behavior-Version", "nTMixedDomain"])
83 assert len(res_domain
) == 1
85 res_dc_s
= samdb
.search("CN=Sites,CN=Configuration," + domain_dn
,
86 scope
=ldb
.SCOPE_SUBTREE
, expression
="(objectClass=nTDSDSA)",
87 attrs
=["msDS-Behavior-Version"])
88 assert len(res_dc_s
) >= 1
91 level_forest
= int(res_forest
[0]["msDS-Behavior-Version"][0])
92 level_domain
= int(res_domain
[0]["msDS-Behavior-Version"][0])
93 level_domain_mixed
= int(res_domain
[0]["nTMixedDomain"][0])
95 min_level_dc
= int(res_dc_s
[0]["msDS-Behavior-Version"][0]) # Init value
97 if int(msg
["msDS-Behavior-Version"][0]) < min_level_dc
:
98 min_level_dc
= int(msg
["msDS-Behavior-Version"][0])
100 if level_forest
< 0 or level_domain
< 0:
101 raise CommandError("Domain and/or forest function level(s) is/are invalid. Correct them or reprovision!")
103 raise CommandError("Lowest function level of a DC is invalid. Correct this or reprovision!")
104 if level_forest
> level_domain
:
105 raise CommandError("Forest function level is higher than the domain level(s). Correct this or reprovision!")
106 if level_domain
> min_level_dc
:
107 raise CommandError("Domain function level is higher than the lowest function level of a DC. Correct this or reprovision!")
110 raise CommandError("Could not retrieve the actual domain, forest level and/or lowest DC function level!")
112 if subcommand
== "show":
113 self
.message("Domain and forest function level for domain '%s'" % domain_dn
)
114 if level_forest
< DS_DOMAIN_FUNCTION_2003
:
115 self
.message("\nATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
116 if level_domain
< DS_DOMAIN_FUNCTION_2003
:
117 self
.message("\nATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
118 if min_level_dc
< DS_DOMAIN_FUNCTION_2003
:
119 self
.message("\nATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!")
123 if level_forest
== DS_DOMAIN_FUNCTION_2000
:
125 elif level_forest
== DS_DOMAIN_FUNCTION_2003_MIXED
:
126 outstr
= "2003 with mixed domains/interim (NT4 DC support)"
127 elif level_forest
== DS_DOMAIN_FUNCTION_2003
:
129 elif level_forest
== DS_DOMAIN_FUNCTION_2008
:
131 elif level_forest
== DS_DOMAIN_FUNCTION_2008_R2
:
134 outstr
= "higher than 2008 R2"
135 self
.message("Forest function level: (Windows) " + outstr
)
137 if level_domain
== DS_DOMAIN_FUNCTION_2000
and level_domain_mixed
!= 0:
138 outstr
= "2000 mixed (NT4 DC support)"
139 elif level_domain
== DS_DOMAIN_FUNCTION_2000
and level_domain_mixed
== 0:
141 elif level_domain
== DS_DOMAIN_FUNCTION_2003_MIXED
:
142 outstr
= "2003 with mixed domains/interim (NT4 DC support)"
143 elif level_domain
== DS_DOMAIN_FUNCTION_2003
:
145 elif level_domain
== DS_DOMAIN_FUNCTION_2008
:
147 elif level_domain
== DS_DOMAIN_FUNCTION_2008_R2
:
150 outstr
= "higher than 2008 R2"
151 self
.message("Domain function level: (Windows) " + outstr
)
153 if min_level_dc
== DS_DOMAIN_FUNCTION_2000
:
155 elif min_level_dc
== DS_DOMAIN_FUNCTION_2003
:
157 elif min_level_dc
== DS_DOMAIN_FUNCTION_2008
:
159 elif min_level_dc
== DS_DOMAIN_FUNCTION_2008_R2
:
162 outstr
= "higher than 2008 R2"
163 self
.message("Lowest function level of a DC: (Windows) " + outstr
)
165 elif subcommand
== "raise":
168 if domain
is not None:
170 new_level_domain
= DS_DOMAIN_FUNCTION_2003
171 elif domain
== "2008":
172 new_level_domain
= DS_DOMAIN_FUNCTION_2008
173 elif domain
== "2008_R2":
174 new_level_domain
= DS_DOMAIN_FUNCTION_2008_R2
176 if new_level_domain
<= level_domain
and level_domain_mixed
== 0:
177 raise CommandError("Domain function level can't be smaller equal to the actual one!")
179 if new_level_domain
> min_level_dc
:
180 raise CommandError("Domain function level can't be higher than the lowest function level of a DC!")
182 # Deactivate mixed/interim domain support
183 if level_domain_mixed
!= 0:
184 # Directly on the base DN
186 m
.dn
= ldb
.Dn(samdb
, domain_dn
)
187 m
["nTMixedDomain"] = ldb
.MessageElement("0",
188 ldb
.FLAG_MOD_REPLACE
, "nTMixedDomain")
192 m
.dn
= ldb
.Dn(samdb
, "CN=" + lp
.get("workgroup")
193 + ",CN=Partitions,CN=Configuration," + domain_dn
)
194 m
["nTMixedDomain"] = ldb
.MessageElement("0",
195 ldb
.FLAG_MOD_REPLACE
, "nTMixedDomain")
198 except LdbError
, (num
, _
):
199 if num
!= ldb
.ERR_UNWILLING_TO_PERFORM
:
202 # Directly on the base DN
204 m
.dn
= ldb
.Dn(samdb
, domain_dn
)
205 m
["msDS-Behavior-Version"]= ldb
.MessageElement(
206 str(new_level_domain
), ldb
.FLAG_MOD_REPLACE
,
207 "msDS-Behavior-Version")
211 m
.dn
= ldb
.Dn(samdb
, "CN=" + lp
.get("workgroup")
212 + ",CN=Partitions,CN=Configuration," + domain_dn
)
213 m
["msDS-Behavior-Version"]= ldb
.MessageElement(
214 str(new_level_domain
), ldb
.FLAG_MOD_REPLACE
,
215 "msDS-Behavior-Version")
218 except LdbError
, (num
, _
):
219 if num
!= ldb
.ERR_UNWILLING_TO_PERFORM
:
222 level_domain
= new_level_domain
223 msgs
.append("Domain function level changed!")
225 if forest
is not None:
227 new_level_forest
= DS_DOMAIN_FUNCTION_2003
228 elif forest
== "2008":
229 new_level_forest
= DS_DOMAIN_FUNCTION_2008
230 elif forest
== "2008_R2":
231 new_level_forest
= DS_DOMAIN_FUNCTION_2008_R2
232 if new_level_forest
<= level_forest
:
233 raise CommandError("Forest function level can't be smaller equal to the actual one!")
234 if new_level_forest
> level_domain
:
235 raise CommandError("Forest function level can't be higher than the domain function level(s). Please raise it/them first!")
237 m
.dn
= ldb
.Dn(samdb
, "CN=Partitions,CN=Configuration,"
239 m
["msDS-Behavior-Version"]= ldb
.MessageElement(
240 str(new_level_forest
), ldb
.FLAG_MOD_REPLACE
,
241 "msDS-Behavior-Version")
243 msgs
.append("Forest function level changed!")
244 msgs
.append("All changes applied successfully!")
245 self
.message("\n".join(msgs
))
247 raise CommandError("Wrong argument '%s'!" % subcommand
)