s4:samldb LDB module - fix "isCriticalSystemObject" behaviour

Tests against Windows Server show that it gets set to "FALSE" (not
deleted) if we change the account type to a domain member.

Reviewed-by: abartlet

diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index aa9d6d30ce9efae9a20646d381e8b5dee486342f..bf91d29709021f764f1a7a976d7208a1d1a1315e 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -911,11 +911,20 @@ static int samldb_objectclass_trigger(struct samldb_ctx *ac)
                        el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
                        el2->flags = LDB_FLAG_MOD_REPLACE;
 
+                       /* "isCriticalSystemObject" might be set */
                        if (user_account_control &
                            (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
-                               ret = samdb_msg_set_string(ldb, ac->msg, ac->msg,
-                                                          "isCriticalSystemObject",
-                                                          "TRUE");
+                               ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+                                                        "TRUE");
+                               if (ret != LDB_SUCCESS) {
+                                       return ret;
+                               }
+                               el2 = ldb_msg_find_element(ac->msg,
+                                                          "isCriticalSystemObject");
+                               el2->flags = LDB_FLAG_MOD_REPLACE;
+                       } else if (user_account_control & UF_WORKSTATION_TRUST_ACCOUNT) {
+                               ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+                                                        "FALSE");
                                if (ret != LDB_SUCCESS) {
                                        return ret;
                                }
@@ -1298,6 +1307,7 @@ static int samldb_user_account_control_change(struct samldb_ctx *ac)
        el = ldb_msg_find_element(ac->msg, "sAMAccountType");
        el->flags = LDB_FLAG_MOD_REPLACE;
 
+       /* "isCriticalSystemObject" might be set/changed */
        if (user_account_control
            & (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
                ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
@@ -1308,6 +1318,15 @@ static int samldb_user_account_control_change(struct samldb_ctx *ac)
                el = ldb_msg_find_element(ac->msg,
                                           "isCriticalSystemObject");
                el->flags = LDB_FLAG_MOD_REPLACE;
+       } else if (user_account_control & UF_WORKSTATION_TRUST_ACCOUNT) {
+               ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+                                        "FALSE");
+               if (ret != LDB_SUCCESS) {
+                       return ret;
+               }
+               el = ldb_msg_find_element(ac->msg,
+                                          "isCriticalSystemObject");
+               el->flags = LDB_FLAG_MOD_REPLACE;
        }
 
        if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {