3 # Raises domain and forest function levels
5 # Copyright Matthias Dieter Wallnoefer 2009
6 # Copyright Jelmer Vernooij 2009
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 # Notice: At the moment we have some more checks to do here on the special
23 # attributes (consider attribute "msDS-Behavior-Version). This is due to the
24 # fact that we on s4 LDB don't implement their change policy (only certain
25 # values, only increments possible...) yet.
27 import samba.getopt as options
30 from samba.auth import system_session
31 from samba.netcmd import (
36 from samba.samdb import SamDB
37 from samba.dsdb import (
38 DS_DOMAIN_FUNCTION_2000,
39 DS_DOMAIN_FUNCTION_2003,
40 DS_DOMAIN_FUNCTION_2003_MIXED,
41 DS_DOMAIN_FUNCTION_2008,
42 DS_DOMAIN_FUNCTION_2008_R2,
46 DS_DC_FUNCTION_2008_R2,
49 class cmd_domainlevel(Command):
50 """Raises domain and forest function levels."""
52 synopsis = "(show | raise <options>)"
54 takes_optiongroups = {
55 "sambaopts": options.SambaOptions,
56 "credopts": options.CredentialsOptions,
57 "versionopts": options.VersionOptions,
61 Option("-H", help="LDB URL for database or target server", type=str),
62 Option("--quiet", help="Be quiet", action="store_true"),
63 Option("--forest", type="choice", choices=["2003", "2008", "2008_R2"],
64 help="The forest function level (2003 | 2008 | 2008_R2)"),
65 Option("--domain", type="choice", choices=["2003", "2008", "2008_R2"],
66 help="The domain function level (2003 | 2008 | 2008_R2)"),
69 takes_args = ["subcommand"]
71 def run(self, subcommand, H=None, forest=None, domain=None, quiet=False,
72 credopts=None, sambaopts=None, versionopts=None):
73 lp = sambaopts.get_loadparm()
74 creds = credopts.get_credentials(lp)
76 samdb = SamDB(url=H, session_info=system_session(),
77 credentials=creds, lp=lp)
79 domain_dn = SamDB.domain_dn(samdb)
81 res_forest = samdb.search("CN=Partitions,CN=Configuration," + domain_dn,
82 scope=ldb.SCOPE_BASE, attrs=["msDS-Behavior-Version"])
83 assert(len(res_forest) == 1)
85 res_domain = samdb.search(domain_dn, scope=ldb.SCOPE_BASE,
86 attrs=["msDS-Behavior-Version", "nTMixedDomain"])
87 assert(len(res_domain) == 1)
89 res_dc_s = samdb.search("CN=Sites,CN=Configuration," + domain_dn,
90 scope=ldb.SCOPE_SUBTREE, expression="(objectClass=nTDSDSA)",
91 attrs=["msDS-Behavior-Version"])
92 assert(len(res_dc_s) >= 1)
95 level_forest = int(res_forest[0]["msDS-Behavior-Version"][0])
96 level_domain = int(res_domain[0]["msDS-Behavior-Version"][0])
97 level_domain_mixed = int(res_domain[0]["nTMixedDomain"][0])
99 min_level_dc = int(res_dc_s[0]["msDS-Behavior-Version"][0]) # Init value
101 if int(msg["msDS-Behavior-Version"][0]) < min_level_dc:
102 min_level_dc = int(msg["msDS-Behavior-Version"][0])
104 if level_forest < 0 or level_domain < 0:
105 raise CommandError("Domain and/or forest function level(s) is/are invalid. Correct them or reprovision!")
107 raise CommandError("Lowest function level of a DC is invalid. Correct this or reprovision!")
108 if level_forest > level_domain:
109 raise CommandError("Forest function level is higher than the domain level(s). Correct this or reprovision!")
110 if level_domain > min_level_dc:
111 raise CommandError("Domain function level is higher than the lowest function level of a DC. Correct this or reprovision!")
114 raise CommandError("Could not retrieve the actual domain, forest level and/or lowest DC function level!")
116 if subcommand == "show":
117 self.message("Domain and forest function level for domain '%s'" % domain_dn)
118 if level_forest < DS_DOMAIN_FUNCTION_2003:
119 self.message("\nATTENTION: You run SAMBA 4 on a forest function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
120 if level_domain < DS_DOMAIN_FUNCTION_2003:
121 self.message("\nATTENTION: You run SAMBA 4 on a domain function level lower than Windows 2003 (Native). This isn't supported! Please raise!")
122 if min_level_dc < DS_DC_FUNCTION_2003:
123 self.message("\nATTENTION: You run SAMBA 4 on a lowest function level of a DC lower than Windows 2003. This isn't supported! Please step-up or upgrade the concerning DC(s)!")
127 if level_forest == DS_DOMAIN_FUNCTION_2000:
129 elif level_forest == DS_DOMAIN_FUNCTION_2003_MIXED:
130 outstr = "2003 with mixed domains/interim (NT4 DC support)"
131 elif level_forest == DS_DOMAIN_FUNCTION_2003:
133 elif level_forest == DS_DOMAIN_FUNCTION_2008:
135 elif level_forest == DS_DOMAIN_FUNCTION_2008_R2:
138 outstr = "higher than 2008 R2"
139 self.message("Forest function level: (Windows) " + outstr)
141 if level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed != 0:
142 outstr = "2000 mixed (NT4 DC support)"
143 elif level_domain == DS_DOMAIN_FUNCTION_2000 and level_domain_mixed == 0:
145 elif level_domain == DS_DOMAIN_FUNCTION_2003_MIXED:
146 outstr = "2003 with mixed domains/interim (NT4 DC support)"
147 elif level_domain == DS_DOMAIN_FUNCTION_2003:
149 elif level_domain == DS_DOMAIN_FUNCTION_2008:
151 elif level_domain == DS_DOMAIN_FUNCTION_2008_R2:
154 outstr = "higher than 2008 R2"
155 self.message("Domain function level: (Windows) " + outstr)
157 if min_level_dc == DS_DC_FUNCTION_2000:
159 elif min_level_dc == DS_DC_FUNCTION_2003:
161 elif min_level_dc == DS_DC_FUNCTION_2008:
163 elif min_level_dc == DS_DC_FUNCTION_2008_R2:
166 outstr = "higher than 2008 R2"
167 self.message("Lowest function level of a DC: (Windows) " + outstr)
169 elif subcommand == "raise":
172 if domain is not None:
174 new_level_domain = DS_DOMAIN_FUNCTION_2003
175 elif domain == "2008":
176 new_level_domain = DS_DOMAIN_FUNCTION_2008
177 elif domain == "2008_R2":
178 new_level_domain = DS_DOMAIN_FUNCTION_2008_R2
180 if new_level_domain <= level_domain and level_domain_mixed == 0:
181 raise CommandError("Domain function level can't be smaller equal to the actual one!")
183 if new_level_domain > min_level_dc:
184 raise CommandError("Domain function level can't be higher than the lowest function level of a DC!")
186 # Deactivate mixed/interim domain support
187 if level_domain_mixed != 0:
189 m.dn = ldb.Dn(samdb, domain_dn)
190 m["nTMixedDomain"] = ldb.MessageElement("0",
191 ldb.FLAG_MOD_REPLACE, "nTMixedDomain")
194 m.dn = ldb.Dn(samdb, domain_dn)
195 m["msDS-Behavior-Version"]= ldb.MessageElement(
196 str(new_level_domain), ldb.FLAG_MOD_REPLACE,
197 "msDS-Behavior-Version")
199 level_domain = new_level_domain
200 msgs.append("Domain function level changed!")
202 if forest is not None:
204 new_level_forest = DS_DOMAIN_FUNCTION_2003
205 elif forest == "2008":
206 new_level_forest = DS_DOMAIN_FUNCTION_2008
207 elif forest == "2008_R2":
208 new_level_forest = DS_DOMAIN_FUNCTION_2008_R2
209 if new_level_forest <= level_forest:
210 raise CommandError("Forest function level can't be smaller equal to the actual one!")
211 if new_level_forest > level_domain:
212 raise CommandError("Forest function level can't be higher than the domain function level(s). Please raise it/them first!")
214 m.dn = ldb.Dn(samdb, "CN=Partitions,CN=Configuration,"
216 m["msDS-Behavior-Version"]= ldb.MessageElement(
217 str(new_level_forest), ldb.FLAG_MOD_REPLACE,
218 "msDS-Behavior-Version")
220 msgs.append("Forest function level changed!")
221 msgs.append("All changes applied successfully!")
222 self.message("\n".join(msgs))
224 raise CommandError("Wrong argument '%s'!" % subcommand)