docs-xml/manpages/samba-tool.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="samba-tool.8">
   4
   5 <refmeta>
   6         <refentrytitle>samba-tool</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
  10         <refmiscinfo class="version">&doc.version;</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>samba-tool</refname>
  16         <refpurpose>Main Samba administration tool.
  17         </refpurpose>
  18 </refnamediv>
  19
  20 <refsynopsisdiv>
  21         <cmdsynopsis>
  22                 <command>samba-tool</command>
  23                 <arg choice="opt">-h</arg>
  24                 <arg choice="opt">-W myworkgroup</arg>
  25                 <arg choice="opt">-U user</arg>
  26                 <arg choice="opt">-d debuglevel</arg>
  27                 <arg choice="opt">--v</arg>
  28         </cmdsynopsis>
  29 </refsynopsisdiv>
  30
  31 <refsect1>
  32         <title>DESCRIPTION</title>
  33         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  34         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  35 </refsect1>
  36
  37 <refsect1>
  38         <title>OPTIONS</title>
  39
  40         <variablelist>
  41
  42         <varlistentry>
  43         <term>-h|--help</term>
  44         <listitem><para>
  45         Show this help message and exit
  46         </para></listitem>
  47         </varlistentry>
  48
  49         <varlistentry>
  50         <term>--realm=REALM</term>
  51         <listitem><para>
  52         Set the realm name
  53         </para></listitem>
  54         </varlistentry>
  55
  56         <varlistentry>
  57         <term>--simple-bind-dn=DN</term>
  58         <listitem><para>
  59         DN to use for a simple bind
  60         </para></listitem>
  61         </varlistentry>
  62
  63         <varlistentry>
  64         <term>--password=PASSWORD</term>
  65         <listitem><para>
  66         Password
  67         </para></listitem>
  68         </varlistentry>
  69
  70         <varlistentry>
  71         <term>-U USERNAME|--username=USERNAME</term>
  72         <listitem><para>
  73         Username
  74         </para></listitem>
  75         </varlistentry>
  76
  77         <varlistentry>
  78         <term>-W WORKGROUP|--workgroup=WORKGROUP</term>
  79         <listitem><para>
  80         Workgroup
  81         </para></listitem>
  82         </varlistentry>
  83
  84         <varlistentry>
  85         <term>-N|--no-pass</term>
  86         <listitem><para>
  87         Don't ask for a password
  88         </para></listitem>
  89         </varlistentry>
  90
  91         <varlistentry>
  92         <term>-k KERBEROS|--kerberos=KERBEROS</term>
  93         <listitem><para>
  94         Use Kerberos
  95         </para></listitem>
  96         </varlistentry>
  97
  98         <varlistentry>
  99         <term>--ipaddress=IPADDRESS</term>
 100         <listitem><para>
 101         IP address of the server
 102         </para></listitem>
 103         </varlistentry>
 104
 105         &popt.common.samba.client;
 106
 107         </variablelist>
 108 </refsect1>
 109
 110 <refsect1>
 111 <title>COMMANDS</title>
 112
 113 <refsect3>
 114         <title>computer create <replaceable>computername</replaceable> [options]</title>
 115         <para>Create a new computer in the Active Directory Domain.</para>
 116         <para>The new computer name specified on the command is the
 117         sAMAccountName, with or without the trailing dollar sign.</para>
 118
 119         <variablelist>
 120         <varlistentry>
 121         <term>--computerou=COMPUTEROU</term>
 122         <listitem><para>
 123         DN of alternative location (with or without domainDN counterpart) to
 124         default CN=Computers in which new computer object will be created.
 125         E.g. 'OU=OUname'.
 126         </para></listitem>
 127         </varlistentry>
 128
 129         <varlistentry>
 130         <term>--description=DESCRIPTION</term>
 131         <listitem><para>
 132         The new computers's description.
 133         </para></listitem>
 134         </varlistentry>
 135
 136         <varlistentry>
 137         <term>--ip-address=IP_ADDRESS_LIST</term>
 138         <listitem><para>
 139         IPv4 address for the computer's A record, or IPv6 address for AAAA record,
 140         can be provided multiple times.
 141         </para></listitem>
 142         </varlistentry>
 143
 144         <varlistentry>
 145         <term>--service-principal-name=SERVICE_PRINCIPAL_NAME_LIST</term>
 146         <listitem><para>
 147         Computer's Service Principal Name, can be provided multiple times.
 148         </para></listitem>
 149         </varlistentry>
 150
 151         <varlistentry>
 152         <term>--prepare-oldjoin</term>
 153         <listitem><para>
 154         Prepare enabled machine account for oldjoin mechanism.
 155         </para></listitem>
 156         </varlistentry>
 157         </variablelist>
 158 </refsect3>
 159
 160 <refsect3>
 161         <title>computer delete <replaceable>computername</replaceable> [options]</title>
 162         <para>Delete an existing computer account.</para>
 163         <para>The computer name specified on the command is the
 164         sAMAccountName, with or without the trailing dollar sign.</para>
 165 </refsect3>
 166
 167 <refsect3>
 168         <title>computer list</title>
 169         <para>List all computers.</para>
 170 </refsect3>
 171
 172 <refsect3>
 173         <title>computer move <replaceable>computername</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 174         <para>This command moves a computer account into the specified
 175         organizational unit or container.</para>
 176         <para>The computername specified on the command is the
 177         sAMAccountName, with or without the trailing dollar sign.</para>
 178         <para>The name of the organizational unit or container can be
 179         specified as a full DN or without the domainDN component.</para>
 180 </refsect3>
 181
 182 <refsect3>
 183         <title>computer show <replaceable>computername</replaceable> [options]</title>
 184         <para>Display a computer AD object.</para>
 185         <para>The computer name specified on the command is the
 186         sAMAccountName, with or without the trailing dollar sign.</para>
 187
 188         <variablelist>
 189         <varlistentry>
 190         <term>--attributes=USER_ATTRS</term>
 191         <listitem><para>
 192         Comma separated list of attributes, which will be printed.
 193         </para></listitem>
 194         </varlistentry>
 195         </variablelist>
 196 </refsect3>
 197
 198 <refsect2>
 199         <title>dbcheck</title>
 200         <para>Check the local AD database for errors.</para>
 201 </refsect2>
 202
 203 <refsect2>
 204         <title>delegation</title>
 205         <para>Manage Delegations.</para>
 206 </refsect2>
 207
 208 <refsect3>
 209         <title>delegation add-service <replaceable>accountname</replaceable> <replaceable>principal</replaceable> [options]</title>
 210         <para>Add a service principal as msDS-AllowedToDelegateTo.</para>
 211 </refsect3>
 212
 213 <refsect3>
 214         <title>delegation del-service <replaceable>accountname</replaceable> <replaceable>principal</replaceable> [options]</title>
 215         <para>Delete a service principal as msDS-AllowedToDelegateTo.</para>
 216 </refsect3>
 217
 218 <refsect3>
 219         <title>delegation for-any-protocol <replaceable>accountname</replaceable> [(on|off)] [options]</title>
 220         <para>Set/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy)
 221         for an account.</para>
 222 </refsect3>
 223
 224 <refsect3>
 225         <title>delegation for-any-service <replaceable>accountname</replaceable> [(on|off)] [options]</title>
 226         <para>Set/unset UF_TRUSTED_FOR_DELEGATION for an account.</para>
 227 </refsect3>
 228
 229 <refsect3>
 230         <title>delegation show <replaceable>accountname</replaceable> [options] </title>
 231         <para>Show the delegation setting of an account.</para>
 232 </refsect3>
 233
 234 <refsect2>
 235         <title>dns</title>
 236         <para>Manage Domain Name Service (DNS).</para>
 237 </refsect2>
 238
 239 <refsect3>
 240         <title>dns add <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>data</replaceable></title>
 241         <para>Add a DNS record.</para>
 242 </refsect3>
 243
 244 <refsect3>
 245         <title>dns delete <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>data</replaceable></title>
 246         <para>Delete a DNS record.</para>
 247 </refsect3>
 248
 249 <refsect3>
 250         <title>dns query <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT|ALL</replaceable> [options] <replaceable>data</replaceable></title>
 251         <para>Query a name.</para>
 252 </refsect3>
 253
 254 <refsect3>
 255         <title>dns roothints <replaceable>server</replaceable> [<replaceable>name</replaceable>] [options]</title>
 256         <para>Query root hints.</para>
 257 </refsect3>
 258
 259 <refsect3>
 260         <title>dns serverinfo <replaceable>server</replaceable> [options]</title>
 261         <para>Query server information.</para>
 262 </refsect3>
 263
 264 <refsect3>
 265         <title>dns update <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>olddata</replaceable> <replaceable>newdata</replaceable></title>
 266         <para>Update a DNS record.</para>
 267 </refsect3>
 268
 269 <refsect3>
 270         <title>dns zonecreate <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 271         <para>Create a zone.</para>
 272 </refsect3>
 273
 274 <refsect3>
 275         <title>dns zonedelete <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 276         <para>Delete a zone.</para>
 277 </refsect3>
 278
 279 <refsect3>
 280         <title>dns zoneinfo <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 281         <para>Query zone information.</para>
 282 </refsect3>
 283
 284 <refsect3>
 285         <title>dns zonelist <replaceable>server</replaceable> [options]</title>
 286         <para>List zones.</para>
 287 </refsect3>
 288
 289 <refsect2>
 290         <title>domain</title>
 291         <para>Manage Domain.</para>
 292 </refsect2>
 293
 294 <refsect3>
 295         <title>domain backup</title>
 296         <para>Create or restore a backup of the domain.</para>
 297 </refsect3>
 298
 299 <refsect3>
 300         <title>domain backup offline</title>
 301         <para>Backup (with proper locking) local domain directories into a tar file.</para>
 302 </refsect3>
 303
 304 <refsect3>
 305         <title>domain backup online</title>
 306         <para>Copy a running DC's current DB into a backup tar file.</para>
 307 </refsect3>
 308
 309 <refsect3>
 310         <title>domain backup rename</title>
 311         <para>Copy a running DC's DB to backup file, renaming the domain in the process.</para>
 312 </refsect3>
 313
 314 <refsect3>
 315         <title>domain backup restore</title>
 316         <para>Restore the domain's DB from a backup-file.</para>
 317 </refsect3>
 318
 319 <refsect3>
 320         <title>domain classicupgrade [options] <replaceable>classic_smb_conf</replaceable></title>
 321         <para>Upgrade from Samba classic (NT4-like) database to Samba AD DC
 322         database.</para>
 323 </refsect3>
 324
 325 <refsect3>
 326         <title>domain dcpromo <replaceable>dnsdomain</replaceable> [DC|RODC] [options]</title>
 327         <para>Promote an existing domain member or NT4 PDC to an AD DC.</para>
 328 </refsect3>
 329
 330 <refsect3>
 331         <title>domain demote</title>
 332         <para>Demote ourselves from the role of domain controller.</para>
 333 </refsect3>
 334
 335 <refsect3>
 336         <title>domain exportkeytab <replaceable>keytab</replaceable> [options]</title>
 337         <para>Dumps Kerberos keys of the domain into a keytab.</para>
 338 </refsect3>
 339
 340 <refsect3>
 341         <title>domain info <replaceable>ip_address</replaceable> [options]</title>
 342         <para>Print basic info about a domain and the specified DC.
 343 </para>
 344 </refsect3>
 345
 346 <refsect3>
 347         <title>domain join <replaceable>dnsdomain</replaceable> [DC|RODC|MEMBER|SUBDOMAIN] [options]</title>
 348         <para>Join a domain as either member or backup domain controller.</para>
 349 </refsect3>
 350
 351 <refsect3>
 352         <title>domain level <replaceable>show|raise</replaceable> <replaceable>options</replaceable> [options]</title>
 353         <para>Show/raise domain and forest function levels.</para>
 354 </refsect3>
 355
 356 <refsect3>
 357         <title>domain passwordsettings <replaceable>show|set</replaceable> <replaceable>options</replaceable> [options]</title>
 358         <para>Show/set password settings.</para>
 359 </refsect3>
 360
 361 <refsect3>
 362         <title>domain passwordsettings pso</title>
 363         <para>Manage fine-grained Password Settings Objects (PSOs).</para>
 364 </refsect3>
 365
 366 <refsect3>
 367         <title>domain passwordsettings pso apply <replaceable>pso-name</replaceable> <replaceable>user-or-group-name</replaceable> [options]</title>
 368         <para>Applies a PSO's password policy to a user or group.</para>
 369 </refsect3>
 370
 371 <refsect3>
 372         <title>domain passwordsettings pso create <replaceable>pso-name</replaceable> <replaceable>precedence</replaceable> [options]</title>
 373         <para>Creates a new Password Settings Object (PSO).</para>
 374 </refsect3>
 375
 376 <refsect3>
 377         <title>domain passwordsettings pso delete <replaceable>pso-name</replaceable> [options]</title>
 378         <para>Deletes a Password Settings Object (PSO).</para>
 379 </refsect3>
 380
 381 <refsect3>
 382         <title>domain passwordsettings pso list [options]</title>
 383         <para>Lists all Password Settings Objects (PSOs).</para>
 384 </refsect3>
 385
 386 <refsect3>
 387         <title>domain passwordsettings pso set <replaceable>pso-name</replaceable> [options]</title>
 388         <para>Modifies a Password Settings Object (PSO).</para>
 389 </refsect3>
 390
 391 <refsect3>
 392         <title>domain passwordsettings pso show <replaceable>user-name</replaceable> [options]</title>
 393         <para>Displays a Password Settings Object (PSO).</para>
 394 </refsect3>
 395
 396 <refsect3>
 397         <title>domain passwordsettings pso show-user <replaceable>pso-name</replaceable> [options]</title>
 398         <para>Displays the Password Settings that apply to a user.</para>
 399 </refsect3>
 400
 401 <refsect3>
 402         <title>domain passwordsettings pso unapply <replaceable>pso-name</replaceable> <replaceable>user-or-group-name</replaceable> [options]</title>
 403         <para>Updates a PSO to no longer apply to a user or group.</para>
 404 </refsect3>
 405
 406 <refsect3>
 407         <title>domain provision</title>
 408         <para>Promote an existing domain member or NT4 PDC to an AD DC.</para>
 409 </refsect3>
 410
 411 <refsect3>
 412         <title>domain trust</title>
 413         <para>Domain and forest trust management.</para>
 414 </refsect3>
 415
 416 <refsect3>
 417         <title>domain trust create <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 418         <para>Create a domain or forest trust.</para>
 419 </refsect3>
 420
 421 <refsect3>
 422         <title>domain trust delete <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 423         <para>Delete a domain trust.</para>
 424 </refsect3>
 425
 426 <refsect3>
 427         <title>domain trust list <replaceable>options</replaceable> [options]</title>
 428         <para>List domain trusts.</para>
 429 </refsect3>
 430
 431 <refsect3>
 432         <title>domain trust namespaces [<replaceable>DOMAIN</replaceable>] <replaceable>options</replaceable> [options]</title>
 433         <para>Manage forest trust namespaces.</para>
 434 </refsect3>
 435
 436 <refsect3>
 437         <title>domain trust show <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 438         <para>Show trusted domain details.</para>
 439 </refsect3>
 440
 441 <refsect3>
 442         <title>domain trust validate <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 443         <para>Validate a domain trust.</para>
 444 </refsect3>
 445
 446 <refsect2>
 447         <title>drs</title>
 448         <para>Manage Directory Replication Services (DRS).</para>
 449 </refsect2>
 450
 451 <refsect3>
 452         <title>drs bind</title>
 453         <para>Show DRS capabilities of a server.</para>
 454 </refsect3>
 455
 456 <refsect3>
 457         <title>drs kcc</title>
 458         <para>Trigger knowledge consistency center run.</para>
 459 </refsect3>
 460
 461 <refsect3>
 462         <title>drs options</title>
 463         <para>Query or change <replaceable>options</replaceable> for NTDS Settings
 464         object of a domain controller.</para>
 465 </refsect3>
 466
 467 <refsect3>
 468         <title>drs replicate <replaceable>destination_DC</replaceable> <replaceable>source_DC</replaceable> <replaceable>NC</replaceable> [options]</title>
 469         <para>Replicate a naming context between two DCs.</para>
 470 </refsect3>
 471
 472 <refsect3>
 473         <title>drs showrepl</title>
 474         <para>Show replication status. The <arg
 475         choice="opt">--json</arg> option results in JSON output, and
 476         with the <arg choice="opt">--summary</arg> option produces
 477         very little output when the replication status seems healthy.
 478         </para>
 479 </refsect3>
 480
 481 <refsect2>
 482         <title>dsacl</title>
 483         <para>Administer DS ACLs</para>
 484 </refsect2>
 485
 486 <refsect3>
 487         <title>dsacl set</title>
 488         <para>Modify access list on a directory object.</para>
 489 </refsect3>
 490
 491 <refsect2>
 492         <title>forest</title>
 493         <para>Manage Forest configuration.</para>
 494 </refsect2>
 495
 496 <refsect3>
 497         <title>forest directory_service</title>
 498         <para>Manage directory_service behaviour for the forest.</para>
 499 </refsect3>
 500
 501 <refsect3>
 502         <title>forest directory_service dsheuristics <replaceable>VALUE</replaceable></title>
 503         <para>Modify dsheuristics directory_service configuration for the forest.</para>
 504 </refsect3>
 505
 506 <refsect3>
 507         <title>forest directory_service show</title>
 508         <para>Show current directory_service configuration for the forest.</para>
 509 </refsect3>
 510
 511 <refsect2>
 512         <title>fsmo</title>
 513         <para>Manage Flexible Single Master Operations (FSMO).</para>
 514 </refsect2>
 515
 516 <refsect3>
 517         <title>fsmo seize [options]</title>
 518         <para>Seize the role.</para>
 519 </refsect3>
 520
 521 <refsect3>
 522         <title>fsmo show</title>
 523         <para>Show the roles.</para>
 524 </refsect3>
 525
 526 <refsect3>
 527         <title>fsmo transfer [options]</title>
 528         <para>Transfer the role.</para>
 529 </refsect3>
 530
 531 <refsect2>
 532         <title>gpo</title>
 533         <para>Manage Group Policy Objects (GPO).</para>
 534 </refsect2>
 535
 536 <refsect3>
 537         <title>gpo create <replaceable>displayname</replaceable> [options]</title>
 538         <para>Create an empty GPO.</para>
 539 </refsect3>
 540
 541 <refsect3>
 542         <title>gpo del <replaceable>gpo</replaceable> [options]</title>
 543         <para>Delete GPO.</para>
 544 </refsect3>
 545
 546 <refsect3>
 547         <title>gpo dellink <replaceable>container_dn</replaceable> <replaceable>gpo</replaceable> [options]</title>
 548         <para>Delete GPO link from a container.</para>
 549 </refsect3>
 550
 551 <refsect3>
 552         <title>gpo fetch <replaceable>gpo</replaceable> [options]</title>
 553         <para>Download a GPO.</para>
 554 </refsect3>
 555
 556 <refsect3>
 557         <title>gpo getinheritance <replaceable>container_dn</replaceable> [options]</title>
 558         <para>Get inheritance flag for a container.</para>
 559 </refsect3>
 560
 561 <refsect3>
 562         <title>gpo getlink <replaceable>container_dn</replaceable> [options]</title>
 563         <para>List GPO Links for a container.</para>
 564 </refsect3>
 565
 566 <refsect3>
 567         <title>gpo list <replaceable>username</replaceable> [options]</title>
 568         <para>List GPOs for an account.</para>
 569 </refsect3>
 570
 571 <refsect3>
 572         <title>gpo listall</title>
 573         <para>List all GPOs.</para>
 574 </refsect3>
 575
 576 <refsect3>
 577         <title>gpo listcontainers <replaceable>gpo</replaceable> [options]</title>
 578         <para>List all linked containers for a GPO.</para>
 579 </refsect3>
 580
 581 <refsect3>
 582         <title>gpo setinheritance <replaceable>container_dn</replaceable> <replaceable>block|inherit</replaceable> [options]</title>
 583         <para>Set inheritance flag on a container.</para>
 584 </refsect3>
 585
 586 <refsect3>
 587         <title>gpo setlink <replaceable>container_dn</replaceable> <replaceable>gpo</replaceable> [options]</title>
 588         <para>Add or Update a GPO link to a container.</para>
 589 </refsect3>
 590
 591 <refsect3>
 592         <title>gpo show <replaceable>gpo</replaceable> [options]</title>
 593         <para>Show information for a GPO.</para>
 594 </refsect3>
 595
 596 <refsect2>
 597         <title>group</title>
 598         <para>Manage groups.</para>
 599 </refsect2>
 600
 601 <refsect3>
 602         <title>group add <replaceable>groupname</replaceable> [options]</title>
 603         <para>Create a new AD group.</para>
 604 </refsect3>
 605
 606 <refsect3>
 607         <title>group addmembers <replaceable>groupname</replaceable> <replaceable>members</replaceable> [options]</title>
 608         <para>Add members to an AD group.</para>
 609 </refsect3>
 610
 611 <refsect3>
 612         <title>group delete <replaceable>groupname</replaceable> [options]</title>
 613         <para>Delete an AD group.</para>
 614 </refsect3>
 615
 616 <refsect3>
 617         <title>group list</title>
 618         <para>List all groups.</para>
 619 </refsect3>
 620
 621 <refsect3>
 622         <title>group listmembers <replaceable>groupname</replaceable> [options]</title>
 623         <para>List all members of the specified AD group.</para>
 624 </refsect3>
 625
 626 <refsect3>
 627         <title>group move <replaceable>groupname</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 628         <para>This command moves a group into the specified organizational unit
 629         or container.</para>
 630         <para>The groupname specified on the command is the sAMAccountName.
 631         </para>
 632         <para>The name of the organizational unit or container can be
 633         specified as a full DN or without the domainDN component.</para>
 634         <para></para>
 635 </refsect3>
 636
 637 <refsect3>
 638         <title>group removemembers <replaceable>groupname</replaceable> <replaceable>members</replaceable> [options]</title>
 639         <para>Remove members from the specified AD group.</para>
 640 </refsect3>
 641
 642 <refsect3>
 643         <title>group show <replaceable>groupname</replaceable> [options]</title>
 644         <para>Show group object and it's attributes.</para>
 645 </refsect3>
 646
 647 <refsect3>
 648         <title>group stats [options]</title>
 649         <para>Show statistics for overall groups and group memberships.</para>
 650 </refsect3>
 651
 652 <refsect2>
 653         <title>ldapcmp <replaceable>URL1</replaceable> <replaceable>URL2</replaceable> <replaceable>domain|configuration|schema|dnsdomain|dnsforest</replaceable> [options] </title>
 654         <para>Compare two LDAP databases.</para>
 655 </refsect2>
 656
 657 <refsect2>
 658         <title>ntacl</title>
 659         <para>Manage NT ACLs.</para>
 660 </refsect2>
 661
 662 <refsect3>
 663         <title>ntacl get <replaceable>file</replaceable> [options]</title>
 664         <para>Get ACLs on a file.</para>
 665 </refsect3>
 666
 667 <refsect3>
 668         <title>ntacl set <replaceable>acl</replaceable> <replaceable>file</replaceable> [options]</title>
 669         <para>Set ACLs on a file.</para>
 670 </refsect3>
 671
 672 <refsect3>
 673         <title>ntacl sysvolcheck</title>
 674         <para>Check sysvol ACLs match defaults (including correct ACLs on GPOs).</para>
 675 </refsect3>
 676
 677 <refsect3>
 678         <title>ntacl sysvolreset</title>
 679         <para>Reset sysvol ACLs to defaults (including correct ACLs on GPOs).</para>
 680 </refsect3>
 681
 682 <refsect3>
 683         <title>ou create <replaceable>ou_dn</replaceable> [options]</title>
 684         <para>Create an organizational unit.</para>
 685         <para>The name of the organizational unit can be specified as a full DN
 686         or without the domainDN component.</para>
 687
 688         <variablelist>
 689         <varlistentry>
 690         <term>--description=DESCRIPTION</term>
 691         <listitem><para>
 692         Specify OU's description.
 693         </para></listitem>
 694         </varlistentry>
 695         </variablelist>
 696 </refsect3>
 697
 698 <refsect3>
 699         <title>ou delete <replaceable>ou_dn</replaceable> [options]</title>
 700         <para>Delete an organizational unit.</para>
 701         <para>The name of the organizational unit can be specified as a full DN
 702         or without the domainDN component.</para>
 703
 704         <variablelist>
 705         <varlistentry>
 706         <term>--force-subtree-delete</term>
 707         <listitem><para>
 708         Delete organizational unit and all children reclusively.
 709         </para></listitem>
 710         </varlistentry>
 711         </variablelist>
 712 </refsect3>
 713
 714 <refsect3>
 715         <title>ou list [options]</title>
 716         <para>List all organizational units.</para>
 717         <variablelist>
 718         <varlistentry>
 719         <term>--full-dn</term>
 720         <listitem><para>
 721         Display DNs including the base DN.
 722         </para></listitem>
 723         </varlistentry>
 724         </variablelist>
 725 </refsect3>
 726
 727 <refsect3>
 728         <title>ou listobjects <replaceable>ou_dn</replaceable> [options]</title>
 729         <para>List all objects in an organizational unit.</para>
 730         <para>The name of the organizational unit can be specified as a full DN
 731         or without the domainDN component.</para>
 732
 733         <variablelist>
 734         <varlistentry>
 735         <term>--full-dn</term>
 736         <listitem><para>
 737         Display DNs including the base DN.
 738         </para></listitem>
 739         </varlistentry>
 740
 741         <varlistentry>
 742         <term>-r|--recursive</term>
 743         <listitem><para>
 744         List objects recursively.
 745         </para></listitem>
 746         </varlistentry>
 747         </variablelist>
 748 </refsect3>
 749
 750 <refsect3>
 751         <title>ou move <replaceable>old_ou_dn</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 752         <para>Move an organizational unit.</para>
 753         <para>The name of the organizational units can be specified as a full DN
 754         or without the domainDN component.</para>
 755 </refsect3>
 756
 757 <refsect3>
 758         <title>ou rename <replaceable>old_ou_dn</replaceable> <replaceable>new_ou_dn</replaceable> [options]</title>
 759         <para>Rename an organizational unit.</para>
 760         <para>The name of the organizational units can be specified as a full DN
 761         or without the domainDN component.</para>
 762 </refsect3>
 763
 764 <refsect2>
 765         <title>rodc</title>
 766         <para>Manage Read-Only Domain Controller (RODC).</para>
 767 </refsect2>
 768
 769 <refsect3>
 770         <title>rodc preload <replaceable>SID</replaceable>|<replaceable>DN</replaceable>|<replaceable>accountname</replaceable> [options]</title>
 771         <para>Preload one account for an RODC.</para>
 772 </refsect3>
 773
 774 <refsect2>
 775         <title>schema</title>
 776         <para>Manage and query schema.</para>
 777 </refsect2>
 778
 779 <refsect3>
 780         <title>schema attribute modify <replaceable>attribute</replaceable> [options]</title>
 781         <para>Modify the behaviour of an attribute in schema.</para>
 782 </refsect3>
 783
 784 <refsect3>
 785         <title>schema attribute show <replaceable>attribute</replaceable> [options]</title>
 786         <para>Display an attribute schema definition.</para>
 787 </refsect3>
 788
 789 <refsect3>
 790         <title>schema attribute show_oc <replaceable>attribute</replaceable> [options]</title>
 791         <para>Show objectclasses that MAY or MUST contain this attribute.</para>
 792 </refsect3>
 793
 794 <refsect3>
 795         <title>schema objectclass show <replaceable>objectclass</replaceable> [options]</title>
 796         <para>Display an objectclass schema definition.</para>
 797 </refsect3>
 798
 799 <refsect2>
 800         <title>sites</title>
 801         <para>Manage sites.</para>
 802 </refsect2>
 803
 804 <refsect3>
 805         <title>sites create <replaceable>site</replaceable> [options]</title>
 806         <para>Create a new site.</para>
 807 </refsect3>
 808
 809 <refsect3>
 810         <title>sites remove <replaceable>site</replaceable> [options]</title>
 811         <para>Delete an existing site.</para>
 812 </refsect3>
 813
 814 <refsect2>
 815         <title>spn</title>
 816         <para>Manage Service Principal Names (SPN).</para>
 817 </refsect2>
 818
 819 <refsect3>
 820         <title>spn add <replaceable>name</replaceable> <replaceable>user</replaceable> [options]</title>
 821         <para>Create a new SPN.</para>
 822 </refsect3>
 823
 824 <refsect3>
 825         <title>spn delete <replaceable>name</replaceable> [<replaceable>user</replaceable>] [options]</title>
 826         <para>Delete an existing SPN.</para>
 827 </refsect3>
 828
 829 <refsect3>
 830         <title>spn list <replaceable>user</replaceable> [options]</title>
 831         <para>List SPNs of a given user.</para>
 832 </refsect3>
 833
 834 <refsect2>
 835         <title>testparm</title>
 836         <para>Check the syntax of the configuration file.</para>
 837 </refsect2>
 838
 839 <refsect2>
 840         <title>time</title>
 841         <para>Retrieve the time on a server.</para>
 842 </refsect2>
 843
 844 <refsect2>
 845         <title>user</title>
 846         <para>Manage users.</para>
 847 </refsect2>
 848
 849 <refsect3>
 850         <title>user add <replaceable>username</replaceable> [<replaceable>password</replaceable>]</title>
 851         <para>Create a new user. Please note that this subcommand is deprecated
 852         and available for compatibility reasons only. Please use
 853         <command>samba-tool user create</command> instead.</para>
 854 </refsect3>
 855
 856 <refsect3>
 857         <title>user create <replaceable>username</replaceable> [<replaceable>password</replaceable>]</title>
 858         <para>Create a new user in the Active Directory Domain.</para>
 859 </refsect3>
 860
 861 <refsect3>
 862         <title>user delete <replaceable>username</replaceable> [options]</title>
 863         <para>Delete an existing user account.</para>
 864 </refsect3>
 865
 866 <refsect3>
 867         <title>user disable <replaceable>username</replaceable></title>
 868         <para>Disable an user account.</para>
 869 </refsect3>
 870
 871 <refsect3>
 872         <title>user edit <replaceable>username</replaceable></title>
 873         <para>Edit a user account AD object.</para>
 874
 875         <variablelist>
 876         <varlistentry>
 877         <term>--editor=EDITOR</term>
 878         <listitem><para>
 879         Specifies the editor to use instead of the system default, or 'vi' if no
 880         system default is set.
 881         </para></listitem>
 882         </varlistentry>
 883         </variablelist>
 884 </refsect3>
 885
 886 <refsect3>
 887         <title>user enable <replaceable>username</replaceable></title>
 888         <para>Enable an user account.</para>
 889 </refsect3>
 890
 891 <refsect3>
 892         <title>user list</title>
 893         <para>List all users.</para>
 894 </refsect3>
 895
 896 <refsect3>
 897         <title>user show <replaceable>username</replaceable> [options]</title>
 898         <para>Display a user AD object.</para>
 899
 900         <variablelist>
 901         <varlistentry>
 902         <term>--attributes=USER_ATTRS</term>
 903         <listitem><para>
 904         Comma separated list of attributes, which will be printed.
 905         </para></listitem>
 906         </varlistentry>
 907         </variablelist>
 908 </refsect3>
 909
 910 <refsect3>
 911         <title>user move <replaceable>username</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 912         <para>This command moves a user account into the specified
 913         organizational unit or container.</para>
 914         <para>The username specified on the command is the
 915         sAMAccountName.</para>
 916         <para>The name of the organizational unit or container can be
 917         specified as a full DN or without the domainDN component.</para>
 918 </refsect3>
 919
 920 <refsect3>
 921         <title>user password [options]</title>
 922         <para>Change password for an user account (the one provided in
 923         authentication).</para>
 924 </refsect3>
 925
 926 <refsect3>
 927         <title>user setexpiry <replaceable>username</replaceable> [options]</title>
 928         <para>Set the expiration of an user account.</para>
 929 </refsect3>
 930
 931 <refsect3>
 932         <title>user setpassword <replaceable>username</replaceable> [options]</title>
 933         <para>Sets or resets the password of an user account.</para>
 934 </refsect3>
 935
 936 <refsect3>
 937         <title>user getpassword <replaceable>username</replaceable> [options]</title>
 938         <para>Gets the password of an user account.</para>
 939 </refsect3>
 940
 941 <refsect3>
 942         <title>user syncpasswords <replaceable>--cache-ldb-initialize</replaceable> [options]</title>
 943         <para>Syncs the passwords of all user accounts, using an optional script.</para>
 944         <para>Note that this command should run on a single domain controller only
 945         (typically the PDC-emulator).</para>
 946 </refsect3>
 947
 948 <refsect2>
 949         <title>vampire [options] <replaceable>domain</replaceable></title>
 950         <para>Join and synchronise a remote AD domain to the local server.
 951         Please note that <command>samba-tool vampire</command> is deprecated,
 952         please use <command>samba-tool domain join</command> instead.</para>
 953 </refsect2>
 954
 955 <refsect2>
 956         <title>visualize [options] <replaceable>subcommand</replaceable></title>
 957         <para>Produce graphical representations of Samba network state.
 958         To work out what is happening in a replication graph, it is sometimes
 959         helpful to use visualisations.</para>
 960
 961         <para>
 962         There are two subcommands, two graphical modes, and (roughly) two modes
 963         of operation with respect to the location of authority.</para>
 964
 965         <refsect3><title>MODES OF OPERATION</title>
 966         <varlistentry>
 967                 <term>samba-tool visualize ntdsconn</term>
 968                 <listitem><para>Looks at NTDS connections.
 969                 </para></listitem>
 970                 </varlistentry>
 971
 972         <varlistentry>
 973                 <term>samba-tool visualize reps</term>
 974                 <listitem><para>Looks at repsTo and repsFrom objects.
 975                 </para></listitem>
 976                 </varlistentry>
 977
 978         <varlistentry>
 979                 <term>samba-tool visualize uptodateness</term>
 980                 <listitem><para>Looks at replication lag as shown by the
 981                 uptodateness vectors.
 982                 </para></listitem>
 983                 </varlistentry>
 984         </refsect3>
 985
 986         <refsect3><title>GRAPHICAL MODES</title>
 987         <varlistentry>
 988                 <term>--distance</term>
 989                 <listitem><para>Distances between DCs are shown in a matrix in
 990                  the terminal.
 991                 </para></listitem>
 992                 </varlistentry>
 993
 994         <varlistentry>
 995                 <term>--dot</term>
 996                 <listitem><para>Generate Graphviz dot output (for
 997                 ntdsconn and reps modes). When viewed using dot or
 998                 xdot, this shows the network as a graph with DCs as
 999                 vertices and connections edges. Certain types of
1000                 degenerate edges are shown in different colours or
1001                 line-styles. </para></listitem>
1002                 </varlistentry>
1003         <varlistentry>
1004                 <term>--xdot</term>
1005                 <listitem><para>Generate Graphviz dot output as with
1006                 <arg choice="opt">--dot</arg> and attempt to view it
1007                 immediately using <command>/usr/bin/xdot</command>.
1008                 </para></listitem>
1009                 </varlistentry>
1010         </refsect3>
1011
1012         <varlistentry>
1013                 <term>-r</term>
1014                 <listitem><para>Normally,
1015                 <command>samba-tool</command> talks to one database;
1016                 with the <arg choice="opt">-r</arg> option attempts
1017                 are made to contact all the DCs known to the first
1018                 database. This is necessary for <command>samba-tool
1019                 visualize uptodateness</command> and for
1020                 <command>samba-tool visualize reps</command> because
1021                 the repsFrom/To objects are not replicated, and it can
1022                 reveal replication issues in other modes.
1023                 </para></listitem>
1024                 </varlistentry>
1025 </refsect2>
1026
1027 <refsect2>
1028 <title>help</title>
1029 <para>Gives usage information.</para>
1030 </refsect2>
1031
1032 </refsect1>
1033
1034 <refsect1>
1035         <title>VERSION</title>
1036
1037         <para>This man page is complete for version &doc.version; of the Samba
1038         suite.</para>
1039 </refsect1>
1040
1041 <refsect1>
1042         <title>AUTHOR</title>
1043
1044         <para>The original Samba software and related utilities
1045         were created by Andrew Tridgell. Samba is now developed
1046         by the Samba Team as an Open Source project similar
1047         to the way the Linux kernel is developed.</para>
1048 </refsect1>
1049
1050 </refentry>