Ignore:
Timestamp:
Nov 14, 2012, 12:59:34 PM (13 years ago)
Author:
Silvan Scherrer
Message:

Samba Server: update vendor to 3.6.0

Location:
vendor/current/source4/setup
Files:
20 added
11 deleted
38 edited

Legend:

Unmodified
Added
Removed

  • vendor/current/source4/setup/DB_CONFIG

    r414 r740  
    1 set_cachesize   0       524288        0
    2 set_lg_regionmax        104857
    3 set_lg_max              1048576
    4 set_lg_bsize            209715
     1# set 32MiB, single-segment cache
     2set_cachesize   0      33554432        1
     3
     4# set transaction log autoremoval; disable if you use them for backups
     5set_flags DB_LOG_AUTOREMOVE
     6
     7# these should be left at default for most installs
     8set_lg_max              10485760
     9set_lg_bsize            2097152
     10
    511set_lg_dir              ${LDAPDBDIR}/bdb-logs
    6 set_tmp_dir             ${LDAPDBDIR}/tmp
     12
     13# tmp_dir stuff is not used by OpenLDAP
     14#set_tmp_dir             ${LDAPDBDIR}/tmp

  • vendor/current/source4/setup/aggregate_schema.ldif

    r414 r740  
    22objectClass: top
    33objectClass: subSchema
     4showInAdvancedViewOnly: FALSE
     5systemFlags: 134217728

  • vendor/current/source4/setup/fedorads-samba.ldif

    r414 r740  
    88objectClass: person
    99cn: samba-admin
     10sn: samba-admin
    1011userPassword: {CLEAR}${LDAPADMINPASS}
     12
     13dn: ou=Ranges,${SAMBADN}
     14objectClass: top
     15objectClass: organizationalUnit
     16ou: Ranges
     17
     18dn: cn=Samba SIDs,ou=Ranges,${SAMBADN}
     19objectClass: top
     20objectClass: nsContainer
     21cn: Samba SIDs

  • vendor/current/source4/setup/fedorads-sasl.ldif

    r414 r740  
    88nsSaslMapFilterTemplate: (objectclass=*)
    99
     10dn: cn=Kerberos uid mapping,cn=mapping,cn=sasl,cn=config
     11changetype: delete
     12
     13dn: cn=rfc 2829 dn syntax,cn=mapping,cn=sasl,cn=config
     14changetype: delete
     15
     16dn: cn=rfc 2829 u syntax,cn=mapping,cn=sasl,cn=config
     17changetype: delete
     18
     19dn: cn=uid mapping,cn=mapping,cn=sasl,cn=config
     20changetype: delete

  • vendor/current/source4/setup/fedorads.inf

    r414 r740  
    99RootDN= ${LDAPMANAGERDN}
    1010RootDNPwd= ${LDAPMANAGERPASS}
    11 ServerIdentifier= samba4
     11ServerIdentifier= ${LDAP_INSTANCE}
    1212${SERVERPORT}
    1313
    14 inst_dir= ${LDAPDIR}/slapd-samba4
    15 config_dir= ${LDAPDIR}/slapd-samba4
    16 schema_dir= ${LDAPDIR}/slapd-samba4/schema
    17 lock_dir= ${LDAPDIR}/slapd-samba4/lock
    18 log_dir= ${LDAPDIR}/slapd-samba4/logs
    19 run_dir= ${LDAPDIR}/slapd-samba4/logs
    20 db_dir= ${LDAPDIR}/slapd-samba4/db
    21 bak_dir= ${LDAPDIR}/slapd-samba4/bak
    22 tmp_dir= ${LDAPDIR}/slapd-samba4/tmp
    23 ldif_dir= ${LDAPDIR}/slapd-samba4/ldif
    24 cert_dir= ${LDAPDIR}/slapd-samba4
     14inst_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}
     15config_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}
     16schema_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}/schema
     17lock_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}/lock
     18log_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}/logs
     19run_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}/logs
     20db_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}/db
     21bak_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}/bak
     22tmp_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}/tmp
     23ldif_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}/ldif
     24cert_dir= ${LDAPDIR}/slapd-${LDAP_INSTANCE}
    2525
    2626start_server= 0
    2727install_full_schema= 0
     28InstallLdifFile= none
    2829SchemaFile=${LDAPDIR}/99_ad.ldif
    2930ConfigFile = ${LDAPDIR}/fedorads-partitions.ldif
    3031ConfigFile = ${LDAPDIR}/fedorads-sasl.ldif
     32ConfigFile = ${LDAPDIR}/fedorads-dna.ldif
     33ConfigFile = ${LDAPDIR}/fedorads-pam.ldif
     34ConfigFile = ${LDAPDIR}/fedorads-refint.ldif
     35ConfigFile = ${LDAPDIR}/fedorads-linked-attributes.ldif
     36ConfigFile = ${LDAPDIR}/fedorads-index.ldif

  • vendor/current/source4/setup/idmap_init.ldif

    r414 r740  
    33lowerBound: 3000000
    44upperBound: 4000000
     5
     6dn: @INDEXLIST
     7@IDXATTR: xidNumber
     8@IDXATTR: objectSid

  • vendor/current/source4/setup/krb5.conf

    r414 r740  
    22        default_realm = ${REALM}
    33        dns_lookup_realm = false
    4         dns_lookup_kdc = false
    5         ticket_lifetime = 24h
    6         forwardable = yes
    7 
    8 [realms]
    9         ${REALM} = {
    10                 kdc = ${HOSTNAME}.${DNSDOMAIN}:88
    11                 admin_server = ${HOSTNAME}.${DNSDOMAIN}:749
    12                 default_domain = ${DNSDOMAIN}
    13         }
    14 
    15 [domain_realm]
    16         .${DNSDOMAIN} = ${REALM}
    17         ${DNSDOMAIN} = ${REALM}
     4        dns_lookup_kdc = true

  • vendor/current/source4/setup/named.conf

    r414 r740  
    22#
    33# For example with
    4 # include "${PRIVATE_DIR}/named.conf";
     4# include "${NAMED_CONF}";
    55
    66zone "${DNSDOMAIN}." IN {
    77        type master;
    8         file "${PRIVATE_DIR}/${DNSDOMAIN}.zone";
     8        file "${ZONE_FILE}";
    99        /*
    10          * Attention: Not all BIND versions support "ms-self". The instead use
    11          * of allow-update { any; }; is another, but less secure possibility.
     10         * the list of principals and what they can change is created
     11         * dynamically by Samba, based on the membership of the domain controllers
     12         * group. The provision just creates this file as an empty file.
    1213         */
    13         update-policy {
    14                 /*
    15                  * A rather long description here, as the "ms-self" option does
    16                  * not appear in any docs yet (it can only be found in the
    17                  * source code).
    18                  *
    19                  * The short of it is that each host is allowed to update its
    20                  * own A and AAAA records, when the update request is properly
    21                  * signed by the host itself.
    22                  *
    23                  * The long description is (look at the
    24                  * dst_gssapi_identitymatchesrealmms() call in lib/dns/ssu.c and
    25                  * its definition in lib/dns/gssapictx.c for details):
    26                  *
    27                  * A GSS-TSIG update request will be signed by a given signer
    28                  * (e.g. machine-name$@${REALM}).  The signer name is split into
    29                  * the machine component (e.g. "machine-name") and the realm
    30                  * component (e.g. "${REALM}").  The update is allowed if the
    31                  * following conditions are met:
    32                  *
    33                  * 1) The machine component of the signer name matches the first
    34                  * (host) component of the FQDN that is being updated.
    35                  *
    36                  * 2) The realm component of the signer name matches the realm
    37                  * in the grant statement below (${REALM}).
    38                  *
    39                  * 3) The domain component of the FQDN that is being updated
    40                  * matches the realm in the grant statement below.
    41                  *
    42                  * If the 3 conditions above are satisfied, the update succeeds.
    43                  */
    44                 grant ${REALM} ms-self * A AAAA;
    45         };
     14        include "${NAMED_CONF_UPDATE}";
     15
     16        /* we need to use check-names ignore so _msdcs A records can be created */
     17        check-names ignore;
    4618};
    4719
    … …  
    6133# Note that the reverse zone file is not created during the provision process.
    6234
    63 # The most recent BIND versions (9.5.0a5 or later) support secure GSS-TSIG
     35# The most recent BIND versions (9.7.2 or later) support secure GSS-TSIG
    6436# updates.  If you are running an earlier version of BIND, or if you do not wish
    6537# to use secure GSS-TSIG updates, you may remove the update-policy sections in

  • vendor/current/source4/setup/provision

    r414 r740  
    1 #!/usr/bin/python
     1#!/usr/bin/env python
    22#
    33# Unix SMB/CIFS implementation.
    … …  
    2323#
    2424
     25import logging
    2526import optparse
    2627import sys
     28import tempfile
    2729
    2830# Find right directory when running from source tree
    … …  
    3032
    3133import samba
     34import samba.ntacls
    3235from samba.credentials import DONT_USE_KERBEROS
    3336from samba.auth import system_session
    3437import samba.getopt as options
    35 from samba.provision import provision, FILL_FULL, FILL_NT4SYNC, FILL_DRS, find_setup_dir
     38from samba.provision import provision, FILL_FULL, FILL_NT4SYNC, FILL_DRS, ProvisioningError
     39from samba.dsdb import (
     40        DS_DOMAIN_FUNCTION_2000,
     41        DS_DOMAIN_FUNCTION_2003,
     42        DS_DOMAIN_FUNCTION_2008,
     43        DS_DOMAIN_FUNCTION_2008_R2,
     44        )
    3645
    3746# how do we make this case insensitive??
    … …  
    4453parser.add_option_group(credopts)
    4554parser.add_option("--interactive", help="Ask for names", action="store_true")
    46 parser.add_option("--setupdir", type="string", metavar="DIR",
    47                 help="directory with setup files")
    48 parser.add_option("--realm", type="string", metavar="REALM", help="set realm")
    4955parser.add_option("--domain", type="string", metavar="DOMAIN",
    5056                                  help="set domain")
    … …  
    5359parser.add_option("--domain-sid", type="string", metavar="SID",
    5460                help="set domainsid (otherwise random)")
    55 parser.add_option("--policy-guid", type="string", metavar="GUID",
    56                                   help="set guid for domain policy")
    57 parser.add_option("--policy-guid-dc", type="string", metavar="GUID",
    58                                   help="set guid for domain controller policy")
     61parser.add_option("--ntds-guid", type="string", metavar="GUID",
     62                  help="set NTDS object GUID (otherwise random)")
    5963parser.add_option("--invocationid", type="string", metavar="GUID",
    6064                  help="set invocationid (otherwise random)")
    … …  
    8892parser.add_option("--ldap-backend-extra-port", type="int", metavar="LDAP-BACKEND-EXTRA-PORT",
    8993                help="Additional TCP port for LDAP backend server (to use for replication)")
     94parser.add_option("--ldap-backend-forced-uri", type="string", metavar="LDAP-BACKEND-FORCED-URI",
     95                help="Force the LDAP backend connection to be to a particular URI.  Use this ONLY for 'existing' backends, or when debugging the interaction with the LDAP backend and you need to intercept the LDAP traffic")
    9096parser.add_option("--ldap-backend-type", type="choice", metavar="LDAP-BACKEND-TYPE",
    9197                help="LDAP backend type (fedora-ds or openldap)",
    … …  
    94100parser.add_option("--server-role", type="choice", metavar="ROLE",
    95101                  choices=["domain controller", "dc", "member server", "member", "standalone"],
    96                 help="Set server role to provision for (default standalone)")
     102                help="The server role (domain controller | dc | member server | member | standalone). Default is standalone.")
     103parser.add_option("--function-level", type="choice", metavar="FOR-FUN-LEVEL",
     104                  choices=["2000", "2003", "2008", "2008_R2"],
     105                help="The domain and forest function level (2000 | 2003 | 2008 | 2008_R2 - always native). Default is (Windows) 2003 Native.")
     106parser.add_option("--next-rid", type="int", metavar="NEXTRID", default=1000,
     107                help="The initial nextRid value (only needed for upgrades).  Default is 1000.")
    97108parser.add_option("--partitions-only",
    98109                help="Configure Samba's partitions, but do not modify them (ie, join a BDC)", action="store_true")
    … …  
    100111                          help="Set target directory")
    101112parser.add_option("--ol-mmr-urls", type="string", metavar="LDAPSERVER",
    102                 help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/  (where <PORT> has to be different than 389!) ] separated with whitespaces for use with OpenLDAP-MMR (Multi-Master-Replication)")
     113                help="List of LDAP-URLS [ ldap://<FQHN>:<PORT>/  (where <PORT> has to be different than 389!) ] separated with comma (\",\") for use with OpenLDAP-MMR (Multi-Master-Replication), e.g.: \"ldap://s4dc1:9000,ldap://s4dc2:9000\"")
    103114parser.add_option("--slapd-path", type="string", metavar="SLAPD-PATH",
    104115                help="Path to slapd for LDAP backend [e.g.:'/usr/local/libexec/slapd']. Required for Setup with LDAP-Backend. OpenLDAP Version >= 2.4.17 should be used.")
    105116parser.add_option("--setup-ds-path", type="string", metavar="SETUP_DS-PATH",
    106117                help="Path to setup-ds.pl script for Fedora DS LDAP backend [e.g.:'/usr/sbin/setup-ds.pl']. Required for Setup with Fedora DS backend.")
    107 parser.add_option("--nosync", help="Configure LDAP backend not to call fsync() (for performance in test environments)", action="store_true")
     118parser.add_option("--use-xattrs", type="choice", choices=["yes","no","auto"], help="Define if we should use the native fs capabilities or a tdb file for storing attributes likes ntacl, auto tries to make an inteligent guess based on the user rights and system capabilities", default="auto")
    108119parser.add_option("--ldap-dryrun-mode", help="Configure LDAP backend, but do not run any binaries and exit early.  Used only for the test environment.  DO NOT USE", action="store_true")
    109120
    110121opts = parser.parse_args()[0]
    111122
    112 def message(text):
    113         """print a message if quiet is not set."""
    114         if not opts.quiet:
    115                 print text
     123logger = logging.getLogger("provision")
     124logger.addHandler(logging.StreamHandler(sys.stdout))
     125if opts.quiet:
     126        logger.setLevel(logging.WARNING)
     127else:
     128        logger.setLevel(logging.INFO)
    116129
    117130if len(sys.argv) == 1:
    118131        opts.interactive = True
    119 
    120 if not opts.interactive and (opts.realm is None or opts.domain is None):
    121         if opts.realm is None:
    122                 print >>sys.stderr, "No realm set"
    123         if opts.domain is None:
    124                 print >>sys.stderr, "No domain set"
    125         parser.print_usage()
    126         sys.exit(1)
    127132
    128133if opts.interactive:
    … …  
    136141                return sys.stdin.readline().rstrip("\n") or default
    137142        try:
    138                 opts.realm = ask("Realm", socket.getfqdn().split(".", 1)[1].upper())
     143                default = socket.getfqdn().split(".", 1)[1].upper()
    139144        except IndexError:
    140                 print >>sys.stderr, "Cannot guess realm from %s" % ( socket.getfqdn())
     145                default = None
     146        opts.realm = ask("Realm", default)
     147        if opts.realm in (None, ""):
     148                print >>sys.stderr, "No realm set!"
    141149                sys.exit(1)
    142150
    143151        try:
    144                 opts.domain = ask("Domain", opts.realm.split(".")[0])
     152                default = opts.realm.split(".")[0]
    145153        except IndexError:
    146                 print >>sys.stderr, "Cannot guess domain from %s" % ( opts.realm())
     154                default = None
     155        opts.domain = ask("Domain", default)
     156        if opts.domain is None:
     157                print >> sys.stderr, "No domain set!"
    147158                sys.exit(1)
    148159
    … …  
    154165                else:
    155166                        break
     167else:
     168        if opts.realm in (None, ""):
     169                opts.realm = sambaopts._lp.get('realm')
     170        if opts.realm is None or opts.domain is None:
     171                if opts.realm is None:
     172                        print >>sys.stderr, "No realm set!"
     173                if opts.domain is None:
     174                        print >> sys.stderr, "No domain set!"
     175                parser.print_usage()
     176                sys.exit(1)
     177
     178if not opts.adminpass:
     179        logger.info("Administrator password will be set randomly!")
    156180
    157181lp = sambaopts.get_loadparm()
    … …  
    165189        server_role = opts.server_role
    166190
     191if opts.function_level is None:
     192        dom_for_fun_level = None
     193elif opts.function_level == "2000":
     194        dom_for_fun_level = DS_DOMAIN_FUNCTION_2000
     195elif opts.function_level == "2003":
     196        dom_for_fun_level = DS_DOMAIN_FUNCTION_2003
     197elif opts.function_level == "2008":
     198        dom_for_fun_level = DS_DOMAIN_FUNCTION_2008
     199elif opts.function_level == "2008_R2":
     200        dom_for_fun_level = DS_DOMAIN_FUNCTION_2008_R2
     201
    167202creds = credopts.get_credentials(lp)
    168203
    169204creds.set_kerberos_state(DONT_USE_KERBEROS)
    170 
    171 setup_dir = opts.setupdir
    172 if setup_dir is None:
    173         setup_dir = find_setup_dir()
    174205
    175206samdb_fill = FILL_FULL
    … …  
    179210    samdb_fill = FILL_DRS
    180211
     212eadb = True
     213if opts.use_xattrs == "yes":
     214        eadb = False
     215elif opts.use_xattrs == "auto" and not lp.get("posix:eadb"):
     216        file = tempfile.NamedTemporaryFile()
     217        try:
     218                samba.ntacls.setntacl(lp, file.name,
     219                        "O:S-1-5-32G:S-1-5-32", "S-1-5-32", "native")
     220                eadb = False
     221        except:
     222                logger.info("You are not root or your system do not support xattr, using tdb backend for attributes. "
     223                            "If you intend to use this provision in production, rerun the script as root on a system supporting xattrs.")
     224        file.close()
     225
     226
     227if opts.ldap_backend_type == "existing":
     228        if opts.ldap_backend_forced_uri is not None:
     229                logger.warn("You have specified to use an existing LDAP server as the backend, please make sure an LDAP server is running at %s" % opts.ldap_backend_forced_uri)
     230        else:
     231                logger.info("You have specified to use an existing LDAP server as the backend, please make sure an LDAP server is running at the default location")
     232else:
     233        if opts.ldap_backend_forced_uri is not None:
     234                logger.warn("You have specified to use an fixed URI %s for connecting to your LDAP server backend.  This is NOT RECOMMENDED, as our default communiation over ldapi:// is more secure and much less prone to unexpected failure or interaction" % opts.ldap_backend_forced_uri)
     235       
    181236session = system_session()
    182 provision(setup_dir, message,
    183           session, creds, smbconf=smbconf, targetdir=opts.targetdir,
    184           samdb_fill=samdb_fill, realm=opts.realm, domain=opts.domain,
    185           domainguid=opts.domain_guid, domainsid=opts.domain_sid,
    186           policyguid=opts.policy_guid, policyguid_dc=opts.policy_guid_dc,
    187           hostname=opts.host_name,
    188           hostip=opts.host_ip, hostip6=opts.host_ip6,
    189           invocationid=opts.invocationid, adminpass=opts.adminpass,
    190           krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass,
    191           dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody,
    192           wheel=opts.wheel, users=opts.users,
    193           serverrole=server_role,
    194           ldap_backend_extra_port=opts.ldap_backend_extra_port,
    195           ldap_backend_type=opts.ldap_backend_type,
    196           ldapadminpass=opts.ldapadminpass,
    197           ol_mmr_urls=opts.ol_mmr_urls,
    198           slapd_path=opts.slapd_path,
    199           setup_ds_path=opts.setup_ds_path,
    200           nosync=opts.nosync,
    201           ldap_dryrun_mode=opts.ldap_dryrun_mode)
     237try:
     238        provision(logger,
     239                  session, creds, smbconf=smbconf, targetdir=opts.targetdir,
     240                  samdb_fill=samdb_fill, realm=opts.realm, domain=opts.domain,
     241                  domainguid=opts.domain_guid, domainsid=opts.domain_sid,
     242                  hostname=opts.host_name,
     243                  hostip=opts.host_ip, hostip6=opts.host_ip6,
     244                  ntdsguid=opts.ntds_guid,
     245                  invocationid=opts.invocationid, adminpass=opts.adminpass,
     246                  krbtgtpass=opts.krbtgtpass, machinepass=opts.machinepass,
     247                  dnspass=opts.dnspass, root=opts.root, nobody=opts.nobody,
     248                  wheel=opts.wheel, users=opts.users,
     249                  serverrole=server_role, dom_for_fun_level=dom_for_fun_level,
     250                  ldap_backend_extra_port=opts.ldap_backend_extra_port,
     251                  ldap_backend_forced_uri=opts.ldap_backend_forced_uri,
     252                  backend_type=opts.ldap_backend_type,
     253                  ldapadminpass=opts.ldapadminpass, ol_mmr_urls=opts.ol_mmr_urls,
     254                  slapd_path=opts.slapd_path, setup_ds_path=opts.setup_ds_path,
     255                  nosync=opts.ldap_backend_nosync, ldap_dryrun_mode=opts.ldap_dryrun_mode,
     256                  useeadb=eadb, next_rid=opts.next_rid, lp=lp)
     257except ProvisioningError, e:
     258        print str(e)
     259        exit(1)

  • vendor/current/source4/setup/provision.ldif

    r414 r740  
    7777description: Quota specifications container
    7878msDS-TombstoneQuotaFactor: 100
    79 systemFlags: -1946157056
     79systemFlags: -2147483648
    8080isCriticalSystemObject: TRUE
    8181
    … …  
    132132showInAdvancedViewOnly: FALSE
    133133
     134dn: CN=DFSR-GlobalSettings,CN=System,${DOMAINDN}
     135objectClass: top
     136objectClass: msDFSR-GlobalSettings
     137msDFSR-Flags: 48
     138
     139dn: CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,${DOMAINDN}
     140objectClass: top
     141objectClass: msDFSR-ReplicationGroup
     142msDFSR-ReplicationGroupType: 1
     143
     144dn: CN=Content,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,${DOMAINDN}
     145objectClass: top
     146objectClass: msDFSR-Content
     147
     148dn: CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,${DOMAINDN}
     149objectClass: top
     150objectClass: msDFSR-Topology
     151
     152# Here are missing the DFSR objects since we don't support this technique yet
     153
    134154# Domain updates
    135155
    … …  
    138158objectClass: container
    139159
     160dn: CN=ActiveDirectoryUpdate,CN=DomainUpdates,CN=System,${DOMAINDN}
     161objectClass: top
     162objectClass: container
     163revision: 5
     164
    140165dn: CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
    141166objectClass: top
    … …  
    358383objectClass: container
    359384
     385dn: CN=0b7fb422-3609-4587-8c2e-94b10f67d1bf,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     386objectClass: top
     387objectClass: container
     388
     389dn: CN=231fb90b-c92a-40c9-9379-bacfc313a3e3,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     390objectClass: top
     391objectClass: container
     392
     393dn: CN=2951353e-d102-4ea5-906c-54247eeec741,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     394objectClass: top
     395objectClass: container
     396
     397dn: CN=4aaabc3a-c416-4b9c-a6bb-4b453ab1c1f0,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     398objectClass: top
     399objectClass: container
     400
     401dn: CN=4c93ad42-178a-4275-8600-16811d28f3aa,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     402objectClass: top
     403objectClass: container
     404
     405dn: CN=57428d75-bef7-43e1-938b-2e749f5a8d56,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     406objectClass: top
     407objectClass: container
     408
     409dn: CN=61b34cb0-55ee-4be9-b595-97810b92b017,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     410objectClass: top
     411objectClass: container
     412
     413dn: CN=71482d49-8870-4cb3-a438-b6fc9ec35d70,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     414objectClass: top
     415objectClass: container
     416
     417dn: CN=9738c400-7795-4d6e-b19d-c16cd6486166,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     418objectClass: top
     419objectClass: container
     420
     421dn: CN=a1789bfb-e0a2-4739-8cc0-e77d892d080a,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     422objectClass: top
     423objectClass: container
     424
     425dn: CN=a3dac986-80e7-4e59-a059-54cb1ab43cb9,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     426objectClass: top
     427objectClass: container
     428
     429dn: CN=aed72870-bf16-4788-8ac7-22299c8207f1,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     430objectClass: top
     431objectClass: container
     432
     433dn: CN=b96ed344-545a-4172-aa0c-68118202f125,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     434objectClass: top
     435objectClass: container
     436
     437dn: CN=c88227bc-fcca-4b58-8d8a-cd3d64528a02,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     438objectClass: top
     439objectClass: container
     440
     441dn: CN=dda1d01d-4bd7-4c49-a184-46f9241b560e,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     442objectClass: top
     443objectClass: container
     444
     445dn: CN=de10d491-909f-4fb0-9abb-4b7865c0fe80,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     446objectClass: top
     447objectClass: container
     448
     449dn: CN=ebad865a-d649-416f-9922-456b53bbb5b8,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     450objectClass: top
     451objectClass: container
     452
     453dn: CN=f58300d1-b71a-4DB6-88a1-a8b9538beaca,CN=Operations,CN=DomainUpdates,CN=System,${DOMAINDN}
     454objectClass: top
     455objectClass: container
     456
    360457dn: CN=Windows2003Update,CN=DomainUpdates,CN=System,${DOMAINDN}
    361458objectClass: top
    362459objectClass: container
    363 revision: 8
     460revision: 9
    364461
    365462# End domain updates
    … …  
    372469isCriticalSystemObject: TRUE
    373470
    374 # Here are missing the FRS objects since we don't support this technique yet
    375 
    376471dn: CN=FileLinks,CN=System,${DOMAINDN}
    377472objectClass: top
    … …  
    394489isCriticalSystemObject: TRUE
    395490
     491# IP security objects
     492
    396493dn: CN=IP Security,CN=System,${DOMAINDN}
    397494objectClass: top
    … …  
    399496isCriticalSystemObject: TRUE
    400497
     498dn: CN=ipsecPolicy{72385230-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     499objectClass: top
     500objectClass: ipsecBase
     501objectClass: ipsecPolicy
     502description: For all IP traffic, always request security using Kerberos trust. Allow unsecured communication with clients that do not respond to request.
     503ipsecName: Server (Request Security)
     504ipsecID: {72385230-70FA-11D1-864C-14A300000000}
     505ipsecDataType: 598
     506ipsecData:: YyEgIkxP0RGGOwCgJI0wIQQAAAAwKgAAAA==
     507ipsecISAKMPReference: CN=ipsecISAKMPPolicy{72385231-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     508ipsecNFAReference: CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     509ipsecNFAReference: CN=ipsecNFA{59319BE2-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     510ipsecNFAReference: CN=ipsecNFA{72385232-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     511isCriticalSystemObject: TRUE
     512
     513dn: CN=ipsecISAKMPPolicy{72385231-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     514objectClass: top
     515objectClass: ipsecBase
     516objectClass: ipsecISAKMPPolicy
     517ipsecID: {72385231-70FA-11D1-864C-14A300000000}
     518ipsecDataType: 598
     519ipsecData:: uCDcgMgu0RGongCgJI0wIUABAABo0hlRHQfTEa0iAGCw7MoXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAADNzQMAAABAAAAACAAAAAIAAABAAAAAAAAAAAAAAAAAAAAAAAAAAADNzc0CAAAAAAAAAAAAAACAcAAAzc3NzQAAzc0DAAAAQAAAAAgAAAABAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAzc3NAgAAAAAAAAAAAAAAgHAAAM3Nzc0AAM3NAQAAAEAAAAAIAAAAAgAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAM3NzQEAAAAAAAAAAAAAAIBwAADNzc3NAADNzQEAAABAAAAACAAAAAEAAABAAAAAAAAAAAAAAAAAAAAAAAAAAADNzc0BAAAAAAAAAAAAAACAcAAAzc3NzQA=
     520ipsecOwnersReference: CN=ipsecPolicy{72385230-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     521isCriticalSystemObject: TRUE
     522
     523dn: CN=ipsecNFA{72385232-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     524objectClass: top
     525objectClass: ipsecBase
     526objectClass: ipsecNFA
     527description: For all IP traffic, always request security using Kerberos trust. Allow unsecured communication with clients that do not respond to request.
     528ipsecName: Request Security (Optional) Rule
     529ipsecID: {72385232-70FA-11D1-864C-14A300000000}
     530ipsecDataType: 598
     531ipsecData:: AKy7EY1J0RGGOQCgJI0wISoAAAABAAAABQAAAAIAAAAAAP3///8CAAAAAAAAAAAAAAAAAAEAAAACAAAAAAAA
     532ipsecOwnersReference: CN=ipsecPolicy{72385230-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     533ipsecNegotiationPolicyReference: CN=ipsecNegotiationPolicy{72385233-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     534ipsecFilterReference: CN=ipsecFilter{7238523A-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     535isCriticalSystemObject: TRUE
     536
     537dn: CN=ipsecNFA{59319BE2-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     538objectClass: top
     539objectClass: ipsecBase
     540objectClass: ipsecNFA
     541ipsecID: {59319BE2-5EE3-11D2-ACE8-0060B0ECCA17}
     542ipsecDataType: 598
     543ipsecData:: AKy7EY1J0RGGOQCgJI0wISoAAAABAAAABQAAAAIAAAAAAP3///8CAAAAAAAAAAAAAAAAAAEAAAACAAAAAAAA
     544ipsecOwnersReference: CN=ipsecPolicy{72385230-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     545ipsecNegotiationPolicyReference: CN=ipsecNegotiationPolicy{59319BDF-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     546isCriticalSystemObject: TRUE
     547
     548dn: CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     549objectClass: top
     550objectClass: ipsecBase
     551objectClass: ipsecNFA
     552description: Permit unsecure ICMP packets to pass through.
     553ipsecName: Permit unsecure ICMP packets to pass through.
     554ipsecID: {594272E2-071D-11D3-AD22-0060B0ECCA17}
     555ipsecDataType: 598
     556ipsecData:: AKy7EY1J0RGGOQCgJI0wISoAAAABAAAABQAAAAIAAAAAAP3///8CAAAAAAAAAAAAAAAAAAEAAAACAAAAAAAA
     557ipsecOwnersReference: CN=ipsecPolicy{72385230-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     558ipsecNegotiationPolicyReference: CN=ipsecNegotiationPolicy{7238523B-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     559ipsecFilterReference: CN=ipsecFilter{72385235-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     560isCriticalSystemObject: TRUE
     561
     562dn: CN=ipsecNegotiationPolicy{72385233-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     563objectClass: top
     564objectClass: ipsecBase
     565objectClass: ipsecNegotiationPolicy
     566description: Accepts unsecured communication, but requests clients to establish trust and security methods.  Will communicate insecurely to untrusted clients if they do not respond to request.
     567ipsecName: Request Security (Optional)
     568ipsecID: {72385233-70FA-11D1-864C-14A300000000}
     569ipsecDataType: 598
     570ipsecData:: uSDcgMgu0RGongCgJI0wIZQBAAAFAAAAhAMAAKCGAQAAAAAAAAAAAAEAAAADAAAAAgAAAAIAAABAAAAACAAAAFwAUwBlAHIAdgBpAGMAZQBzAFwAUABvAGwAaQBjAHkAQQBnAGUAbgCEAwAAoIYBAAAAAAAAAAAAAQAAAAEAAAACAAAAAgAAAEAAAAAIAAAAAAAAAFX0sjdcAEwAbwBjABUADwABAAgAIAJlACACZQBYxHYF+M54BSwBAACghgEAAAAAAAAAAAABAAAAAgAAAAAAAAABAAAAQAAAAAgAAAAtADkAQQBDADEALQA0AEQANgBEAC0AQQAxAEIAMAAtADEANQA4ADcALAEAAKCGAQAAAAAAAAAAAAEAAAABAAAAAAAAAAEAAABAAAAACAAAAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFAAbwBsAGkAYwB5AEEAZwAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAgAAAEAAAAAIAAAANgBDAC0AMwBCADkANwAtADQANQA1ADIALQA4AEUANAA1AC0AOQA5AAA=
     571ipsecOwnersReference: CN=ipsecNFA{72385232-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     572isCriticalSystemObject: TRUE
     573iPSECNegotiationPolicyType: {62F49E10-6C37-11D1-864C-14A300000000}
     574iPSECNegotiationPolicyAction: {3F91A81A-7647-11D1-864D-D46A00000000}
     575
     576dn: CN=ipsecFilter{7238523A-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     577objectClass: top
     578objectClass: ipsecBase
     579objectClass: ipsecFilter
     580description: Matches all IP packets from this computer to any other computer, except broadcast, multicast, Kerberos, RSVP and ISAKMP (IKE).
     581ipsecName: All IP Traffic
     582ipsecID: {7238523A-70FA-11D1-864C-14A300000000}
     583ipsecDataType: 598
     584ipsecData:: tSDcgMgu0RGongCgJI0wIUoAAAABAAAAAgAAAAAAAgAAAAAAAgAAAAAA3ZsxWeNe0hGs6ABgsOzKFwEAAAAAAAAA/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
     585ipsecOwnersReference: CN=ipsecNFA{72385232-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     586ipsecOwnersReference: CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     587isCriticalSystemObject: TRUE
     588
     589dn: CN=ipsecNegotiationPolicy{59319BDF-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     590objectClass: top
     591objectClass: ipsecBase
     592objectClass: ipsecNegotiationPolicy
     593ipsecID: {59319BDF-5EE3-11D2-ACE8-0060B0ECCA17}
     594ipsecDataType: 598
     595ipsecData:: uSDcgMgu0RGongCgJI0wIeQBAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAADAAAAAgAAAAIAAABAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAMAAAABAAAAAgAAAEAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQAAAAIAAAACAAAAQAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAQAAAAIAAABAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAIAAAAAAAAAAQAAAEAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQAAAAAAAAABAAAAQAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
     596ipsecOwnersReference: CN=ipsecNFA{59319BE2-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     597isCriticalSystemObject: TRUE
     598iPSECNegotiationPolicyType: {62F49E13-6C37-11D1-864C-14A300000000}
     599iPSECNegotiationPolicyAction: {8A171DD3-77E3-11D1-8659-A04F00000000}
     600
     601dn: CN=ipsecNegotiationPolicy{7238523B-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     602objectClass: top
     603objectClass: ipsecBase
     604objectClass: ipsecNegotiationPolicy
     605description: Permit unsecured IP packets to pass through.
     606ipsecName: Permit
     607ipsecID: {7238523B-70FA-11D1-864C-14A300000000}
     608ipsecDataType: 598
     609ipsecData:: uSDcgMgu0RGongCgJI0wIQQAAAAAAAAAAA==
     610ipsecOwnersReference: CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     611ipsecOwnersReference: CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     612isCriticalSystemObject: TRUE
     613iPSECNegotiationPolicyType: {62F49E10-6C37-11D1-864C-14A300000000}
     614iPSECNegotiationPolicyAction: {8A171DD2-77E3-11D1-8659-A04F00000000}
     615
     616dn: CN=ipsecFilter{72385235-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     617objectClass: top
     618objectClass: ipsecBase
     619objectClass: ipsecFilter
     620description: Matches all ICMP packets between this computer and any other computer.
     621ipsecName: All ICMP Traffic
     622ipsecID: {72385235-70FA-11D1-864C-14A300000000}
     623ipsecDataType: 598
     624ipsecData:: tSDcgMgu0RGongCgJI0wIVIAAAABAAAAAgAAAAAAAgAAAAAACgAAAEkAQwBNAFAAAABj0hlRHQfTEa0iAGCw7MoXAQAAAAAAAAD/////AAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAA==
     625ipsecOwnersReference: CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     626ipsecOwnersReference: CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     627isCriticalSystemObject: TRUE
     628
     629dn: CN=ipsecPolicy{72385236-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     630objectClass: top
     631objectClass: ipsecBase
     632objectClass: ipsecPolicy
     633description: Communicate normally (unsecured). Use the default response rule to negotiate with servers that request security. Only the requested protocol and port traffic with that server is secured.
     634ipsecName: Client (Respond Only)
     635ipsecID: {72385236-70FA-11D1-864C-14A300000000}
     636ipsecDataType: 598
     637ipsecData:: YyEgIkxP0RGGOwCgJI0wIQQAAAAwKgAAAA==
     638ipsecISAKMPReference: CN=ipsecISAKMPPolicy{72385237-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     639ipsecNFAReference: CN=ipsecNFA{59319C04-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     640isCriticalSystemObject: TRUE
     641
     642dn: CN=ipsecISAKMPPolicy{72385237-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     643objectClass: top
     644objectClass: ipsecBase
     645objectClass: ipsecISAKMPPolicy
     646ipsecID: {72385237-70FA-11D1-864C-14A300000000}
     647ipsecDataType: 598
     648ipsecData:: uCDcgMgu0RGongCgJI0wIUABAABz7EFfHQfTEa0iAGCw7MoXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAADNzQMAAABAAAAACAAAAAIAAABAAAAAAAAAAAAAAAAAAAAAAAAAAADNzc0CAAAAAAAAAAAAAACAcAAAzc3NzQAAzc0DAAAAQAAAAAgAAAABAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAzc3NAgAAAAAAAAAAAAAAgHAAAM3Nzc0AAM3NAQAAAEAAAAAIAAAAAgAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAM3NzQEAAAAAAAAAAAAAAIBwAADNzc3NAADNzQEAAABAAAAACAAAAAEAAABAAAAAAAAAAAAAAAAAAAAAAAAAAADNzc0BAAAAAAAAAAAAAACAcAAAzc3NzQA=
     649ipsecOwnersReference: CN=ipsecPolicy{72385236-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     650isCriticalSystemObject: TRUE
     651
     652dn: CN=ipsecNFA{59319C04-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     653objectClass: top
     654objectClass: ipsecBase
     655objectClass: ipsecNFA
     656ipsecID: {59319C04-5EE3-11D2-ACE8-0060B0ECCA17}
     657ipsecDataType: 598
     658ipsecData:: AKy7EY1J0RGGOQCgJI0wISoAAAABAAAABQAAAAIAAAAAAP3///8CAAAAAAAAAAAAAAAAAAEAAAACAAAAAAAA
     659ipsecOwnersReference: CN=ipsecPolicy{72385236-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     660ipsecNegotiationPolicyReference: CN=ipsecNegotiationPolicy{59319C01-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     661isCriticalSystemObject: TRUE
     662
     663dn: CN=ipsecNegotiationPolicy{59319C01-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     664objectClass: top
     665objectClass: ipsecBase
     666objectClass: ipsecNegotiationPolicy
     667ipsecID: {59319C01-5EE3-11D2-ACE8-0060B0ECCA17}
     668ipsecDataType: 598
     669ipsecData:: uSDcgMgu0RGongCgJI0wIeQBAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAADAAAAAgAAAAIAAABAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAMAAAABAAAAAgAAAEAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQAAAAIAAAACAAAAQAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAQAAAAIAAABAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAIAAAAAAAAAAQAAAEAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQAAAAAAAAABAAAAQAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
     670ipsecOwnersReference: CN=ipsecNFA{59319C04-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     671isCriticalSystemObject: TRUE
     672iPSECNegotiationPolicyType: {62F49E13-6C37-11D1-864C-14A300000000}
     673iPSECNegotiationPolicyAction: {8A171DD3-77E3-11D1-8659-A04F00000000}
     674
     675dn: CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     676objectClass: top
     677objectClass: ipsecBase
     678objectClass: ipsecPolicy
     679description: For all IP traffic, always require security using Kerberos trust. Do NOT allow unsecured communication with untrusted clients.
     680ipsecName: Secure Server (Require Security)
     681ipsecID: {7238523C-70FA-11D1-864C-14A300000000}
     682ipsecDataType: 598
     683ipsecData:: YyEgIkxP0RGGOwCgJI0wIQQAAAAwKgAAAA==
     684ipsecISAKMPReference: CN=ipsecISAKMPPolicy{7238523D-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     685ipsecNFAReference: CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     686ipsecNFAReference: CN=ipsecNFA{59319BF3-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     687ipsecNFAReference: CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     688isCriticalSystemObject: TRUE
     689
     690dn: CN=ipsecISAKMPPolicy{7238523D-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     691objectClass: top
     692objectClass: ipsecBase
     693objectClass: ipsecISAKMPPolicy
     694ipsecID: {7238523D-70FA-11D1-864C-14A300000000}
     695ipsecDataType: 598
     696ipsecData:: uCDcgMgu0RGongCgJI0wIUABAAD5ckJZHQfTEa0iAGCw7MoXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAADNzQMAAABAAAAACAAAAAIAAABAAAAAAAAAAAAAAAAAAAAAAAAAAADNzc0CAAAAAAAAAAAAAACAcAAAzc3NzQAAzc0DAAAAQAAAAAgAAAABAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAzc3NAgAAAAAAAAAAAAAAgHAAAM3Nzc0AAM3NAQAAAEAAAAAIAAAAAgAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAM3NzQEAAAAAAAAAAAAAAIBwAADNzc3NAADNzQEAAABAAAAACAAAAAEAAABAAAAAAAAAAAAAAAAAAAAAAAAAAADNzc0BAAAAAAAAAAAAAACAcAAAzc3NzQA=
     697ipsecOwnersReference: CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     698isCriticalSystemObject: TRUE
     699
     700dn: CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     701objectClass: top
     702objectClass: ipsecBase
     703objectClass: ipsecNFA
     704description: Accepts unsecured communication, but always requires clients to establish trust and security methods.  Will NOT communicate with untrusted clients.
     705ipsecName: Require Security
     706ipsecID: {7238523E-70FA-11D1-864C-14A300000000}
     707ipsecDataType: 598
     708ipsecData:: AKy7EY1J0RGGOQCgJI0wISoAAAABAAAABQAAAAIAAAAAAP3///8CAAAAAAAAAAAAAAAAAAEAAAACAAAAAAAA
     709ipsecOwnersReference: CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     710ipsecNegotiationPolicyReference: CN=ipsecNegotiationPolicy{7238523F-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     711ipsecFilterReference: CN=ipsecFilter{7238523A-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     712isCriticalSystemObject: TRUE
     713
     714dn: CN=ipsecNFA{59319BF3-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     715objectClass: top
     716objectClass: ipsecBase
     717objectClass: ipsecNFA
     718ipsecID: {59319BF3-5EE3-11D2-ACE8-0060B0ECCA17}
     719ipsecDataType: 598
     720ipsecData:: AKy7EY1J0RGGOQCgJI0wISoAAAABAAAABQAAAAIAAAAAAP3///8CAAAAAAAAAAAAAAAAAAEAAAACAAAAAAAA
     721ipsecOwnersReference: CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     722ipsecNegotiationPolicyReference: CN=ipsecNegotiationPolicy{59319BF0-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     723isCriticalSystemObject: TRUE
     724
     725dn: CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     726objectClass: top
     727objectClass: ipsecBase
     728objectClass: ipsecNFA
     729description: Permit unsecure ICMP packets to pass through.
     730ipsecName: Permit unsecure ICMP packets to pass through.
     731ipsecID: {594272FD-071D-11D3-AD22-0060B0ECCA17}
     732ipsecDataType: 598
     733ipsecData:: AKy7EY1J0RGGOQCgJI0wISoAAAABAAAABQAAAAIAAAAAAP3///8CAAAAAAAAAAAAAAAAAAEAAAACAAAAAAAA
     734ipsecOwnersReference: CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     735ipsecNegotiationPolicyReference: CN=ipsecNegotiationPolicy{7238523B-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     736ipsecFilterReference: CN=ipsecFilter{72385235-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     737isCriticalSystemObject: TRUE
     738
     739dn: CN=ipsecNegotiationPolicy{7238523F-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     740objectClass: top
     741objectClass: ipsecBase
     742objectClass: ipsecNegotiationPolicy
     743description: Accepts unsecured communication, but always requires clients to establish trust and security methods.  Will NOT communicate with untrusted clients.
     744ipsecName: Require Security
     745ipsecID: {7238523F-70FA-11D1-864C-14A300000000}
     746ipsecDataType: 598
     747ipsecData:: uSDcgMgu0RGongCgJI0wIUQBAAAEAAAAhAMAAKCGAQAAAAAAAAAAAAEAAAADAAAAAgAAAAIAAABAAAAACAAAAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABTAGUAcgCEAwAAoIYBAAAAAAAAAAAAAQAAAAMAAAABAAAAAgAAAEAAAAAIAAAAcABzAGUAYwBOAEYAQQB7ADcAMgAzADgANQAyADMARQAtADcAMABGAIQDAACghgEAAAAAAAAAAAABAAAAAQAAAAIAAAACAAAAQAAAAAgAAABsAGkAYwB5AFwATABvAGMAYQBsAFwAaQBwAHMAZQBjAE4ARgBBAHsAhAMAAKCGAQAAAAAAAAAAAAEAAAABAAAAAQAAAAIAAABAAAAACAAAAGUAYwBOAEYAQQB7AEIARgBDADcAQwAzADUAQQAtAEIANQA5ADIALQAA
     748ipsecOwnersReference: CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300000000},CN=IP Security,CN=System,${DOMAINDN}
     749isCriticalSystemObject: TRUE
     750iPSECNegotiationPolicyType: {62F49E10-6C37-11D1-864C-14A300000000}
     751iPSECNegotiationPolicyAction: {3F91A81A-7647-11D1-864D-D46A00000000}
     752
     753dn: CN=ipsecNegotiationPolicy{59319BF0-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     754objectClass: top
     755objectClass: ipsecBase
     756objectClass: ipsecNegotiationPolicy
     757ipsecID: {59319BF0-5EE3-11D2-ACE8-0060B0ECCA17}
     758ipsecDataType: 598
     759ipsecData:: uSDcgMgu0RGongCgJI0wIeQBAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAADAAAAAgAAAAIAAABAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAMAAAABAAAAAgAAAEAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQAAAAIAAAACAAAAQAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAQAAAAIAAABAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAIAAAAAAAAAAQAAAEAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQAAAAAAAAABAAAAQAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
     760ipsecOwnersReference: CN=ipsecNFA{59319BF3-5EE3-11D2-ACE8-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     761isCriticalSystemObject: TRUE
     762iPSECNegotiationPolicyType: {62F49E13-6C37-11D1-864C-14A300000000}
     763iPSECNegotiationPolicyAction: {8A171DD3-77E3-11D1-8659-A04F00000000}
     764
     765dn: CN=ipsecNFA{6A1F5C6F-72B7-11D2-ACF0-0060B0ECCA17},CN=IP Security,CN=System,${DOMAINDN}
     766objectClass: top
     767objectClass: ipsecBase
     768objectClass: ipsecNFA
     769description: Version Information Object
     770ipsecName: Version Information Object
     771ipsecID: {6A1F5C6F-72B7-11D2-ACF0-0060B0ECCA17}
     772ipsecDataType: 598
     773ipsecData:: b1wfardy0hGs8ABgsOzKF1AAAAAAAAEApmamNhoAAABXAGkAbgBkAG8AdwBzACAAMgAwADAAMAAAABwAAABBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAAAABgAAAA0ACgAAAACsuxGNSdERhjkAoCSNMCEqAAAAAQAAAAUAAAACAAAAAAD9////AgAAAAAAAAAAAAAAAAABAAAAAgAAAAAAAA==
     774isCriticalSystemObject: TRUE
     775
     776# End IP security objects
     777
    401778dn: CN=Meetings,CN=System,${DOMAINDN}
    402779objectClass: top
    … …  
    404781isCriticalSystemObject: TRUE
    405782
    406 dn: CN=MicrosoftDNS,CN=System,${DOMAINDN}
    407 objectClass: top
    408 objectClass: container
    409 displayName: DNS Servers
     783dn: CN=Password Settings Container,CN=System,${DOMAINDN}
     784objectClass: top
     785objectClass: msDS-PasswordSettingsContainer
     786systemFlags: -1946157056
     787showInAdvancedViewOnly: TRUE
    410788
    411789dn: CN=Policies,CN=System,${DOMAINDN}
    … …  
    427805objectClass: rIDManager
    428806systemFlags: -1946157056
    429 rIDAvailablePool: 4611686014132423217
     807rIDAvailablePool: ${RIDAVAILABLESTART}-1073741823
    430808isCriticalSystemObject: TRUE
    431809

  • vendor/current/source4/setup/provision.reg

    r414 r740  
    1010
    1111[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
    12 CurrentVersion=5.2
     12"CurrentVersion"="6.1"
    1313
    1414[HKEY_LOCAL_MACHINE\SYSTEM]
    … …  
    1919
    2020[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions]
    21 ProductType=LanmanNT
     21"ProductType"="LanmanNT"
    2222
    2323[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print]
    … …  
    3434
    3535[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]
    36 RefusePasswordChange=REG_DWORD:0
     36"RefusePasswordChange"=dword:00000000
    3737
    3838[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter]

  • vendor/current/source4/setup/provision.smb.conf.dc

    r414 r740  
    11[globals]
    2         netbios name    = ${HOSTNAME}
     2        netbios name    = ${NETBIOS_NAME}
    33        workgroup       = ${DOMAIN}
    44        realm           = ${REALM}
    55        server role     = ${SERVERROLE}
     6        ${SIDGENERATOR_LINE}
    67        ${PRIVATEDIR_LINE}
    78        ${LOCKDIR_LINE}

  • vendor/current/source4/setup/provision.smb.conf.member

    r414 r740  
    11[globals]
    2         netbios name    = ${HOSTNAME}
     2        netbios name    = ${NETBIOS_NAME}
    33        workgroup       = ${DOMAIN}
    44        realm           = ${REALM}
    55        server role     = ${SERVERROLE}
     6        ${SIDGENERATOR_LINE}
    67        ${PRIVATEDIR_LINE}
    78        ${LOCKDIR_LINE}

  • vendor/current/source4/setup/provision.smb.conf.standalone

    r414 r740  
    11[globals]
    2         netbios name    = ${HOSTNAME}
     2        netbios name    = ${NETBIOS_NAME}
    33        workgroup       = ${DOMAIN}
    44        realm           = ${REALM}
    55        server role     = ${SERVERROLE}
     6        ${SIDGENERATOR_LINE}
    67        ${PRIVATEDIR_LINE}
    78        ${LOCKDIR_LINE}

  • vendor/current/source4/setup/provision.zone

    r414 r740  
    33$ORIGIN ${DNSDOMAIN}.
    44$TTL 1W
    5 @               IN SOA  @   hostmaster (
     5@               IN SOA  ${HOSTNAME}   hostmaster (
    66                                ${DATESTRING}   ; serial
    77                                2D              ; refresh
    … …  
    1515${HOSTIP6_HOST_LINE}
    1616${HOSTIP_HOST_LINE}
    17 gc._msdcs               IN CNAME        ${HOSTNAME}
     17${GC_MSDCS_IP_LINE}
     18${GC_MSDCS_IP6_LINE}
    1819${NTDSGUID}._msdcs      IN CNAME        ${HOSTNAME}
    1920;
    … …  
    2122_gc._tcp                IN SRV 0 100 3268       ${HOSTNAME}
    2223_gc._tcp.${DEFAULTSITE}._sites  IN SRV 0 100 3268       ${HOSTNAME}
    23 _ldap._tcp.gc._msdcs    IN SRV 0 100 389        ${HOSTNAME}
    24 _ldap._tcp.${DEFAULTSITE}._sites.gc._msdcs      IN SRV 0 100 389 ${HOSTNAME}
     24_ldap._tcp.gc._msdcs    IN SRV 0 100 3268       ${HOSTNAME}
     25_ldap._tcp.${DEFAULTSITE}._sites.gc._msdcs      IN SRV 0 100 3268 ${HOSTNAME}
    2526;
    2627; ldap servers

  • vendor/current/source4/setup/provision_basedn.ldif

    r414 r740  
    44dn: ${DOMAINDN}
    55objectClass: top
    6 objectClass: ${DOMAIN_OC}
    7 
     6objectClass: domaindns
     7instanceType: 5
     8objectSid: ${DOMAINSID}
     9nTSecurityDescriptor:: ${DESCRIPTOR}
     10${DOMAINGUID}

  • vendor/current/source4/setup/provision_basedn_modify.ldif

    r414 r740  
    1212creationTime: ${CREATTIME}
    1313-
     14# "dSCorePropagationDate" should contain the provision data
    1415replace: forceLogoff
    1516forceLogoff: -9223372036854775808
    … …  
    3334# "masteredBy" filled in later
    3435replace: maxPwdAge
    35 maxPwdAge: -37108517437440
     36maxPwdAge: -36288000000000
    3637-
    37 # FIXME: This should be "-864000000000" when we fully comply with passwords pol.
    3838replace: minPwdAge
    39 minPwdAge: 0
     39minPwdAge: -864000000000
    4040-
    4141replace: minPwdLength
    … …  
    5858-
    5959# "msDs-masteredBy" filled in later
     60replace: msDS-NcType
     61msDS-NcType: 0
     62-
    6063replace: msDS-PerUserTrustQuota
    6164msDS-PerUserTrustQuota: 1
    … …  
    6568-
    6669replace: nextRid
    67 nextRid: 1000
     70nextRid: ${NEXTRID}
    6871-
    6972replace: nTMixedDomain
    7073nTMixedDomain: 0
    7174-
    72 replace: objectSid
    73 objectSid: ${DOMAINSID}
    74 -
    75 # This exists only in SAMBA
     75# This does only exist in SAMBA
    7676replace: oEMInformation
    7777oEMInformation: Provisioned by SAMBA ${SAMBA_VERSION_STRING}
    … …  
    9898uASCompat: 1
    9999-
    100 replace: wellKnownObjects
    101 wellKnownObjects: B:32:6227f0af1fc2410d8e3bb10615bb5b0f:CN=NTDS Quotas,${DOMAINDN}
    102 wellKnownObjects: B:32:f4be92a4c777485e878e9421d53087db:CN=Microsoft,CN=Program Data,${DOMAINDN}
    103 wellKnownObjects: B:32:09460c08ae1e4a4ea0f64aee7daa1e5a:CN=Program Data,${DOMAINDN}
    104 wellKnownObjects: B:32:22b70c67d56e4efb91e9300fca3dc1aa:CN=ForeignSecurityPrincipals,${DOMAINDN}
    105 wellKnownObjects: B:32:18e2ea80684f11d2b9aa00c04f79f805:CN=Deleted Objects,${DOMAINDN}
    106 wellKnownObjects: B:32:2fbac1870ade11d297c400c04fd8d5cd:CN=Infrastructure,${DOMAINDN}
    107 wellKnownObjects: B:32:ab8153b7768811d1aded00c04fd8d5cd:CN=LostAndFound,${DOMAINDN}
    108 wellKnownObjects: B:32:ab1d30f3768811d1aded00c04fd8d5cd:CN=System,${DOMAINDN}
    109 wellKnownObjects: B:32:a361b2ffffd211d1aa4b00c04fd7d83a:OU=Domain Controllers,${DOMAINDN}
    110 wellKnownObjects: B:32:aa312825768811d1aded00c04fd8d5cd:CN=Computers,${DOMAINDN}
    111 wellKnownObjects: B:32:a9d1ca15768811d1aded00c04fd8d5cd:CN=Users,${DOMAINDN}
    112 -
    113 ${DOMAINGUID_MOD}
     100

  • vendor/current/source4/setup/provision_configuration.ldif

    r414 r740  
    640640validAccesses: 256
    641641
     642dn: CN=DS-Replication-Get-Changes-In-Filtered-Set,CN=Extended-Rights,${CONFIGDN}
     643objectClass: top
     644objectClass: controlAccessRight
     645displayName: Replicating Directory Changes In Filtered Set
     646rightsGuid: 89e95b76-444d-4c62-991a-0facbeda640c
     647appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
     648appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
     649appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
     650localizationDisplayId: 77
     651validAccesses: 256
     652
     653dn: CN=MS-TS-GatewayAccess,CN=Extended-Rights,${CONFIGDN}
     654objectClass: top
     655objectClass: controlAccessRight
     656displayName: MS-TS-GatewayAccess
     657rightsGuid: ffa6f046-ca4b-4feb-b40d-04dfee722543
     658appliesTo: bf967a86-0de6-11d0-a285-00aa003049e2
     659localizationDisplayId: 74
     660validAccesses: 48
     661
     662dn: CN=Private-Information,CN=Extended-Rights,${CONFIGDN}
     663objectClass: top
     664objectClass: controlAccessRight
     665displayName: Private Information
     666rightsGuid: 91e647de-d96f-4b70-9557-d63ff4f3ccd8
     667appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
     668appliesTo: 4828cc14-1437-45bc-9b07-ad6f015e5f28
     669localizationDisplayId: 72
     670validAccesses: 48
     671
     672dn: CN=Read-Only-Replication-Secret-Synchronization,CN=Extended-Rights,${CONFIGDN}
     673objectClass: top
     674objectClass: controlAccessRight
     675displayName: Read Only Replication Secret Synchronization
     676rightsGuid: 1131f6ae-9c07-11d1-f79f-00c04fc2dcd2
     677appliesTo: bf967a8f-0de6-11d0-a285-00aa003049e2
     678appliesTo: bf967a87-0de6-11d0-a285-00aa003049e2
     679appliesTo: 19195a5b-6da0-11d0-afd3-00c04fd930c9
     680localizationDisplayId: 73
     681validAccesses: 256
     682
     683dn: CN=Reload-SSL-Certificate,CN=Extended-Rights,${CONFIGDN}
     684objectClass: top
     685objectClass: controlAccessRight
     686displayName: Reload SSL/TLS Certificate
     687rightsGuid: 1a60ea8d-58a6-4b20-bcdc-fb71eb8a9ff8
     688appliesTo: f0f8ffab-1191-11d0-a060-00aa006c33ed
     689localizationDisplayId: 76
     690validAccesses: 256
     691
     692dn: CN=Terminal-Server-License-Server,CN=Extended-Rights,${CONFIGDN}
     693objectClass: top
     694objectClass: controlAccessRight
     695displayName: Terminal Server License Server
     696rightsGuid: 5805bc62-bdc9-4428-a5e2-856a0f4c185e
     697appliesTo: bf967aba-0de6-11d0-a285-00aa003049e2
     698appliesTo: 4828cc14-1437-45bc-9b07-ad6f015e5f28
     699localizationDisplayId: 75
     700validAccesses: 48
     701
    642702# End extended rights
    643703
    … …  
    648708objectClass: container
    649709
     710dn: CN=ActiveDirectoryRodcUpdate,CN=ForestUpdates,${CONFIGDN}
     711objectClass: top
     712objectClass: container
     713revision: 5
     714
     715dn: CN=ActiveDirectoryUpdate,CN=ForestUpdates,${CONFIGDN}
     716objectClass: top
     717objectClass: container
     718revision: 5
     719
    650720dn: CN=Operations,CN=ForestUpdates,${CONFIGDN}
    651721objectClass: top
    … …  
    671741objectClass: top
    672742objectClass: container
     743objectVersion: 3
    673744
    674745dn: CN=1a3f6b15-55f2-4752-ba27-3d38a8232c4d,CN=Operations,CN=ForestUpdates,${CONFIGDN}
    … …  
    800871objectClass: container
    801872
     873dn: CN=002fb291-0d00-4b0c-8c00-fe7f50ce6f8d,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     874objectClass: top
     875objectClass: container
     876
     877dn: CN=07e57d28-ad40-44fc-8334-8a0dc119b3f4,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     878objectClass: top
     879objectClass: container
     880
     881dn: CN=0fc5a978-0059-4b0a-9dc2-9896e8e389a1,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     882objectClass: top
     883objectClass: container
     884
     885dn: CN=10338d31-2423-4dff-b4b5-ef025144b01f,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     886objectClass: top
     887objectClass: container
     888
     889dn: CN=2a858903-5696-4364-b4e5-4cac027ca7a6,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     890objectClass: top
     891objectClass: container
     892
     893dn: CN=2b9e0609-6d75-498a-9727-c9fcc93f0e42,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     894objectClass: top
     895objectClass: container
     896
     897dn: CN=3b3adbdb-4485-4559-aed8-9811c4bf90e4,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     898objectClass: top
     899objectClass: container
     900
     901dn: CN=429a6334-1a00-4515-bf48-676deb55954a,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     902objectClass: top
     903objectClass: container
     904
     905dn: CN=4c022fd1-adab-4d84-a7f1-9580f03da856,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     906objectClass: top
     907objectClass: container
     908
     909dn: CN=4c0672a2-437c-4944-b953-5db8f111d665,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     910objectClass: top
     911objectClass: container
     912
     913dn: CN=4d753a29-26ac-4d1a-bc80-311f947e4f0a,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     914objectClass: top
     915objectClass: container
     916
     917dn: CN=56040c71-fe93-4037-8fe9-1a4d1a283009,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     918objectClass: top
     919objectClass: container
     920
     921dn: CN=560cf82d-9572-48a3-9024-6f2b56f1f866,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     922objectClass: top
     923objectClass: container
     924
     925dn: CN=613bd063-e8e9-4a62-8f4c-cda566f7eb6f,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     926objectClass: top
     927objectClass: container
     928
     929dn: CN=6eb8eaf9-3403-4ba5-8b4b-ce349a4680ad,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     930objectClass: top
     931objectClass: container
     932
     933dn: CN=6fd48655-1698-497a-ac8d-8267ce01c80b,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     934objectClass: top
     935objectClass: container
     936
     937dn: CN=782370ce-3d38-438d-8b0c-464220a3039d,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     938objectClass: top
     939objectClass: container
     940
     941dn: CN=8f86b825-c322-4101-adc4-579f12d445db,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     942objectClass: top
     943objectClass: container
     944
     945dn: CN=96541a16-910a-4b66-acde-720a0dff03c7,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     946objectClass: top
     947objectClass: container
     948
     949dn: CN=9fea28ff-387f-4d57-866d-3893c50f373f,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     950objectClass: top
     951objectClass: container
     952
     953dn: CN=a96e2ed5-7a7c-4d5c-9d5d-965eca0051da,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     954objectClass: top
     955objectClass: container
     956
     957dn: CN=abd97102-88dd-4013-a009-0e2c2f967ff6,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     958objectClass: top
     959objectClass: container
     960
     961dn: CN=bd3413c0-9559-469b-9f3d-51d7faabd81a,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     962objectClass: top
     963objectClass: container
     964
     965dn: CN=c03b1f37-c240-4910-93c8-1544a452b4b5,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     966objectClass: top
     967objectClass: container
     968
     969dn: CN=caa2bfad-0cca-483b-8d00-347f943292a8,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     970objectClass: top
     971objectClass: container
     972
     973dn: CN=d668ad1f-cedd-4565-ab02-9385926ce4f5,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     974objectClass: top
     975objectClass: container
     976
     977dn: CN=dcb3c95d-deb7-4c51-ad13-43a7d5d06fc7,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     978objectClass: top
     979objectClass: container
     980
     981dn: CN=ea08c04c-f474-4212-b19e-5e754f9210d4,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     982objectClass: top
     983objectClass: container
     984
     985dn: CN=ef010a1e-bd88-48c8-a7af-2affd250d77d,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     986objectClass: top
     987objectClass: container
     988
     989dn: CN=f814097b-3e3d-49ba-8a3a-092c25085f06,CN=Operations,CN=ForestUpdates,CN=Configuration,${DOMAINDN}
     990objectClass: top
     991objectClass: container
     992
    802993dn: CN=Windows2003Update,CN=ForestUpdates,${CONFIGDN}
    803994objectClass: top
    804995objectClass: container
    805 revision: 9
     996revision: 10
    806997
    807998# End forest updates
    … …  
    8161007objectClass: msDS-QuotaContainer
    8171008description: Quota specifications container
     1009isCriticalSystemObject: TRUE
    8181010msDS-TombstoneQuotaFactor: 100
    8191011systemFlags: -2147483648
    … …  
    8251017objectClass: crossRefContainer
    8261018systemFlags: -2147483648
    827 msDS-Behavior-Version: ${FOREST_FUNCTIONALALITY}
     1019msDS-Behavior-Version: ${FOREST_FUNCTIONALITY}
    8281020showInAdvancedViewOnly: TRUE
    8291021
    … …  
    8481040objectClass: crossRef
    8491041dnsRoot: ${DNSDOMAIN}
     1042msDS-Behavior-Version: ${DOMAIN_FUNCTIONALITY}
    8501043nCName: ${DOMAINDN}
    8511044nETBIOSName: ${DOMAIN}
    … …  
    9611154tombstoneLifetime: 180
    9621155
     1156dn: CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,${CONFIGDN}
     1157objectClass: top
     1158objectClass: container
     1159
     1160dn: CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,${CONFIGDN}
     1161objectClass: top
     1162objectClass: msDS-OptionalFeature
     1163msDS-OptionalFeatureGUID: 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a
     1164msDS-OptionalFeatureFlags: 1
     1165msDS-RequiredForestBehaviorVersion: 4
     1166systemFlags: -1946157056
     1167
    9631168dn: CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,${CONFIGDN}
    9641169objectClass: top
    … …  
    9901195objectClass: sitesContainer
    9911196systemFlags: -2113929216
     1197nTSecurityDescriptor:: ${SITES_DESCRIPTOR}
    9921198
    9931199dn: CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
    … …  
    9951201objectClass: site
    9961202systemFlags: 1107296256
    997 
    998 dn: CN=Licensing Site Settings,CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
    999 objectClass: top
    1000 objectClass: applicationSiteSettings
    1001 objectClass: licensingSiteSettings
    10021203
    10031204dn: CN=Inter-Site Transports,CN=Sites,${CONFIGDN}
    … …  
    10181219cost: 100
    10191220replInterval: 180
     1221showInAdvancedViewOnly: TRUE
    10201222siteList: CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
    10211223systemFlags: 1073741824
    … …  
    10321234objectClass: applicationSiteSettings
    10331235objectClass: nTDSSiteSettings
     1236schedule:: vAAAAAAAAAABAAAAAAAAABQAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE=
    10341237
    10351238dn: CN=Servers,CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
    … …  
    10411244objectClass: top
    10421245objectClass: subnetContainer
    1043 systemFlags: -1073741824
     1246systemFlags: -2147483648

  • vendor/current/source4/setup/provision_configuration_basedn.ldif

    r414 r740  
    55objectClass: top
    66objectClass: configuration
    7 cn: Configuration
     7msDS-NcType: 0
    88nTSecurityDescriptor:: ${DESCRIPTOR}
     9instanceType: 13

  • vendor/current/source4/setup/provision_group_policy.ldif

    r414 r740  
    66gPCFunctionalityVersion: 2
    77gPCFileSysPath: \\${DNSDOMAIN}\sysvol\${DNSDOMAIN}\Policies\{${POLICYGUID}}
    8 versionNumber: 65543
     8versionNumber: 0
    99flags: 0
    1010gPCMachineExtensionNames: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-248
    … …  
    1616 11D1-A7CC-0000F87571E3}]
    1717isCriticalSystemObject: TRUE
    18 nTSecurityDescriptor: O:${DOMAINSID}-512G:${DOMAINSID}-512D:PAI(A;CI;RPWPCCDCLCLORCWOWDSDDTSW;;;${DOMAINSID}-512)(A;CI;RPWPCCDCLCLORCWOWDSDDTSW;;;${DOMAINSID}-519)(A;;RPWPCCDCLCLORCWOWDSDDTSW;;;${DOMAINSID}-512)(A;CIIO;RPWPCCDCLCLORCWOWDSDDTSW;;;CO)(A;CI;RPWPCCDCLCLORCWOWDSDDTSW;;;SY)(A;CI;RPLCLORC;;;AU)(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;CI;RPLCLORC;;;ED)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)
    1918systemFlags: -1946157056
    2019
    … …  
    3837gPCFunctionalityVersion: 2
    3938gPCFileSysPath: \\${DNSDOMAIN}\sysvol\${DNSDOMAIN}\Policies\{${POLICYGUID_DC}}
    40 versionNumber: 2
     39versionNumber: 0
    4140flags: 0
    4241gPCMachineExtensionNames: [{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4
    4342 FB-11D0-A0D0-00A0C90F574B}]
    4443isCriticalSystemObject: TRUE
    45 nTSecurityDescriptor: O:${DOMAINSID}-512G:${DOMAINSID}-512D:PAI(A;CI;RPWPCCDCLCLORCWOWDSDDTSW;;;${DOMAINSID}-512)(A;CI;RPWPCCDCLCLORCWOWDSDDTSW;;;${DOMAINSID}-519)(A;;RPWPCCDCLCLORCWOWDSDDTSW;;;${DOMAINSID}-512)(A;CIIO;RPWPCCDCLCLORCWOWDSDDTSW;;;CO)(A;CI;RPWPCCDCLCLORCWOWDSDDTSW;;;SY)(A;CI;RPLCLORC;;;AU)(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;CI;RPLCLORC;;;ED)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)
    4644systemFlags: -1946157056
    4745

  • vendor/current/source4/setup/provision_init.ldif

    r414 r740  
    1818passwordAttribute: initialAuthOutgoing
    1919passwordAttribute: initialAuthIncoming
     20
     21dn: @OPTIONS
     22checkBaseOnSearch: TRUE
     23
     24dn: @SAMBA_DSDB
     25backendType: ${BACKEND_TYPE}
     26serverRole: ${SERVER_ROLE}
     27
     28dn: @MODULES
     29@LIST: samba_dsdb

  • vendor/current/source4/setup/provision_partitions.ldif

    r414 r740  
    11dn: @PARTITION
    2 partition: ${SCHEMADN}:${SCHEMADN_LDB}
    3 partition: ${CONFIGDN}:${CONFIGDN_LDB}
    4 partition: ${DOMAINDN}:${DOMAINDN_LDB}
    52replicateEntries: @ATTRIBUTES
    63replicateEntries: @INDEXLIST
    74replicateEntries: @OPTIONS
    8 modules:${SCHEMADN}:${SCHEMADN_MOD},${BACKEND_MOD}
    9 modules:${CONFIGDN}:${CONFIGDN_MOD},${BACKEND_MOD}
    10 modules:${DOMAINDN}:${DOMAINDN_MOD},${BACKEND_MOD}
     5${LDAP_BACKEND_LINE}
    116
    12 dn: @MODULES
    13 @LIST: ${MODULES_LIST}${TDB_MODULES_LIST},${MODULES_LIST2}

  • vendor/current/source4/setup/provision_rootdse_add.ldif

    r414 r740  
    77configurationNamingContext: ${CONFIGDN}
    88schemaNamingContext: ${SCHEMADN}
     9#supportedLDAPPolicies: MaxPoolThreads
     10#supportedLDAPPolicies: MaxDatagramRecv
     11#supportedLDAPPolicies: MaxReceiveBuffer
     12#supportedLDAPPolicies: InitRecvTimeout
     13#supportedLDAPPolicies: MaxConnections
     14#supportedLDAPPolicies: MaxConnIdleTime
     15#supportedLDAPPolicies: MaxPageSize
     16#supportedLDAPPolicies: MaxQueryDuration
     17#supportedLDAPPolicies: MaxTempTableSize
     18#supportedLDAPPolicies: MaxResultSetSize
     19#supportedLDAPPolicies: MaxNotificationPerConn
     20#supportedLDAPPolicies: MaxValRange
     21supportedLDAPVersion: 2
    922supportedLDAPVersion: 3
    10 supportedLDAPVersion: 2
    11 dnsHostName: ${DNSNAME}
    12 ldapServiceName: ${DNSDOMAIN}:${NETBIOSNAME}$@${REALM}
    13 serverName: ${SERVERDN}
    1423isSynchronized: FALSE
    1524vendorName: Samba Team (http://samba.org)
    1625supportedCapabilities: 1.2.840.113556.1.4.800
     26supportedCapabilities: 1.2.840.113556.1.4.1670
    1727supportedCapabilities: 1.2.840.113556.1.4.1791
    18 supportedCapabilities: 1.2.840.113556.1.4.1670
     28supportedCapabilities: 1.2.840.113556.1.4.1935
     29supportedCapabilities: 1.2.840.113556.1.4.2080

  • vendor/current/source4/setup/provision_schema_basedn.ldif

    r414 r740  
    55objectClass: top
    66objectClass: dMD
    7 cn: Schema
     7msDS-NcType: 0
    88nTSecurityDescriptor:: ${DESCRIPTOR}
     9instanceType: 13

  • vendor/current/source4/setup/provision_schema_basedn_modify.ldif

    r414 r740  
    77# "masteredBy", "msDs-masteredBy" filled in later
    88replace: objectVersion
    9 objectVersion: 30
     9objectVersion: 47
    1010

  • vendor/current/source4/setup/provision_self_join.ldif

    r414 r740  
    1010accountExpires: 9223372036854775807
    1111dNSHostName: ${DNSNAME}
    12 # "frsComputerReferenceBL" doesn't exist since we still miss FRS support
    13 isCriticalSystemObject: TRUE
     12# "MSDFSR-ComputerReferenceBL" doesn't exist since we still miss DFSR support
     13# "isCritcalSystemObject" is now filled in by the samldb LDB module
    1414localPolicyFlags: 0
    1515operatingSystem: Samba
    1616operatingSystemVersion: ${SAMBA_VERSION_STRING}
    17 primaryGroupID: 516
    18 # "rIDSetReferences" doesn't exist since we still miss distributed RIDs
    1917sAMAccountName: ${NETBIOSNAME}$
    20 # "servicePrincipalName" for FRS doesn't exit since we still miss FRS support
    21 # "servicePrincipalName"s for DNS ("ldap/../ForestDnsZones",
    22 # "ldap/../DomainDnsZones", "DNS/..") don't exist since we don't support AD DNS
    23 servicePrincipalName: GC/${DNSNAME}/${REALM}
    24 servicePrincipalName: HOST/${DNSNAME}/${DOMAIN}
    25 servicePrincipalName: HOST/${NETBIOSNAME}
    26 servicePrincipalName: HOST/${DNSNAME}
    27 servicePrincipalName: HOST/${DNSNAME}/${REALM}
    28 # "servicePrincipalName"s with GUIDs are located in
    29 # "provision_self_join_modify.ldif"
    30 servicePrincipalName: ldap/${DNSNAME}/${DOMAIN}
    31 servicePrincipalName: ldap/${NETBIOSNAME}
    32 servicePrincipalName: ldap/${DNSNAME}
    33 servicePrincipalName: ldap/${DNSNAME}/${REALM}
     18# The "servicePrincipalName" updates are now handled by the "samba_spnupdate"
     19# script
    3420userAccountControl: 532480
    35 userPassword:: ${MACHINEPASS_B64}
     21clearTextPassword:: ${MACHINEPASS_B64}
     22objectSid: ${DOMAINSID}-${DCRID}
    3623
    37 # Here are missing the objects for the NTFRS subscription and the RID set since
    38 # we don't support those techniques (FRS, distributed RIDs) yet.
     24# Here are missing the objects for the NTFRS subscription since we don't
     25# support this technique yet.
    3926
    4027# Objects under "Configuration/Sites/<Default sitename>/Servers"
    … …  
    6855options: 1
    6956systemFlags: 33554432
    70 
    71 # Provides an account for DNS keytab export
    72 dn: CN=dns,CN=Users,${DOMAINDN}
    73 objectClass: top
    74 objectClass: person
    75 objectClass: organizationalPerson
    76 objectClass: user
    77 description: DNS Service Account
    78 userAccountControl: 514
    79 accountExpires: 9223372036854775807
    80 sAMAccountName: dns
    81 servicePrincipalName: DNS/${DNSDOMAIN}
    82 userPassword:: ${DNSPASS_B64}
    83 isCriticalSystemObject: TRUE
     57${NTDSGUID}

  • vendor/current/source4/setup/provision_self_join_modify.ldif

    r414 r740  
    2929interSiteTopologyGenerator: CN=NTDS Settings,${SERVERDN}
    3030
     31dn: CN=RID Set,CN=${NETBIOSNAME},OU=Domain Controllers,${DOMAINDN}
     32changetype: add
     33objectClass: rIDSet
     34rIDAllocationPool: ${RIDALLOCATIONSTART}-${RIDALLOCATIONEND}
     35rIDPreviousAllocationPool: ${RIDALLOCATIONSTART}-${RIDALLOCATIONEND}
     36rIDUsedPool: 0
     37rIDNextRID: ${RIDALLOCATIONSTART}
     38
    3139dn: CN=${NETBIOSNAME},OU=Domain Controllers,${DOMAINDN}
    3240changetype: modify
    33 add: servicePrincipalName
    34 servicePrincipalName: E3514235-4B06-11D1-AB04-00C04FC2DCD2/${NTDSGUID}/${DNSDOMAIN}
    35 servicePrincipalName: ldap/${NTDSGUID}._msdcs.${DNSDOMAIN}
     41add: rIDSetReferences
     42rIDSetReferences: CN=RID Set,CN=${NETBIOSNAME},OU=Domain Controllers,${DOMAINDN}

  • vendor/current/source4/setup/provision_users.ldif

    r414 r740  
    1 # Add default primary groups (domain users, domain guests) - needed for
    2 # the users to find valid primary groups (samldb module)
     1# Add default primary groups (domain users, domain guests, domain computers &
     2# domain controllers) - needed for the users to find valid primary groups
     3# (samldb module)
    34
    45dn: CN=Domain Users,CN=Users,${DOMAINDN}
    … …  
    1819isCriticalSystemObject: TRUE
    1920
     21dn: CN=Domain Computers,CN=Users,${DOMAINDN}
     22objectClass: top
     23objectClass: group
     24description: All workstations and servers joined to the domain
     25objectSid: ${DOMAINSID}-515
     26sAMAccountName: Domain Computers
     27isCriticalSystemObject: TRUE
     28
     29dn: CN=Domain Controllers,CN=Users,${DOMAINDN}
     30objectClass: top
     31objectClass: group
     32description: All domain controllers in the domain
     33objectSid: ${DOMAINSID}-516
     34adminCount: 1
     35sAMAccountName: Domain Controllers
     36isCriticalSystemObject: TRUE
     37
    2038# Add users
    2139
    … …  
    2341objectClass: user
    2442description: Built-in account for administering the computer/domain
    25 userAccountControl: 66048
     43userAccountControl: 512
    2644objectSid: ${DOMAINSID}-500
    2745adminCount: 1
    2846accountExpires: 9223372036854775807
    2947sAMAccountName: Administrator
    30 userPassword:: ${ADMINPASS_B64}
     48clearTextPassword:: ${ADMINPASS_B64}
    3149isCriticalSystemObject: TRUE
    3250
    … …  
    5371sAMAccountName: krbtgt
    5472servicePrincipalName: kadmin/changepw
    55 userPassword:: ${KRBTGTPASS_B64}
     73clearTextPassword:: ${KRBTGTPASS_B64}
    5674isCriticalSystemObject: TRUE
    5775
    5876# Add other groups
     77
     78dn: CN=Enterprise Read-only Domain Controllers,CN=Users,${DOMAINDN}
     79objectClass: top
     80objectClass: group
     81description: Members of this group are Read-Only Domain Controllers in the enterprise
     82objectSid: ${DOMAINSID}-498
     83sAMAccountName: Enterprise Read-Only Domain Controllers
     84groupType: -2147483640
     85isCriticalSystemObject: TRUE
     86
     87dn: CN=Domain Admins,CN=Users,${DOMAINDN}
     88objectClass: top
     89objectClass: group
     90description: Designated administrators of the domain
     91member: CN=Administrator,CN=Users,${DOMAINDN}
     92objectSid: ${DOMAINSID}-512
     93adminCount: 1
     94sAMAccountName: Domain Admins
     95isCriticalSystemObject: TRUE
     96
     97dn: CN=Cert Publishers,CN=Users,${DOMAINDN}
     98objectClass: top
     99objectClass: group
     100description: Members of this group are permitted to publish certificates to the directory
     101objectSid: ${DOMAINSID}-517
     102sAMAccountName: Cert Publishers
     103groupType: -2147483644
     104isCriticalSystemObject: TRUE
     105
     106dn: CN=Schema Admins,CN=Users,${DOMAINDN}
     107objectClass: top
     108objectClass: group
     109description: Designated administrators of the schema
     110member: CN=Administrator,CN=Users,${DOMAINDN}
     111objectSid: ${DOMAINSID}-518
     112adminCount: 1
     113sAMAccountName: Schema Admins
     114groupType: -2147483640
     115isCriticalSystemObject: TRUE
    59116
    60117dn: CN=Enterprise Admins,CN=Users,${DOMAINDN}
    … …  
    66123adminCount: 1
    67124sAMAccountName: Enterprise Admins
    68 isCriticalSystemObject: TRUE
    69 
    70 dn: CN=Domain Computers,CN=Users,${DOMAINDN}
    71 objectClass: top
    72 objectClass: group
    73 description: All workstations and servers joined to the domain
    74 objectSid: ${DOMAINSID}-515
    75 sAMAccountName: Domain Computers
    76 isCriticalSystemObject: TRUE
    77 
    78 dn: CN=Domain Controllers,CN=Users,${DOMAINDN}
    79 objectClass: top
    80 objectClass: group
    81 description: All domain controllers in the domain
    82 objectSid: ${DOMAINSID}-516
    83 adminCount: 1
    84 sAMAccountName: Domain Controllers
    85 isCriticalSystemObject: TRUE
    86 
    87 dn: CN=Schema Admins,CN=Users,${DOMAINDN}
    88 objectClass: top
    89 objectClass: group
    90 description: Designated administrators of the schema
    91 member: CN=Administrator,CN=Users,${DOMAINDN}
    92 objectSid: ${DOMAINSID}-518
    93 adminCount: 1
    94 sAMAccountName: Schema Admins
    95 isCriticalSystemObject: TRUE
    96 
    97 dn: CN=Cert Publishers,CN=Users,${DOMAINDN}
    98 objectClass: top
    99 objectClass: group
    100 description: Members of this group are permitted to publish certificates to the Active Directory
    101 groupType: -2147483644
    102 objectSid: ${DOMAINSID}-517
    103 sAMAccountName: Cert Publishers
    104 isCriticalSystemObject: TRUE
    105 
    106 dn: CN=Domain Admins,CN=Users,${DOMAINDN}
    107 objectClass: top
    108 objectClass: group
    109 description: Designated administrators of the domain
    110 member: CN=Administrator,CN=Users,${DOMAINDN}
    111 objectSid: ${DOMAINSID}-512
    112 adminCount: 1
    113 sAMAccountName: Domain Admins
     125groupType: -2147483640
    114126isCriticalSystemObject: TRUE
    115127
    … …  
    123135isCriticalSystemObject: TRUE
    124136
     137dn: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
     138objectClass: top
     139objectClass: group
     140description: Members of this group are Read-Only Domain Controllers in the domain
     141objectSid: ${DOMAINSID}-521
     142adminCount: 1
     143sAMAccountName: Read-Only Domain Controllers
     144isCriticalSystemObject: TRUE
     145
    125146dn: CN=RAS and IAS Servers,CN=Users,${DOMAINDN}
    126147objectClass: top
    … …  
    132153isCriticalSystemObject: TRUE
    133154
    134 dn: CN=Read-Only Domain Controllers,CN=Users,${DOMAINDN}
    135 objectClass: top
    136 objectClass: group
    137 description: read-only domain controllers
    138 objectSid: ${DOMAINSID}-521
    139 sAMAccountName: Read-Only Domain Controllers
     155dn: CN=Allowed RODC Password Replication Group,CN=Users,${DOMAINDN}
     156objectClass: top
     157objectClass: group
     158description: Members in this group can have their passwords replicated to all read-only domain controllers in the domain
     159objectSid: ${DOMAINSID}-571
     160sAMAccountName: Allowed RODC Password Replication Group
    140161groupType: -2147483644
    141162isCriticalSystemObject: TRUE
    142163
    143 dn: CN=Enterprise Read-Only Domain Controllers,CN=Users,${DOMAINDN}
    144 objectClass: top
    145 objectClass: group
    146 description: enterprise read-only domain controllers
    147 objectSid: ${DOMAINSID}-498
    148 sAMAccountName: Enterprise Read-Only Domain Controllers
     164dn: CN=Denied RODC Password Replication Group,CN=Users,${DOMAINDN}
     165objectClass: top
     166objectClass: group
     167description: Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain
     168member: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
     169member: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
     170member: CN=Domain Admins,CN=Users,${DOMAINDN}
     171member: CN=Cert Publishers,CN=Users,${DOMAINDN}
     172member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
     173member: CN=Schema Admins,CN=Users,${DOMAINDN}
     174member: CN=Domain Controllers,CN=Users,${DOMAINDN}
     175member: CN=krbtgt,CN=Users,${DOMAINDN}
     176objectSid: ${DOMAINSID}-572
     177sAMAccountName: Denied RODC Password Replication Group
    149178groupType: -2147483644
    150179isCriticalSystemObject: TRUE
    151180
    152 dn: CN=Certificate Service DCOM Access,CN=Users,${DOMAINDN}
    153 objectClass: top
    154 objectClass: group
    155 description: Certificate Service DCOM Access
    156 objectSid: ${DOMAINSID}-574
    157 sAMAccountName: Certificate Service DCOM Access
    158 groupType: -2147483644
    159 isCriticalSystemObject: TRUE
    160 
    161 dn: CN=Cryptographic Operators,CN=Users,${DOMAINDN}
    162 objectClass: top
    163 objectClass: group
    164 description: Cryptographic Operators
    165 objectSid: ${DOMAINSID}-569
    166 sAMAccountName: Cryptographic Operators
    167 groupType: -2147483644
    168 isCriticalSystemObject: TRUE
    169 
    170 dn: CN=Event Log Readers,CN=Users,${DOMAINDN}
    171 objectClass: top
    172 objectClass: group
    173 description: Event Log Readers
    174 objectSid: ${DOMAINSID}-573
    175 sAMAccountName: Event Log Readers
    176 groupType: -2147483644
    177 isCriticalSystemObject: TRUE
     181# NOTICE: Some other users and groups which rely on automatic SIDs are located
     182# in "provision_self_join_modify.ldif"
    178183
    179184# Add foreign security principals
    … …  
    194199objectSid: S-1-5-11
    195200
    196 dn: CN=S-1-5-20,CN=ForeignSecurityPrincipals,${DOMAINDN}
    197 objectClass: top
    198 objectClass: foreignSecurityPrincipal
    199 objectSid: S-1-5-20
     201dn: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
     202objectClass: top
     203objectClass: foreignSecurityPrincipal
     204objectSid: S-1-5-17
    200205
    201206# Add builtin objects
    … …  
    213218systemFlags: -1946157056
    214219groupType: -2147483643
    215 privilege: SeSecurityPrivilege
    216 privilege: SeBackupPrivilege
    217 privilege: SeRestorePrivilege
    218 privilege: SeSystemtimePrivilege
    219 privilege: SeShutdownPrivilege
    220 privilege: SeRemoteShutdownPrivilege
    221 privilege: SeTakeOwnershipPrivilege
    222 privilege: SeDebugPrivilege
    223 privilege: SeSystemEnvironmentPrivilege
    224 privilege: SeSystemProfilePrivilege
    225 privilege: SeProfileSingleProcessPrivilege
    226 privilege: SeIncreaseBasePriorityPrivilege
    227 privilege: SeLoadDriverPrivilege
    228 privilege: SeCreatePagefilePrivilege
    229 privilege: SeIncreaseQuotaPrivilege
    230 privilege: SeChangeNotifyPrivilege
    231 privilege: SeUndockPrivilege
    232 privilege: SeManageVolumePrivilege
    233 privilege: SeImpersonatePrivilege
    234 privilege: SeCreateGlobalPrivilege
    235 privilege: SeEnableDelegationPrivilege
    236 privilege: SeInteractiveLogonRight
    237 privilege: SeNetworkLogonRight
    238 privilege: SeRemoteInteractiveLogonRight
    239220isCriticalSystemObject: TRUE
    240221
    … …  
    242223objectClass: top
    243224objectClass: group
    244 description: Users are prevented from making accidental or intentional system-wide changes.  Thus, Users can run certified applications, but not most legacy applications
     225description: Users are prevented from making accidental or intentional system-wide changes and can run most applications
    245226member: CN=Domain Users,CN=Users,${DOMAINDN}
    246227member: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
    … …  
    264245isCriticalSystemObject: TRUE
    265246
     247dn: CN=Account Operators,CN=Builtin,${DOMAINDN}
     248objectClass: top
     249objectClass: group
     250description: Members can administer domain user and group accounts
     251objectSid: S-1-5-32-548
     252adminCount: 1
     253sAMAccountName: Account Operators
     254systemFlags: -1946157056
     255groupType: -2147483643
     256isCriticalSystemObject: TRUE
     257
     258dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
     259objectClass: top
     260objectClass: group
     261description: Members can administer domain servers
     262objectSid: S-1-5-32-549
     263adminCount: 1
     264sAMAccountName: Server Operators
     265systemFlags: -1946157056
     266groupType: -2147483643
     267isCriticalSystemObject: TRUE
     268
    266269dn: CN=Print Operators,CN=Builtin,${DOMAINDN}
    267270objectClass: top
    … …  
    273276systemFlags: -1946157056
    274277groupType: -2147483643
    275 privilege: SeLoadDriverPrivilege
    276 privilege: SeShutdownPrivilege
    277 privilege: SeInteractiveLogonRight
    278278isCriticalSystemObject: TRUE
    279279
    … …  
    287287systemFlags: -1946157056
    288288groupType: -2147483643
    289 privilege: SeBackupPrivilege
    290 privilege: SeRestorePrivilege
    291 privilege: SeShutdownPrivilege
    292 privilege: SeInteractiveLogonRight
    293289isCriticalSystemObject: TRUE
    294290
    … …  
    302298systemFlags: -1946157056
    303299groupType: -2147483643
    304 isCriticalSystemObject: TRUE
    305 
    306 dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
    307 objectClass: top
    308 objectClass: group
    309 description: Members in this group are granted the right to logon remotely
    310 objectSid: S-1-5-32-555
    311 sAMAccountName: Remote Desktop Users
    312 systemFlags: -1946157056
    313 groupType: -2147483643
    314 isCriticalSystemObject: TRUE
    315 
    316 dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
    317 objectClass: top
    318 objectClass: group
    319 description: Members in this group can have some administrative privileges to manage configuration of networking features
    320 objectSid: S-1-5-32-556
    321 sAMAccountName: Network Configuration Operators
    322 systemFlags: -1946157056
    323 groupType: -2147483643
    324 isCriticalSystemObject: TRUE
    325 
    326 dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
    327 objectClass: top
    328 objectClass: group
    329 description: Members of this group have remote access to monitor this computer
    330 objectSid: S-1-5-32-558
    331 sAMAccountName: Performance Monitor Users
    332 systemFlags: -1946157056
    333 groupType: -2147483643
    334 isCriticalSystemObject: TRUE
    335 
    336 dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
    337 objectClass: top
    338 objectClass: group
    339 description: Members of this group have remote access to schedule logging of performance counters on this computer
    340 member: CN=S-1-5-20,CN=ForeignSecurityPrincipals,${DOMAINDN}
    341 objectSid: S-1-5-32-559
    342 sAMAccountName: Performance Log Users
    343 systemFlags: -1946157056
    344 groupType: -2147483643
    345 isCriticalSystemObject: TRUE
    346 
    347 dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
    348 objectClass: top
    349 objectClass: group
    350 description: Members can administer domain servers
    351 objectSid: S-1-5-32-549
    352 adminCount: 1
    353 sAMAccountName: Server Operators
    354 systemFlags: -1946157056
    355 groupType: -2147483643
    356 privilege: SeBackupPrivilege
    357 privilege: SeSystemtimePrivilege
    358 privilege: SeRemoteShutdownPrivilege
    359 privilege: SeRestorePrivilege
    360 privilege: SeShutdownPrivilege
    361 privilege: SeInteractiveLogonRight
    362 isCriticalSystemObject: TRUE
    363 
    364 dn: CN=Account Operators,CN=Builtin,${DOMAINDN}
    365 objectClass: top
    366 objectClass: group
    367 description: Members can administer domain user and group accounts
    368 objectSid: S-1-5-32-548
    369 adminCount: 1
    370 sAMAccountName: Account Operators
    371 systemFlags: -1946157056
    372 groupType: -2147483643
    373 privilege: SeInteractiveLogonRight
    374300isCriticalSystemObject: TRUE
    375301
    … …  
    383309systemFlags: -1946157056
    384310groupType: -2147483643
    385 privilege: SeRemoteInteractiveLogonRight
    386 privilege: SeChangeNotifyPrivilege
     311isCriticalSystemObject: TRUE
     312
     313dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
     314objectClass: top
     315objectClass: group
     316description: Members in this group are granted the right to logon remotely
     317objectSid: S-1-5-32-555
     318sAMAccountName: Remote Desktop Users
     319systemFlags: -1946157056
     320groupType: -2147483643
     321isCriticalSystemObject: TRUE
     322
     323dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
     324objectClass: top
     325objectClass: group
     326description: Members in this group can have some administrative privileges to manage configuration of networking features
     327objectSid: S-1-5-32-556
     328sAMAccountName: Network Configuration Operators
     329systemFlags: -1946157056
     330groupType: -2147483643
    387331isCriticalSystemObject: TRUE
    388332
    … …  
    393337objectSid: S-1-5-32-557
    394338sAMAccountName: Incoming Forest Trust Builders
     339systemFlags: -1946157056
     340groupType: -2147483643
     341isCriticalSystemObject: TRUE
     342
     343dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
     344objectClass: top
     345objectClass: group
     346description: Members of this group can access performance counter data locally and remotely
     347objectSid: S-1-5-32-558
     348sAMAccountName: Performance Monitor Users
     349systemFlags: -1946157056
     350groupType: -2147483643
     351isCriticalSystemObject: TRUE
     352
     353dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
     354objectClass: top
     355objectClass: group
     356description: Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer
     357objectSid: S-1-5-32-559
     358sAMAccountName: Performance Log Users
    395359systemFlags: -1946157056
    396360groupType: -2147483643
    … …  
    411375objectClass: top
    412376objectClass: group
    413 description: Terminal Server License Servers
     377description: Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage
    414378objectSid: S-1-5-32-561
    415379sAMAccountName: Terminal Server License Servers
    … …  
    428392isCriticalSystemObject: TRUE
    429393
     394dn: CN=IIS_IUSRS,CN=Builtin,${DOMAINDN}
     395objectClass: top
     396objectClass: group
     397description: Built-in group used by Internet Information Services.
     398member: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
     399objectSid: S-1-5-32-568
     400sAMAccountName: IIS_IUSRS
     401systemFlags: -1946157056
     402groupType: -2147483643
     403isCriticalSystemObject: TRUE
     404
     405dn: CN=Cryptographic Operators,CN=Builtin,${DOMAINDN}
     406objectClass: top
     407objectClass: group
     408description: Members are authorized to perform cryptographic operations.
     409objectSid: S-1-5-32-569
     410sAMAccountName: Cryptographic Operators
     411systemFlags: -1946157056
     412groupType: -2147483643
     413isCriticalSystemObject: TRUE
     414
     415dn: CN=Event Log Readers,CN=Builtin,${DOMAINDN}
     416objectClass: top
     417objectClass: group
     418description: Members of this group can read event logs from local machine
     419objectSid: S-1-5-32-573
     420sAMAccountName: Event Log Readers
     421systemFlags: -1946157056
     422groupType: -2147483643
     423isCriticalSystemObject: TRUE
     424
     425dn: CN=Certificate Service DCOM Access,CN=Builtin,${DOMAINDN}
     426objectClass: top
     427objectClass: group
     428description: Members of this group are allowed to connect to Certification Authorities in the enterprise
     429objectSid: S-1-5-32-574
     430sAMAccountName: Certificate Service DCOM Access
     431systemFlags: -1946157056
     432groupType: -2147483643
     433isCriticalSystemObject: TRUE
     434
    430435# Add well known security principals
    431436
    … …  
    485490objectSid: S-1-5-4
    486491
     492dn: CN=IUSR,CN=WellKnown Security Principals,${CONFIGDN}
     493objectClass: top
     494objectClass: foreignSecurityPrincipal
     495objectSid: S-1-5-17
     496
    487497dn: CN=Local Service,CN=WellKnown Security Principals,${CONFIGDN}
    488498objectClass: top
    … …  
    510520objectSid: S-1-5-1000
    511521
     522dn: CN=Owner Rights,CN=WellKnown Security Principals,${CONFIGDN}
     523objectClass: top
     524objectClass: foreignSecurityPrincipal
     525objectSid: S-1-3-4
     526
    512527dn: CN=Proxy,CN=WellKnown Security Principals,${CONFIGDN}
    513528objectClass: top
    … …  
    540555objectSid: S-1-5-6
    541556
     557dn: CN=System,CN=WellKnown Security Principals,${CONFIGDN}
     558objectClass: top
     559objectClass: foreignSecurityPrincipal
     560objectSid: S-1-5-18
     561
    542562dn: CN=Terminal Server User,CN=WellKnown Security Principals,${CONFIGDN}
    543563objectClass: top
    … …  
    549569objectClass: foreignSecurityPrincipal
    550570objectSid: S-1-5-15
    551 
    552 dn: CN=Well-Known-Security-Id-System,CN=WellKnown Security Principals,${CONFIGDN}
    553 objectClass: top
    554 objectClass: foreignSecurityPrincipal
    555 objectSid: S-1-5-18

  • vendor/current/source4/setup/schema-map-fedora-ds-1.0

    r414 r740  
    1 #Standard OpenLDAP attributes
     1#Standard Fedora DS attributes
    22name
    33objectClasses
    … …  
    1313dITContentRules
    1414top
     15
    1516#This should be provided by the LDAP server, only in our schema to permit provision
    1617aci
     18
    1719#Skip ObjectClasses
     20sambaSamAccount
     21sambaGroupMapping
     22sambaTrustPassword
     23sambaTrustedDomainPassword
     24sambaDomain
     25sambaUnixIdPool
     26sambaIdmapEntry
     27sambaSidEntry
     28sambaConfig
     29sambaShare
     30sambaConfigOption
     31
    1832#MiddleName has a conflicting OID
    19332.16.840.1.113730.3.1.34:1.3.6.1.4.1.7165.4.255.1
    2034#defaultGroup has a conflicting OID
    21351.2.840.113556.1.4.480:1.3.6.1.4.1.7165.4.255.2
     36#thumbnailPhoto has a conflicting OID
     372.16.840.1.113730.3.1.35:1.3.6.1.4.1.7165.4.255.10
     38#thumbnailLogo has a conflicting OID
     392.16.840.1.113730.3.1.36:1.3.6.1.4.1.7165.4.255.11
     40
    2241#This large integer format is unimplemented in OpenLDAP 2.3
    23421.2.840.113556.1.4.906:1.3.6.1.4.1.1466.115.121.1.27
    2443#This case insensitive string isn't available
    25 1.2.840.113556.1.4.905:1.3.6.1.4.1.1466.115.121.1.15
     441.2.840.113556.1.4.905:1.3.6.1.4.1.1466.115.121.1.44
    2645#Treat Security Descriptors as binary
    27461.2.840.113556.1.4.907:1.3.6.1.4.1.1466.115.121.1.40
    28 #NumbericString is not supported in Fedora DS 1.0, map to a directory string
    29 1.3.6.1.4.1.1466.115.121.1.36:1.3.6.1.4.1.1466.115.121.1.15
    3047#Treat Object(DN-Binary) as a binary blob
    31481.2.840.113556.1.4.903:1.3.6.1.4.1.1466.115.121.1.40
    32 #Printable String as IA5 String
    33 1.3.6.1.4.1.1466.115.121.1.44:1.3.6.1.4.1.1466.115.121.1.26
    3449#UTC Time as Generalized Time
    35501.3.6.1.4.1.1466.115.121.1.53:1.3.6.1.4.1.1466.115.121.1.24
    3651#DN with String as Directory String
    37 1.2.840.113556.1.4.904:1.3.6.1.4.1.1466.115.121.1.15
     521.2.840.113556.1.4.904:1.3.6.1.4.1.1466.115.121.1.40
     53#attribute names, declared at OIDs fail
     541.3.6.1.4.1.1466.115.121.1.38:1.3.6.1.4.1.1466.115.121.1.44
    3855#Presentation Address as Directory String
    39561.3.6.1.4.1.1466.115.121.1.43:1.3.6.1.4.1.1466.115.121.1.15
     57
     58#Remap into existing schema
     59pwdLastSet
     60pwdLastSet:sambaPwdLastSet
     61lastLogon
     62lastLogon:sambaLogonTime
     63lastLogoff
     64lastLogoff:sambaLogoffTime
     65badPwdCount
     66badPwdCount:sambaBadPasswordCount
     67logonHours
     68logonHours:sambaLogonHours
     69homeDrive
     70homeDrive:sambaHomeDrive
     71scriptPath
     72scriptPath:sambaLogonScript
     73profilePath
     74profilePath:sambaProfilePath
     75userWorkstations
     76userWorkstations:sambaUserWorkstations
     77homeDirectory
     78homeDirectory:sambaHomePath
     79groupType
     80groupType:sambaGroupType
     81nextRid
     82nextRid:sambaNextRid
     83privilegeDisplayName
     84privilegeDisplayName:sambaPrivName
     85objectSid
     86objectSid:sambaSID

  • vendor/current/source4/setup/schema-map-openldap-2.3

    r414 r740  
    1616#The memberOf plugin provides this attribute
    1717memberOf
     18#'name' is the RDN in AD, but 'name' means something else in
     19#OpenLDAP.  We use rdnValue for the mapping, but this is provided by
     20#the rdnval overlay.
     21name
    1822#These conflict with OpenLDAP builtins
    1923attributeTypes:samba4AttributeTypes
    … …  
    2529subSchema:samba4SubSchema
    26302.5.20.1:1.3.6.1.4.1.7165.4.255.4
    27 #'name' is the RDN in AD, but something else in OpenLDAP
    28 name:samba4RDN
    2931#Remap these so that we don't put operational attributes in a schema MAY
    3032modifyTimeStamp:samba4ModifyTimestamp

  • vendor/current/source4/setup/schema_samba4.ldif

    r414 r740  
    122122#oMSyntax: 20
    123123
    124 dn: cn=privilege,${SCHEMADN}
    125 objectClass: top
    126 objectClass: attributeSchema
    127 cn: privilege
    128 lDAPDisplayName: privilege
    129 isSingleValued: FALSE
    130 systemFlags: 17
    131 systemOnly: TRUE
    132 schemaIDGUID: 7429BC94-CC6A-4481-8B2C-A97E316EB182
    133 adminDisplayName: Privilege
    134 attributeID: 1.3.6.1.4.1.7165.4.1.7
    135 attributeSyntax: 2.5.5.4
    136 oMSyntax: 20
     124# not used anymore
     125#dn: cn=privilege,${SCHEMADN}
     126#objectClass: top
     127#objectClass: attributeSchema
     128#cn: privilege
     129#lDAPDisplayName: privilege
     130#isSingleValued: FALSE
     131#systemFlags: 17
     132#systemOnly: TRUE
     133#schemaIDGUID: 7429BC94-CC6A-4481-8B2C-A97E316EB182
     134#adminDisplayName: Privilege
     135#attributeID: 1.3.6.1.4.1.7165.4.1.7
     136#attributeSyntax: 2.5.5.4
     137#oMSyntax: 20
    137138
    138139#
    … …  
    172173#oMSyntax: 4
    173174
     175# Controls 1.3.6.1.4.1.7165.4.3.x
    174176#Allocated: (not used anymore) DSDB_CONTROL_REPLICATED_OBJECT_OID 1.3.6.1.4.1.7165.4.3.1
    175 
    176177#Allocated: DSDB_CONTROL_CURRENT_PARTITION_OID 1.3.6.1.4.1.7165.4.3.2
    177 
    178178#Allocated: DSDB_CONTROL_REPLICATED_UPDATE_OID 1.3.6.1.4.1.7165.4.3.3
    179 
     179#Allocated: DSDB_CONTROL_DN_STORAGE_FORMAT_OID 1.3.6.1.4.1.7165.4.3.4
     180#Allocated: LDB_CONTROL_RECALCULATE_SD_OID 1.3.6.1.4.1.7165.4.3.5
     181#Allocated: LDB_CONTROL_REVEAL_INTERNALS 1.3.6.1.4.1.7165.4.3.6
     182#Allocated: LDB_CONTROL_AS_SYSTEM_OID 1.3.6.1.4.1.7165.4.3.7
     183#Allocated: DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID 1.3.6.1.4.1.7165.4.3.8
     184#Allocated: DSDB_CONTROL_PASSWORD_HASH_VALUES_OID 1.3.6.1.4.1.7165.4.3.9
     185#Allocated: DSDB_CONTROL_PASSWORD_CHANGE_OID 1.3.6.1.4.1.7165.4.3.10
     186#Allocated: DSDB_CONTROL_APPLY_LINKS 1.3.6.1.4.1.7165.4.3.11
     187#Allocated: DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID 1.3.6.1.4.1.7165.4.3.12
     188#Allocated: LDB_CONTROL_BYPASS_OPERATIONAL_OID 1.3.6.1.4.1.7165.4.3.13
     189#Allocated: DSDB_CONTROL_CHANGEREPLMETADATA_OID 1.3.6.1.4.1.7165.4.3.14
     190#Allocated: (not used anymore) DSDB_CONTROL_SEARCH_APPLY_ACCESS 1.3.6.1.4.1.7165.4.3.15
     191#Allocated: LDB_CONTROL_PROVISION_OID 1.3.6.1.4.1.7165.4.3.16
     192
     193# Extended 1.3.6.1.4.1.7165.4.4.x
    180194#Allocated: DSDB_EXTENDED_REPLICATED_OBJECTS_OID 1.3.6.1.4.1.7165.4.4.1
    181195#Allocated: DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID 1.3.6.1.4.1.7165.4.4.2
    182196#Allocated: LDB_EXTENDED_SEQUENCE_NUMBER 1.3.6.1.4.1.7165.4.4.3
     197#Allocated: DSDB_EXTENDED_CREATE_PARTITION_OID 1.3.6.1.4.1.7165.4.4.4
     198#Allocated: DSDB_EXTENDED_ALLOCATE_RID_POOL 1.3.6.1.4.1.7165.4.4.5
    183199
    184200#Allocated: (middleName) attributeID: 1.3.6.1.4.1.7165.4.255.1
    … …  
    194210#Allocated: (entryTTL) samba4EntryTTL: 1.3.6.1.4.1.7165.4.255.9
    195211
     212#Allocated: (thumbnailPhoto) attributeID: 1.3.6.1.4.1.7165.4.255.10
     213#Allocated: (thumbnailLogo) attributeID: 1.3.6.1.4.1.7165.4.255.11
     214
    196215#
    197216# Based on domainDNS, but without the DNS bits.
    198217#
    199218
    200 dn: CN=Samba4-Local-Domain,${SCHEMADN}
    201 objectClass: top
    202 objectClass: classSchema
    203 cn: Samba4-Local-Domain
    204 subClassOf: top
    205 governsID: 1.3.6.1.4.1.7165.4.2.2
    206 rDNAttID: cn
    207 adminDisplayName: Samba4-Local-Domain
    208 adminDescription: Samba4-Local-Domain
    209 systemMayContain: msDS-Behavior-Version
    210 systemMayContain: managedBy
    211 objectClassCategory: 1
    212 lDAPDisplayName: samba4LocalDomain
    213 schemaIDGUID: 07be1647-8310-4fba-91ae-34e55d5a8293
    214 systemOnly: FALSE
    215 systemAuxiliaryClass: samDomain
    216 defaultSecurityDescriptor: D:(A;;RPLCLORC;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
    217 systemFlags: 16
    218 defaultHidingValue: TRUE
    219 defaultObjectCategory: CN=Samba4-Local-Domain,${SCHEMADN}
     219#
     220# Not used anymore
     221#
     222#dn: CN=Samba4-Local-Domain,${SCHEMADN}
     223#objectClass: top
     224#objectClass: classSchema
     225#cn: Samba4-Local-Domain
     226#subClassOf: top
     227#governsID: 1.3.6.1.4.1.7165.4.2.2
     228#rDNAttID: cn
     229#adminDisplayName: Samba4-Local-Domain
     230#adminDescription: Samba4-Local-Domain
     231#systemMayContain: msDS-Behavior-Version
     232#systemMayContain: managedBy
     233#objectClassCategory: 1
     234#lDAPDisplayName: samba4LocalDomain
     235#schemaIDGUID: 07be1647-8310-4fba-91ae-34e55d5a8293
     236#systemOnly: FALSE
     237#systemAuxiliaryClass: samDomain
     238#defaultSecurityDescriptor: D:(A;;RPLCLORC;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
     239#systemFlags: 16
     240#defaultHidingValue: TRUE
     241#defaultObjectCategory: CN=Samba4-Local-Domain,${SCHEMADN}
    220242
    221243
    … …  
    269291systemMayContain: msDS-ReplValueMetaData
    270292systemMayContain: msDS-ReplAttributeMetaData
     293systemMayContain: msDS-NcType
    271294systemMayContain: msDS-NonMembersBL
    272295systemMayContain: msDS-NCReplOutboundNeighbors
    … …  
    314337systemMustContain: nTSecurityDescriptor
    315338systemMustContain: instanceType
    316 systemAuxiliaryClass: samba4TopExtra
    317339defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
    318340systemFlags: 16
    … …  
    321343defaultObjectCategory: CN=Samba4Top,${SCHEMADN}
    322344
    323 
    324 dn: CN=Samba4TopExtra,${SCHEMADN}
    325 objectClass: top
    326 objectClass: classSchema
    327 cn: Samba4TopExtra
    328 subClassOf: top
    329 governsID: 1.3.6.1.4.1.7165.4.2.3
    330 rDNAttID: cn
    331 adminDisplayName: Samba4TopExtra
    332 adminDescription: Attributes used in top in Samba4 that OpenLDAP does not
    333 objectClassCategory: 2
    334 lDAPDisplayName: samba4TopExtra
    335 schemaIDGUID: 073598d0-635b-4685-a929-da731b98d84e
    336 systemOnly: TRUE
    337 mayContain: privilege
    338 systemPossSuperiors: lostAndFound
    339 defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)
    340 systemFlags: 16
    341 defaultHidingValue: TRUE
    342 objectCategory: CN=Class-Schema,${SCHEMADN}
    343 defaultObjectCategory: CN=Samba4TopExtra,${SCHEMADN}
    344 

  • vendor/current/source4/setup/secrets_dns.ldif

    r414 r740  
    11#Update a keytab for the external DNS server to use
    2 dn: servicePrincipalName=DNS/${DNSDOMAIN},CN=Principals
     2dn: samAccountName=dns-${HOSTNAME},CN=Principals
    33objectClass: top
    44objectClass: secret
    … …  
    66realm: ${REALM}
    77servicePrincipalName: DNS/${DNSDOMAIN}
     8servicePrincipalName: DNS/${DNSNAME}
    89msDS-KeyVersionNumber: 1
    910privateKeytab: ${DNS_KEYTAB}
    1011secret:: ${DNSPASS_B64}
    11 
     12samAccountName: dns-${HOSTNAME}

  • vendor/current/source4/setup/secrets_init.ldif

    r414 r740  
    55
    66dn: @ATTRIBUTES
     7cn: CASE_INSENSITIVE
    78realm: CASE_INSENSITIVE
    89flatname: CASE_INSENSITIVE
    … …  
    1213#beware often order is important
    1314dn: @MODULES
    14 @LIST: update_keytab,operational,objectguid,rdn_name
     15@LIST: samba_secrets
    1516

  • vendor/current/source4/setup/slapd.conf

    r414 r740  
    4949rootdn cn=Manager
    5050
     51moduleload rdnval
     52
     53moduleload deref
    5154overlay deref
    5255
     56moduleload refint
    5357${REFINT_CONFIG}
    5458
     59moduleload memberof
    5560${MEMBEROF_CONFIG}
     61
     62moduleload syncprov
    5663
    5764database        ldif
    … …  
    8895syncprov-checkpoint 100 10
    8996
     97overlay rdnval
    9098
    9199### Multimaster-Replication of cn=schema Subcontext ###
    … …  
    108116syncprov-checkpoint 100 10
    109117
     118overlay rdnval
     119
    110120### Multimaster-Replication of cn=config Subcontext ###
    111121${MMR_SYNCREPL_CONFIG_CONFIG}
    … …  
    127137syncprov-checkpoint 100 10
    128138
     139overlay rdnval
     140
    129141### Multimaster-Replication of cn=user/base-dn context ###
    130142${MMR_SYNCREPL_USER_CONFIG}

  • vendor/current/source4/setup/tests/blackbox_newuser.sh

    r414 r740  
    1414
    1515
    16 testit "simple-dc" $PYTHON ./setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc
     16rm -rf $PREFIX/simple-dc
     17testit "simple-dc" $PYTHON $SRCDIR/source4/setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc
     18samba_tool="./bin/samba-tool"
    1719
    1820CONFIG="--configfile=$PREFIX/simple-dc/etc/smb.conf"
    1921
    20 testit "newuser" $PYTHON ./setup/newuser $CONFIG testuser testpass
     22#two test for creating new user
     23#newuser  account is created with cn=Given Name Initials. Surname
     24#newuser1 account is created using cn=username
     25testit "newuser" $samba_tool newuser $CONFIG --given-name="User" --surname="Tester" --initials="T" --profile-path="\\\\myserver\\my\\profile" --script-path="\\\\myserver\\my\\script" --home-directory="\\\\myserver\\my\\homedir" --job-title="Tester" --department="Testing" --company="Samba.org" --description="Description" --mail-address="tester@samba.org" --internet-address="http://samba.org" --telephone-number="001122334455" --physical-delivery-office="101" --home-drive="H:" NewUser testp@ssw0Rd
     26testit "newuser" $samba_tool newuser $CONFIG --use-username-as-cn --given-name="User1" --surname="Tester1" --initials="UT1" --profile-path="\\\\myserver\\my\\profile" --script-path="\\\\myserver\\my\\script" --home-directory="\\\\myserver\\my\\homedir" --job-title="Tester" --department="Testing" --company="Samba.org" --description="Description" --mail-address="tester@samba.org" --internet-address="http://samba.org" --telephone-number="001122334455" --physical-delivery-office="101" --home-drive="H:" NewUser1 testp@ssw0Rd
    2127
    2228# check the enable account script
    23 testit "enableaccount" $PYTHON ./setup/enableaccount $CONFIG testuser
     29testit "enableaccount" $samba_tool enableaccount $CONFIG NewUser
     30testit "enableaccount" $samba_tool enableaccount $CONFIG NewUser1
    2431
    2532# check the enable account script
    26 testit "setpassword" $PYTHON ./setup/setpassword $CONFIG testuser --newpassword=testpass2
     33testit "setpassword" $samba_tool setpassword $CONFIG NewUser --newpassword=testp@ssw0Rd2
     34testit "setpassword" $samba_tool setpassword $CONFIG NewUser1 --newpassword=testp@ssw0Rd2
    2735
    2836# check the setexpiry script
    29 testit "noexpiry" $PYTHON ./setup/setexpiry $CONFIG testuser --noexpiry
    30 testit "expiry" $PYTHON ./setup/setexpiry $CONFIG testuser --days=7
     37testit "noexpiry" $samba_tool setexpiry $CONFIG NewUser --noexpiry
     38testit "noexpiry" $samba_tool setexpiry $CONFIG NewUser1 --noexpiry
     39testit "expiry" $samba_tool setexpiry $CONFIG NewUser --days=7
     40testit "expiry" $samba_tool setexpiry $CONFIG NewUser1 --days=7
    3141
    3242exit $failed

  • vendor/current/source4/setup/tests/blackbox_provision-backend.sh

    r414 r740  
    1313. `dirname $0`/../../../testprogs/blackbox/subunit.sh
    1414
    15 testit "openldap-backend" $PYTHON ./setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-backend --ldap-dryrun-mode --slapd-path=/dev/null
    16 testit "openldap-mmr-backend" $PYTHON ./setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-mmr-backend --ol-mmr-urls='ldap://localdc1:9000,ldap://localdc2:9000,ldap://localdc3:9000' --ldap-dryrun-mode --slapd-path=/dev/null
    17 testit "fedora-ds-backend" $PYTHON ./setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-backend --ldap-dryrun-mode --slapd-path=/dev/null
     15testit "openldap-backend" $PYTHON $SRCDIR/source4/setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-backend --ldap-dryrun-mode --slapd-path=/dev/null
     16testit "openldap-mmr-backend" $PYTHON $SRCDIR/source4/setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-mmr-backend --ol-mmr-urls="ldap://s4dc1.test:9000,ldap://s4dc2.test:9000" --ldap-dryrun-mode --slapd-path=/dev/null --username=samba-admin --password=linux --adminpass=linux --ldapadminpass=linux
     17testit "fedora-ds-backend" $PYTHON $SRCDIR/source4/setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-backend --ldap-dryrun-mode --slapd-path=/dev/null
    1818
    1919reprovision() {
    20         $PYTHON ./setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-backend-reprovision --ldap-dryrun-mode --slapd-path=/dev/null
    21         $PYTHON ./setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-backend-reprovision --ldap-dryrun-mode --slapd-path=/dev/null
     20        $PYTHON $SRCDIR/source4/setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-backend-reprovision --ldap-dryrun-mode --slapd-path=/dev/null
     21        $PYTHON $SRCDIR/source4/setup/provision --domain=FOO --realm=foo.example.com --ldap-backend-type=openldap --targetdir=$PREFIX/openldap-backend-reprovision --ldap-dryrun-mode --slapd-path=/dev/null
    2222}
    2323

  • vendor/current/source4/setup/tests/blackbox_provision.sh

    r414 r740  
    1313. `dirname $0`/../../../testprogs/blackbox/subunit.sh
    1414
    15 testit "simple-default" $PYTHON ./setup/provision --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple-default
    16 testit "simple-dc" $PYTHON ./setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc
    17 testit "simple-member" $PYTHON ./setup/provision --server-role="member" --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple-member
    18 testit "simple-standalone" $PYTHON ./setup/provision --server-role="standalone" --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple-standalone
    19 testit "blank-dc" $PYTHON ./setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/blank-dc --blank
    20 testit "partitions-only-dc" $PYTHON ./setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/partitions-only-dc --partitions-only
     15#Prepare an empty smb.conf to ensure it is overwritten
     16rm -rf $PREFIX/simple-default
     17mkdir -p $PREFIX/simple-default/etc
     18touch $PREFIX/simple-default/etc/smb.conf
     19testit "simple-default" $PYTHON $SRCDIR/source4/setup/provision --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple-default
     20#And try with just whitespace
     21rm -rf $PREFIX/simple-dc
     22mkdir -p $PREFIX/simple-dc/etc
     23echo "  " > $PREFIX/simple-dc/etc/smb.conf
     24testit "simple-dc" $PYTHON $SRCDIR/source4/setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc
     25#The rest of these tests are with no smb.conf file present
     26
     27rm -rf $PREFIX/simple-dc
     28testit "simple-dc-guids" $PYTHON $SRCDIR/source4/setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --domain-guid=6054d36d-2bfd-44f1-a9cd-32cfbb06480b --ntds-guid=b838f255-c8aa-4fe8-9402-b7d61ca3bd1b --invocationid=6d4cff9a-2bbf-4b4c-98a2-36242ddb0bd6 --targetdir=$PREFIX/simple-dc
     29rm -rf $PREFIX/simple-member
     30testit "simple-member" $PYTHON $SRCDIR/source4/setup/provision --server-role="member" --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple-member
     31rm -rf $PREFIX/simple-standalone
     32testit "simple-standalone" $PYTHON $SRCDIR/source4/setup/provision --server-role="standalone" --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple-standalone
     33rm -rf $PREFIX/blank-dc
     34testit "blank-dc" $PYTHON $SRCDIR/source4/setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/blank-dc --blank
     35rm -rf $PREFIX/partitions-only-dc
     36testit "partitions-only-dc" $PYTHON $SRCDIR/source4/setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/partitions-only-dc --partitions-only
    2137
    2238reprovision() {
    23         $PYTHON ./setup/provision --domain=FOO --realm=foo.example.com --targetdir="$PREFIX/reprovision"
    24         $PYTHON ./setup/provision --domain=FOO --realm=foo.example.com --targetdir="$PREFIX/reprovision"
     39        rm -rf $PREFIX/reprovision
     40        $PYTHON $SRCDIR/source4/setup/provision --domain=FOO --realm=foo.example.com --targetdir="$PREFIX/reprovision"
     41        $PYTHON $SRCDIR/source4/setup/provision --domain=FOO --realm=foo.example.com --targetdir="$PREFIX/reprovision"
    2542}
    2643
    2744testit "reprovision" reprovision
     45rm -rf $PREFIX/simple-default
     46rm -rf $PREFIX/simple-dc
     47rm -rf $PREFIX/blank-dc
     48rm -rf $PREFIX/simple-member
     49rm -rf $PREFIX/simple-standalone
     50rm -rf $PREFIX/partitions-only-dc
     51rm -rf $PREFIX/reprovision
    2852
    2953exit $failed

  • vendor/current/source4/setup/tests/blackbox_setpassword.sh

    r414 r740  
    1313. `dirname $0`/../../../testprogs/blackbox/subunit.sh
    1414
    15 testit "simple-dc" $PYTHON ./setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc
     15samba_tool="./bin/samba-tool"
    1616
    17 testit "newuser" $PYTHON ./setup/newuser --configfile=$PREFIX/simple-dc/etc/smb.conf testuser testpass
     17rm -rf $PREFIX/simple-dc
     18testit "simple-dc" $PYTHON $SRCDIR/source4/setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc
    1819
    19 testit "setpassword" $PYTHON ./setup/setpassword --configfile=$PREFIX/simple-dc/etc/smb.conf testuser --newpassword=testpass
     20testit "newuser" $samba_tool newuser --configfile=$PREFIX/simple-dc/etc/smb.conf testuser testp@ssw0Rd
    2021
    21 testit "setpassword" $PYTHON ./setup/setpassword --configfile=$PREFIX/simple-dc/etc/smb.conf testuser --newpassword=testpass --must-change-at-next-login
     22testit "setpassword" $samba_tool setpassword --configfile=$PREFIX/simple-dc/etc/smb.conf testuser --newpassword=testp@ssw0Rd
    2223
    23 testit "pwsettings" $PYTHON ./setup/pwsettings --quiet set --configfile=$PREFIX/simple-dc/etc/smb.conf --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default
     24testit "setpassword" $samba_tool setpassword --configfile=$PREFIX/simple-dc/etc/smb.conf testuser --newpassword=testp@ssw0Rd --must-change-at-next-login
     25
     26testit "pwsettings" $samba_tool pwsettings --quiet set --configfile=$PREFIX/simple-dc/etc/smb.conf --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default --store-plaintext=on
    2427
    2528exit $failed
Note: See TracChangeset for help on using the changeset viewer.