Ignore:
Timestamp:
Nov 27, 2012, 4:43:17 PM (13 years ago)
Author:
Silvan Scherrer
Message:

Samba Server: updated trunk to 3.6.0

Location:
trunk/server
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • trunk/server

  • trunk/server/source4/setup/provision_users.ldif

    r414 r745  
    1 # Add default primary groups (domain users, domain guests) - needed for
    2 # the users to find valid primary groups (samldb module)
     1# Add default primary groups (domain users, domain guests, domain computers &
     2# domain controllers) - needed for the users to find valid primary groups
     3# (samldb module)
    34
    45dn: CN=Domain Users,CN=Users,${DOMAINDN}
    … …  
    1819isCriticalSystemObject: TRUE
    1920
     21dn: CN=Domain Computers,CN=Users,${DOMAINDN}
     22objectClass: top
     23objectClass: group
     24description: All workstations and servers joined to the domain
     25objectSid: ${DOMAINSID}-515
     26sAMAccountName: Domain Computers
     27isCriticalSystemObject: TRUE
     28
     29dn: CN=Domain Controllers,CN=Users,${DOMAINDN}
     30objectClass: top
     31objectClass: group
     32description: All domain controllers in the domain
     33objectSid: ${DOMAINSID}-516
     34adminCount: 1
     35sAMAccountName: Domain Controllers
     36isCriticalSystemObject: TRUE
     37
    2038# Add users
    2139
    … …  
    2341objectClass: user
    2442description: Built-in account for administering the computer/domain
    25 userAccountControl: 66048
     43userAccountControl: 512
    2644objectSid: ${DOMAINSID}-500
    2745adminCount: 1
    2846accountExpires: 9223372036854775807
    2947sAMAccountName: Administrator
    30 userPassword:: ${ADMINPASS_B64}
     48clearTextPassword:: ${ADMINPASS_B64}
    3149isCriticalSystemObject: TRUE
    3250
    … …  
    5371sAMAccountName: krbtgt
    5472servicePrincipalName: kadmin/changepw
    55 userPassword:: ${KRBTGTPASS_B64}
     73clearTextPassword:: ${KRBTGTPASS_B64}
    5674isCriticalSystemObject: TRUE
    5775
    5876# Add other groups
     77
     78dn: CN=Enterprise Read-only Domain Controllers,CN=Users,${DOMAINDN}
     79objectClass: top
     80objectClass: group
     81description: Members of this group are Read-Only Domain Controllers in the enterprise
     82objectSid: ${DOMAINSID}-498
     83sAMAccountName: Enterprise Read-Only Domain Controllers
     84groupType: -2147483640
     85isCriticalSystemObject: TRUE
     86
     87dn: CN=Domain Admins,CN=Users,${DOMAINDN}
     88objectClass: top
     89objectClass: group
     90description: Designated administrators of the domain
     91member: CN=Administrator,CN=Users,${DOMAINDN}
     92objectSid: ${DOMAINSID}-512
     93adminCount: 1
     94sAMAccountName: Domain Admins
     95isCriticalSystemObject: TRUE
     96
     97dn: CN=Cert Publishers,CN=Users,${DOMAINDN}
     98objectClass: top
     99objectClass: group
     100description: Members of this group are permitted to publish certificates to the directory
     101objectSid: ${DOMAINSID}-517
     102sAMAccountName: Cert Publishers
     103groupType: -2147483644
     104isCriticalSystemObject: TRUE
     105
     106dn: CN=Schema Admins,CN=Users,${DOMAINDN}
     107objectClass: top
     108objectClass: group
     109description: Designated administrators of the schema
     110member: CN=Administrator,CN=Users,${DOMAINDN}
     111objectSid: ${DOMAINSID}-518
     112adminCount: 1
     113sAMAccountName: Schema Admins
     114groupType: -2147483640
     115isCriticalSystemObject: TRUE
    59116
    60117dn: CN=Enterprise Admins,CN=Users,${DOMAINDN}
    … …  
    66123adminCount: 1
    67124sAMAccountName: Enterprise Admins
    68 isCriticalSystemObject: TRUE
    69 
    70 dn: CN=Domain Computers,CN=Users,${DOMAINDN}
    71 objectClass: top
    72 objectClass: group
    73 description: All workstations and servers joined to the domain
    74 objectSid: ${DOMAINSID}-515
    75 sAMAccountName: Domain Computers
    76 isCriticalSystemObject: TRUE
    77 
    78 dn: CN=Domain Controllers,CN=Users,${DOMAINDN}
    79 objectClass: top
    80 objectClass: group
    81 description: All domain controllers in the domain
    82 objectSid: ${DOMAINSID}-516
    83 adminCount: 1
    84 sAMAccountName: Domain Controllers
    85 isCriticalSystemObject: TRUE
    86 
    87 dn: CN=Schema Admins,CN=Users,${DOMAINDN}
    88 objectClass: top
    89 objectClass: group
    90 description: Designated administrators of the schema
    91 member: CN=Administrator,CN=Users,${DOMAINDN}
    92 objectSid: ${DOMAINSID}-518
    93 adminCount: 1
    94 sAMAccountName: Schema Admins
    95 isCriticalSystemObject: TRUE
    96 
    97 dn: CN=Cert Publishers,CN=Users,${DOMAINDN}
    98 objectClass: top
    99 objectClass: group
    100 description: Members of this group are permitted to publish certificates to the Active Directory
    101 groupType: -2147483644
    102 objectSid: ${DOMAINSID}-517
    103 sAMAccountName: Cert Publishers
    104 isCriticalSystemObject: TRUE
    105 
    106 dn: CN=Domain Admins,CN=Users,${DOMAINDN}
    107 objectClass: top
    108 objectClass: group
    109 description: Designated administrators of the domain
    110 member: CN=Administrator,CN=Users,${DOMAINDN}
    111 objectSid: ${DOMAINSID}-512
    112 adminCount: 1
    113 sAMAccountName: Domain Admins
     125groupType: -2147483640
    114126isCriticalSystemObject: TRUE
    115127
    … …  
    123135isCriticalSystemObject: TRUE
    124136
     137dn: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
     138objectClass: top
     139objectClass: group
     140description: Members of this group are Read-Only Domain Controllers in the domain
     141objectSid: ${DOMAINSID}-521
     142adminCount: 1
     143sAMAccountName: Read-Only Domain Controllers
     144isCriticalSystemObject: TRUE
     145
    125146dn: CN=RAS and IAS Servers,CN=Users,${DOMAINDN}
    126147objectClass: top
    … …  
    132153isCriticalSystemObject: TRUE
    133154
    134 dn: CN=Read-Only Domain Controllers,CN=Users,${DOMAINDN}
    135 objectClass: top
    136 objectClass: group
    137 description: read-only domain controllers
    138 objectSid: ${DOMAINSID}-521
    139 sAMAccountName: Read-Only Domain Controllers
     155dn: CN=Allowed RODC Password Replication Group,CN=Users,${DOMAINDN}
     156objectClass: top
     157objectClass: group
     158description: Members in this group can have their passwords replicated to all read-only domain controllers in the domain
     159objectSid: ${DOMAINSID}-571
     160sAMAccountName: Allowed RODC Password Replication Group
    140161groupType: -2147483644
    141162isCriticalSystemObject: TRUE
    142163
    143 dn: CN=Enterprise Read-Only Domain Controllers,CN=Users,${DOMAINDN}
    144 objectClass: top
    145 objectClass: group
    146 description: enterprise read-only domain controllers
    147 objectSid: ${DOMAINSID}-498
    148 sAMAccountName: Enterprise Read-Only Domain Controllers
     164dn: CN=Denied RODC Password Replication Group,CN=Users,${DOMAINDN}
     165objectClass: top
     166objectClass: group
     167description: Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain
     168member: CN=Read-only Domain Controllers,CN=Users,${DOMAINDN}
     169member: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
     170member: CN=Domain Admins,CN=Users,${DOMAINDN}
     171member: CN=Cert Publishers,CN=Users,${DOMAINDN}
     172member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
     173member: CN=Schema Admins,CN=Users,${DOMAINDN}
     174member: CN=Domain Controllers,CN=Users,${DOMAINDN}
     175member: CN=krbtgt,CN=Users,${DOMAINDN}
     176objectSid: ${DOMAINSID}-572
     177sAMAccountName: Denied RODC Password Replication Group
    149178groupType: -2147483644
    150179isCriticalSystemObject: TRUE
    151180
    152 dn: CN=Certificate Service DCOM Access,CN=Users,${DOMAINDN}
    153 objectClass: top
    154 objectClass: group
    155 description: Certificate Service DCOM Access
    156 objectSid: ${DOMAINSID}-574
    157 sAMAccountName: Certificate Service DCOM Access
    158 groupType: -2147483644
    159 isCriticalSystemObject: TRUE
    160 
    161 dn: CN=Cryptographic Operators,CN=Users,${DOMAINDN}
    162 objectClass: top
    163 objectClass: group
    164 description: Cryptographic Operators
    165 objectSid: ${DOMAINSID}-569
    166 sAMAccountName: Cryptographic Operators
    167 groupType: -2147483644
    168 isCriticalSystemObject: TRUE
    169 
    170 dn: CN=Event Log Readers,CN=Users,${DOMAINDN}
    171 objectClass: top
    172 objectClass: group
    173 description: Event Log Readers
    174 objectSid: ${DOMAINSID}-573
    175 sAMAccountName: Event Log Readers
    176 groupType: -2147483644
    177 isCriticalSystemObject: TRUE
     181# NOTICE: Some other users and groups which rely on automatic SIDs are located
     182# in "provision_self_join_modify.ldif"
    178183
    179184# Add foreign security principals
    … …  
    194199objectSid: S-1-5-11
    195200
    196 dn: CN=S-1-5-20,CN=ForeignSecurityPrincipals,${DOMAINDN}
    197 objectClass: top
    198 objectClass: foreignSecurityPrincipal
    199 objectSid: S-1-5-20
     201dn: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
     202objectClass: top
     203objectClass: foreignSecurityPrincipal
     204objectSid: S-1-5-17
    200205
    201206# Add builtin objects
    … …  
    213218systemFlags: -1946157056
    214219groupType: -2147483643
    215 privilege: SeSecurityPrivilege
    216 privilege: SeBackupPrivilege
    217 privilege: SeRestorePrivilege
    218 privilege: SeSystemtimePrivilege
    219 privilege: SeShutdownPrivilege
    220 privilege: SeRemoteShutdownPrivilege
    221 privilege: SeTakeOwnershipPrivilege
    222 privilege: SeDebugPrivilege
    223 privilege: SeSystemEnvironmentPrivilege
    224 privilege: SeSystemProfilePrivilege
    225 privilege: SeProfileSingleProcessPrivilege
    226 privilege: SeIncreaseBasePriorityPrivilege
    227 privilege: SeLoadDriverPrivilege
    228 privilege: SeCreatePagefilePrivilege
    229 privilege: SeIncreaseQuotaPrivilege
    230 privilege: SeChangeNotifyPrivilege
    231 privilege: SeUndockPrivilege
    232 privilege: SeManageVolumePrivilege
    233 privilege: SeImpersonatePrivilege
    234 privilege: SeCreateGlobalPrivilege
    235 privilege: SeEnableDelegationPrivilege
    236 privilege: SeInteractiveLogonRight
    237 privilege: SeNetworkLogonRight
    238 privilege: SeRemoteInteractiveLogonRight
    239220isCriticalSystemObject: TRUE
    240221
    … …  
    242223objectClass: top
    243224objectClass: group
    244 description: Users are prevented from making accidental or intentional system-wide changes.  Thus, Users can run certified applications, but not most legacy applications
     225description: Users are prevented from making accidental or intentional system-wide changes and can run most applications
    245226member: CN=Domain Users,CN=Users,${DOMAINDN}
    246227member: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
    … …  
    264245isCriticalSystemObject: TRUE
    265246
     247dn: CN=Account Operators,CN=Builtin,${DOMAINDN}
     248objectClass: top
     249objectClass: group
     250description: Members can administer domain user and group accounts
     251objectSid: S-1-5-32-548
     252adminCount: 1
     253sAMAccountName: Account Operators
     254systemFlags: -1946157056
     255groupType: -2147483643
     256isCriticalSystemObject: TRUE
     257
     258dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
     259objectClass: top
     260objectClass: group
     261description: Members can administer domain servers
     262objectSid: S-1-5-32-549
     263adminCount: 1
     264sAMAccountName: Server Operators
     265systemFlags: -1946157056
     266groupType: -2147483643
     267isCriticalSystemObject: TRUE
     268
    266269dn: CN=Print Operators,CN=Builtin,${DOMAINDN}
    267270objectClass: top
    … …  
    273276systemFlags: -1946157056
    274277groupType: -2147483643
    275 privilege: SeLoadDriverPrivilege
    276 privilege: SeShutdownPrivilege
    277 privilege: SeInteractiveLogonRight
    278278isCriticalSystemObject: TRUE
    279279
    … …  
    287287systemFlags: -1946157056
    288288groupType: -2147483643
    289 privilege: SeBackupPrivilege
    290 privilege: SeRestorePrivilege
    291 privilege: SeShutdownPrivilege
    292 privilege: SeInteractiveLogonRight
    293289isCriticalSystemObject: TRUE
    294290
    … …  
    302298systemFlags: -1946157056
    303299groupType: -2147483643
    304 isCriticalSystemObject: TRUE
    305 
    306 dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
    307 objectClass: top
    308 objectClass: group
    309 description: Members in this group are granted the right to logon remotely
    310 objectSid: S-1-5-32-555
    311 sAMAccountName: Remote Desktop Users
    312 systemFlags: -1946157056
    313 groupType: -2147483643
    314 isCriticalSystemObject: TRUE
    315 
    316 dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
    317 objectClass: top
    318 objectClass: group
    319 description: Members in this group can have some administrative privileges to manage configuration of networking features
    320 objectSid: S-1-5-32-556
    321 sAMAccountName: Network Configuration Operators
    322 systemFlags: -1946157056
    323 groupType: -2147483643
    324 isCriticalSystemObject: TRUE
    325 
    326 dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
    327 objectClass: top
    328 objectClass: group
    329 description: Members of this group have remote access to monitor this computer
    330 objectSid: S-1-5-32-558
    331 sAMAccountName: Performance Monitor Users
    332 systemFlags: -1946157056
    333 groupType: -2147483643
    334 isCriticalSystemObject: TRUE
    335 
    336 dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
    337 objectClass: top
    338 objectClass: group
    339 description: Members of this group have remote access to schedule logging of performance counters on this computer
    340 member: CN=S-1-5-20,CN=ForeignSecurityPrincipals,${DOMAINDN}
    341 objectSid: S-1-5-32-559
    342 sAMAccountName: Performance Log Users
    343 systemFlags: -1946157056
    344 groupType: -2147483643
    345 isCriticalSystemObject: TRUE
    346 
    347 dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
    348 objectClass: top
    349 objectClass: group
    350 description: Members can administer domain servers
    351 objectSid: S-1-5-32-549
    352 adminCount: 1
    353 sAMAccountName: Server Operators
    354 systemFlags: -1946157056
    355 groupType: -2147483643
    356 privilege: SeBackupPrivilege
    357 privilege: SeSystemtimePrivilege
    358 privilege: SeRemoteShutdownPrivilege
    359 privilege: SeRestorePrivilege
    360 privilege: SeShutdownPrivilege
    361 privilege: SeInteractiveLogonRight
    362 isCriticalSystemObject: TRUE
    363 
    364 dn: CN=Account Operators,CN=Builtin,${DOMAINDN}
    365 objectClass: top
    366 objectClass: group
    367 description: Members can administer domain user and group accounts
    368 objectSid: S-1-5-32-548
    369 adminCount: 1
    370 sAMAccountName: Account Operators
    371 systemFlags: -1946157056
    372 groupType: -2147483643
    373 privilege: SeInteractiveLogonRight
    374300isCriticalSystemObject: TRUE
    375301
    … …  
    383309systemFlags: -1946157056
    384310groupType: -2147483643
    385 privilege: SeRemoteInteractiveLogonRight
    386 privilege: SeChangeNotifyPrivilege
     311isCriticalSystemObject: TRUE
     312
     313dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
     314objectClass: top
     315objectClass: group
     316description: Members in this group are granted the right to logon remotely
     317objectSid: S-1-5-32-555
     318sAMAccountName: Remote Desktop Users
     319systemFlags: -1946157056
     320groupType: -2147483643
     321isCriticalSystemObject: TRUE
     322
     323dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
     324objectClass: top
     325objectClass: group
     326description: Members in this group can have some administrative privileges to manage configuration of networking features
     327objectSid: S-1-5-32-556
     328sAMAccountName: Network Configuration Operators
     329systemFlags: -1946157056
     330groupType: -2147483643
    387331isCriticalSystemObject: TRUE
    388332
    … …  
    393337objectSid: S-1-5-32-557
    394338sAMAccountName: Incoming Forest Trust Builders
     339systemFlags: -1946157056
     340groupType: -2147483643
     341isCriticalSystemObject: TRUE
     342
     343dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
     344objectClass: top
     345objectClass: group
     346description: Members of this group can access performance counter data locally and remotely
     347objectSid: S-1-5-32-558
     348sAMAccountName: Performance Monitor Users
     349systemFlags: -1946157056
     350groupType: -2147483643
     351isCriticalSystemObject: TRUE
     352
     353dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
     354objectClass: top
     355objectClass: group
     356description: Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer
     357objectSid: S-1-5-32-559
     358sAMAccountName: Performance Log Users
    395359systemFlags: -1946157056
    396360groupType: -2147483643
    … …  
    411375objectClass: top
    412376objectClass: group
    413 description: Terminal Server License Servers
     377description: Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage
    414378objectSid: S-1-5-32-561
    415379sAMAccountName: Terminal Server License Servers
    … …  
    428392isCriticalSystemObject: TRUE
    429393
     394dn: CN=IIS_IUSRS,CN=Builtin,${DOMAINDN}
     395objectClass: top
     396objectClass: group
     397description: Built-in group used by Internet Information Services.
     398member: CN=S-1-5-17,CN=ForeignSecurityPrincipals,${DOMAINDN}
     399objectSid: S-1-5-32-568
     400sAMAccountName: IIS_IUSRS
     401systemFlags: -1946157056
     402groupType: -2147483643
     403isCriticalSystemObject: TRUE
     404
     405dn: CN=Cryptographic Operators,CN=Builtin,${DOMAINDN}
     406objectClass: top
     407objectClass: group
     408description: Members are authorized to perform cryptographic operations.
     409objectSid: S-1-5-32-569
     410sAMAccountName: Cryptographic Operators
     411systemFlags: -1946157056
     412groupType: -2147483643
     413isCriticalSystemObject: TRUE
     414
     415dn: CN=Event Log Readers,CN=Builtin,${DOMAINDN}
     416objectClass: top
     417objectClass: group
     418description: Members of this group can read event logs from local machine
     419objectSid: S-1-5-32-573
     420sAMAccountName: Event Log Readers
     421systemFlags: -1946157056
     422groupType: -2147483643
     423isCriticalSystemObject: TRUE
     424
     425dn: CN=Certificate Service DCOM Access,CN=Builtin,${DOMAINDN}
     426objectClass: top
     427objectClass: group
     428description: Members of this group are allowed to connect to Certification Authorities in the enterprise
     429objectSid: S-1-5-32-574
     430sAMAccountName: Certificate Service DCOM Access
     431systemFlags: -1946157056
     432groupType: -2147483643
     433isCriticalSystemObject: TRUE
     434
    430435# Add well known security principals
    431436
    … …  
    485490objectSid: S-1-5-4
    486491
     492dn: CN=IUSR,CN=WellKnown Security Principals,${CONFIGDN}
     493objectClass: top
     494objectClass: foreignSecurityPrincipal
     495objectSid: S-1-5-17
     496
    487497dn: CN=Local Service,CN=WellKnown Security Principals,${CONFIGDN}
    488498objectClass: top
    … …  
    510520objectSid: S-1-5-1000
    511521
     522dn: CN=Owner Rights,CN=WellKnown Security Principals,${CONFIGDN}
     523objectClass: top
     524objectClass: foreignSecurityPrincipal
     525objectSid: S-1-3-4
     526
    512527dn: CN=Proxy,CN=WellKnown Security Principals,${CONFIGDN}
    513528objectClass: top
    … …  
    540555objectSid: S-1-5-6
    541556
     557dn: CN=System,CN=WellKnown Security Principals,${CONFIGDN}
     558objectClass: top
     559objectClass: foreignSecurityPrincipal
     560objectSid: S-1-5-18
     561
    542562dn: CN=Terminal Server User,CN=WellKnown Security Principals,${CONFIGDN}
    543563objectClass: top
    … …  
    549569objectClass: foreignSecurityPrincipal
    550570objectSid: S-1-5-15
    551 
    552 dn: CN=Well-Known-Security-Id-System,CN=WellKnown Security Principals,${CONFIGDN}
    553 objectClass: top
    554 objectClass: foreignSecurityPrincipal
    555 objectSid: S-1-5-18
Note: See TracChangeset for help on using the changeset viewer.