2046 lines
59 KiB
C++
2046 lines
59 KiB
C++
/*++
|
||
|
||
Microsoft Windows
|
||
|
||
Copyright (C) Microsoft Corporation, 1998 - 2001
|
||
|
||
Module Name:
|
||
|
||
join.c
|
||
|
||
Abstract:
|
||
|
||
Handles the various functions for joining a machine to a domain, including creating and
|
||
deleting machine accounts and managing domain membership
|
||
|
||
--*/
|
||
#include "pch.h"
|
||
#pragma hdrstop
|
||
#include <netdom.h>
|
||
|
||
|
||
DWORD
|
||
NetDompHandleAdd(ARG_RECORD * rgNetDomArgs)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This function will add a machine account to the domain using the default password
|
||
|
||
Arguments:
|
||
|
||
Args - List of command line arguments
|
||
|
||
Return Value:
|
||
|
||
ERROR_INVALID_PARAMETER - No object name was supplied
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
PWSTR Domain = NULL;
|
||
ND5_AUTH_INFO DomainUser;
|
||
PWSTR Server = NULL, OU = NULL, FullServer = NULL;
|
||
PDOMAIN_CONTROLLER_INFO pDcInfo = NULL;
|
||
ULONG DsGetDcOptions = 0, Length;
|
||
WCHAR DefaultPassword[ LM20_PWLEN + 1 ];
|
||
WCHAR DefaultMachineAccountName[ MAX_COMPUTERNAME_LENGTH + 2 ];
|
||
USER_INFO_1 NetUI1;
|
||
|
||
RtlZeroMemory( &DomainUser, sizeof( ND5_AUTH_INFO ) );
|
||
|
||
Win32Err = NetDompValidateSecondaryArguments(rgNetDomArgs,
|
||
eObject,
|
||
eCommDomain,
|
||
eCommOU,
|
||
eCommUserNameD,
|
||
eCommPasswordD,
|
||
eCommServer,
|
||
eAddDC,
|
||
eCommVerbose,
|
||
eArgEnd);
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
DisplayHelp(ePriAdd);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
PWSTR Object = rgNetDomArgs[eObject].strValue;
|
||
|
||
if ( !Object ) {
|
||
|
||
DisplayHelp(ePriAdd);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
//
|
||
// Make sure that the object name we were given is valid
|
||
//
|
||
Win32Err = I_NetNameValidate( NULL,
|
||
Object,
|
||
NAMETYPE_COMPUTER,
|
||
LM2X_COMPATIBLE );
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleAddExit;
|
||
}
|
||
|
||
//
|
||
// Get the server if it exists
|
||
//
|
||
Win32Err = NetDompGetArgumentString(rgNetDomArgs,
|
||
eCommServer,
|
||
&Server);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleAddExit;
|
||
}
|
||
|
||
//
|
||
// Get the domain.
|
||
//
|
||
Win32Err = NetDompGetDomainForOperation(rgNetDomArgs,
|
||
Server,
|
||
TRUE,
|
||
&Domain);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleAddExit;
|
||
}
|
||
|
||
//
|
||
// Get the password and user if it exists
|
||
//
|
||
if ( CmdFlagOn(rgNetDomArgs, eCommUserNameD) ) {
|
||
|
||
Win32Err = NetDompGetUserAndPasswordForOperation(rgNetDomArgs,
|
||
eCommUserNameD,
|
||
Domain,
|
||
&DomainUser);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleAddExit;
|
||
}
|
||
}
|
||
|
||
//
|
||
// Get the OU if it exists
|
||
//
|
||
Win32Err = NetDompGetArgumentString(rgNetDomArgs,
|
||
eCommOU,
|
||
&OU);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleAddExit;
|
||
}
|
||
|
||
//
|
||
// Get the name of a server for the domain
|
||
//
|
||
if ( Server == NULL || CmdFlagOn(rgNetDomArgs, eAddDC)) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_FIND_DC, Domain ));
|
||
DsGetDcOptions = DS_WRITABLE_REQUIRED;
|
||
|
||
if ( OU ) {
|
||
|
||
DsGetDcOptions |= DS_DIRECTORY_SERVICE_REQUIRED;
|
||
|
||
} else {
|
||
|
||
DsGetDcOptions |= DS_DIRECTORY_SERVICE_PREFERRED;
|
||
}
|
||
|
||
Win32Err = DsGetDcName( Server,
|
||
Domain,
|
||
NULL,
|
||
NULL,
|
||
DsGetDcOptions,
|
||
&pDcInfo );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
Server = pDcInfo->DomainControllerName;
|
||
}
|
||
}
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleAddExit;
|
||
}
|
||
|
||
//
|
||
// Set the default password as the first 14 characters of the machine name, lowercased
|
||
//
|
||
wcsncpy( DefaultPassword, Object, LM20_PWLEN );
|
||
DefaultPassword[ LM20_PWLEN ] = UNICODE_NULL;
|
||
_wcslwr( DefaultPassword );
|
||
|
||
//
|
||
// Ok, now, do the add
|
||
//
|
||
if ( OU ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_CREATE_ACCT_OU, Object, OU ));
|
||
|
||
//
|
||
// Use the Ds routines
|
||
//
|
||
|
||
if (CmdFlagOn(rgNetDomArgs, eAddDC) ||
|
||
CmdFlagOn(rgNetDomArgs, eCommServer))
|
||
{
|
||
//
|
||
// Don't support adding domain controllers in different OU's,
|
||
// domain controllers are always in the Domain Controllers OU
|
||
// Can't specify a server name since the OU add must be run directly
|
||
// on a DC.
|
||
//
|
||
Win32Err = ERROR_INVALID_PARAMETER;
|
||
goto HandleAddExit;
|
||
}
|
||
else
|
||
{
|
||
Win32Err = NetpCreateComputerObjectInDs(pDcInfo,
|
||
DomainUser.User,
|
||
DomainUser.Password,
|
||
Object,
|
||
DefaultPassword,
|
||
NULL,
|
||
OU);
|
||
}
|
||
|
||
} else {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_ESTABLISH_SESSION, Server ));
|
||
Win32Err = NetpManageIPCConnect( Server,
|
||
DomainUser.User,
|
||
DomainUser.Password,
|
||
NETSETUPP_CONNECT_IPC );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
wcsncpy( DefaultMachineAccountName, Object, MAX_COMPUTERNAME_LENGTH );
|
||
DefaultMachineAccountName[ MAX_COMPUTERNAME_LENGTH ] = L'\0';
|
||
wcscat( DefaultMachineAccountName, L"$" );
|
||
|
||
RtlZeroMemory( &NetUI1, sizeof( NetUI1 ) );
|
||
|
||
//
|
||
// Initialize it..
|
||
//
|
||
NetUI1.usri1_name = DefaultMachineAccountName;
|
||
NetUI1.usri1_password = DefaultPassword;
|
||
|
||
if (CmdFlagOn(rgNetDomArgs, eAddDC))
|
||
{
|
||
NetUI1.usri1_flags = UF_SERVER_TRUST_ACCOUNT | UF_SCRIPT;
|
||
}
|
||
else
|
||
{
|
||
NetUI1.usri1_flags = UF_WORKSTATION_TRUST_ACCOUNT | UF_SCRIPT;
|
||
}
|
||
|
||
NetUI1.usri1_priv = USER_PRIV_USER;
|
||
|
||
if ( Server && *Server != L'\\' ) {
|
||
|
||
Win32Err = NetApiBufferAllocate( ( wcslen( Server ) + 3 ) * sizeof( WCHAR ),
|
||
(PVOID*)&FullServer );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
swprintf( FullServer, L"\\\\%ws", Server );
|
||
}
|
||
|
||
} else {
|
||
|
||
FullServer = Server;
|
||
}
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_CREATE_ACCT, Object ));
|
||
Win32Err = NetUserAdd( FullServer,
|
||
1,
|
||
( PBYTE )&NetUI1,
|
||
NULL );
|
||
}
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_DELETE_SESSION, Server ));
|
||
NetpManageIPCConnect( Server,
|
||
DomainUser.User,
|
||
DomainUser.Password,
|
||
NETSETUPP_DISCONNECT_IPC );
|
||
}
|
||
|
||
}
|
||
|
||
HandleAddExit:
|
||
|
||
NetApiBufferFree( Domain );
|
||
NetApiBufferFree( OU );
|
||
|
||
NetDompFreeAuthIdent( &DomainUser );
|
||
|
||
if ( pDcInfo ) {
|
||
|
||
NetApiBufferFree( pDcInfo );
|
||
|
||
} else {
|
||
|
||
NetApiBufferFree( Server );
|
||
}
|
||
|
||
if ( FullServer != Server ) {
|
||
|
||
NetApiBufferFree( FullServer );
|
||
}
|
||
|
||
if (NO_ERROR != Win32Err)
|
||
{
|
||
NetDompDisplayErrorMessage(Win32Err);
|
||
}
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
|
||
|
||
DWORD
|
||
NetDompHandleRemove(ARG_RECORD * rgNetDomArgs)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This function will remove a machine from the domain
|
||
|
||
Arguments:
|
||
|
||
Args - List of command line arguments
|
||
|
||
Return Value:
|
||
|
||
ERROR_INVALID_PARAMETER - No object name was supplied
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
PWSTR Domain = NULL;
|
||
ND5_AUTH_INFO DomainUser, ObjectUser;
|
||
WCHAR DefaultMachineAccountName[ MAX_COMPUTERNAME_LENGTH + 2 ];
|
||
USER_INFO_1 NetUI1;
|
||
BOOL NeedReboot = FALSE;
|
||
|
||
RtlZeroMemory( &DomainUser, sizeof( ND5_AUTH_INFO ) );
|
||
RtlZeroMemory( &ObjectUser, sizeof( ND5_AUTH_INFO ) );
|
||
|
||
Win32Err = NetDompValidateSecondaryArguments(rgNetDomArgs,
|
||
eObject,
|
||
eCommDomain,
|
||
eCommUserNameO,
|
||
eCommPasswordO,
|
||
eCommUserNameD,
|
||
eCommPasswordD,
|
||
eCommRestart,
|
||
eCommVerbose,
|
||
eArgEnd);
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
DisplayHelp(ePriRemove);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
PWSTR Object = rgNetDomArgs[eObject].strValue;
|
||
|
||
if ( !Object ) {
|
||
|
||
DisplayHelp(ePriRemove);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
//
|
||
// Make sure that we have a specified domain...
|
||
//
|
||
Win32Err = NetDompGetDomainForOperation(rgNetDomArgs,
|
||
Object,
|
||
TRUE,
|
||
&Domain);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleRemoveExit;
|
||
}
|
||
|
||
//
|
||
// Get the password and user if it exists
|
||
//
|
||
if ( CmdFlagOn(rgNetDomArgs, eCommUserNameD) ) {
|
||
|
||
Win32Err = NetDompGetUserAndPasswordForOperation(rgNetDomArgs,
|
||
eCommUserNameD,
|
||
Domain,
|
||
&DomainUser);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleRemoveExit;
|
||
}
|
||
}
|
||
|
||
if ( CmdFlagOn(rgNetDomArgs, eCommUserNameO) ) {
|
||
|
||
Win32Err = NetDompGetUserAndPasswordForOperation(rgNetDomArgs,
|
||
eCommUserNameO,
|
||
Object,
|
||
&ObjectUser);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleRemoveExit;
|
||
}
|
||
}
|
||
|
||
//
|
||
// See if the reboot argument is specified
|
||
//
|
||
NeedReboot = NetDompGetArgumentBoolean(rgNetDomArgs,
|
||
eCommRestart);
|
||
//
|
||
// Try and unjoin the specified machine from the network by speaking directly to that
|
||
// machine
|
||
//
|
||
LOG_VERBOSE(( MSG_VERBOSE_ESTABLISH_SESSION, Object ));
|
||
Win32Err = NetpManageIPCConnect( Object,
|
||
ObjectUser.User,
|
||
ObjectUser.Password,
|
||
NETSETUPP_CONNECT_IPC );
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
// NETSETUP_ACCT_DELETE means disable the old account object.
|
||
//
|
||
Win32Err = NetUnjoinDomain( Object,
|
||
DomainUser.User,
|
||
DomainUser.Password,
|
||
NETSETUP_ACCT_DELETE );
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_DELETE_SESSION, Object ));
|
||
NetpManageIPCConnect( Object,
|
||
ObjectUser.User,
|
||
ObjectUser.Password,
|
||
NETSETUPP_DISCONNECT_IPC );
|
||
} else {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_SESSION_FAILED, Object ));
|
||
ERROR_VERBOSE( Win32Err );
|
||
}
|
||
|
||
if ( NeedReboot ) {
|
||
|
||
NetDompRestartAsRequired(rgNetDomArgs,
|
||
Object,
|
||
ObjectUser.User,
|
||
Win32Err,
|
||
MSG_DOMAIN_CHANGE_RESTART_MSG);
|
||
}
|
||
|
||
HandleRemoveExit:
|
||
|
||
NetApiBufferFree( Domain );
|
||
NetDompFreeAuthIdent( &DomainUser );
|
||
NetDompFreeAuthIdent( &ObjectUser );
|
||
|
||
if (NO_ERROR != Win32Err)
|
||
{
|
||
NetDompDisplayErrorMessage(Win32Err);
|
||
}
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
|
||
|
||
DWORD
|
||
NetDompHandleJoin(ARG_RECORD * rgNetDomArgs, BOOL AllowMove)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This function will join a machine to the domain
|
||
|
||
Arguments:
|
||
|
||
Args - List of command line arguments
|
||
|
||
AllowMove - If TRUE, allow the join if the machine is already joined to a domain
|
||
|
||
Return Value:
|
||
|
||
ERROR_INVALID_PARAMETER - No object name was supplied
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
USER_INFO_1 * pui1 = NULL;
|
||
PWSTR pwzNewDomain = NULL, pwzOldDomain = NULL, OU = NULL;
|
||
ND5_AUTH_INFO DomainUser, WkstaUser, FormerDomainUser;
|
||
ULONG JoinOptions = 0;
|
||
BOOL NeedReboot = FALSE, fConnectedO = FALSE;
|
||
|
||
RtlZeroMemory( &DomainUser, sizeof( ND5_AUTH_INFO ) );
|
||
RtlZeroMemory( &WkstaUser, sizeof( ND5_AUTH_INFO ) );
|
||
RtlZeroMemory( &FormerDomainUser, sizeof( ND5_AUTH_INFO ) );
|
||
|
||
if (AllowMove)
|
||
{
|
||
Win32Err = NetDompValidateSecondaryArguments(rgNetDomArgs,
|
||
eObject,
|
||
eCommDomain,
|
||
eCommOU,
|
||
eCommUserNameO,
|
||
eCommPasswordO,
|
||
eCommUserNameD,
|
||
eCommPasswordD,
|
||
eMoveUserNameF,
|
||
eMovePasswordF,
|
||
eCommRestart,
|
||
eCommVerbose,
|
||
eArgEnd);
|
||
}
|
||
else
|
||
{
|
||
Win32Err = NetDompValidateSecondaryArguments(rgNetDomArgs,
|
||
eObject,
|
||
eCommDomain,
|
||
eCommOU,
|
||
eCommUserNameO,
|
||
eCommPasswordO,
|
||
eCommUserNameD,
|
||
eCommPasswordD,
|
||
eCommRestart,
|
||
eCommVerbose,
|
||
eArgEnd);
|
||
}
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
DisplayHelp((AllowMove) ? ePriMove : ePriJoin);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
PWSTR pwzWksta = rgNetDomArgs[eObject].strValue;
|
||
|
||
if ( !pwzWksta ) {
|
||
|
||
DisplayHelp((AllowMove) ? ePriMove : ePriJoin);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
//
|
||
// Ok, make sure that we have a specified domain...
|
||
//
|
||
Win32Err = NetDompGetDomainForOperation(rgNetDomArgs,
|
||
NULL,
|
||
FALSE,
|
||
&pwzNewDomain);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleJoinExit;
|
||
}
|
||
|
||
//
|
||
// Get the password and user for the new domain if specified on command line.
|
||
//
|
||
if ( CmdFlagOn(rgNetDomArgs, eCommUserNameD) ) {
|
||
|
||
Win32Err = NetDompGetUserAndPasswordForOperation(rgNetDomArgs,
|
||
eCommUserNameD,
|
||
pwzNewDomain,
|
||
&DomainUser);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleJoinExit;
|
||
}
|
||
}
|
||
|
||
//
|
||
// Get the password and user for the workstation and establish the
|
||
// connection if the args are specified on the command line.
|
||
//
|
||
if ( CmdFlagOn(rgNetDomArgs, eCommUserNameO) ) {
|
||
|
||
Win32Err = NetDompGetUserAndPasswordForOperation(rgNetDomArgs,
|
||
eCommUserNameO,
|
||
pwzWksta,
|
||
&WkstaUser);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleJoinExit;
|
||
}
|
||
|
||
LOG_VERBOSE((MSG_VERBOSE_ESTABLISH_SESSION, pwzWksta));
|
||
Win32Err = NetpManageIPCConnect(pwzWksta,
|
||
WkstaUser.User,
|
||
WkstaUser.Password,
|
||
NETSETUPP_CONNECT_IPC);
|
||
if (ERROR_SUCCESS != Win32Err)
|
||
{
|
||
LOG_VERBOSE((MSG_VERBOSE_SESSION_FAILED, pwzWksta));
|
||
goto HandleJoinExit;
|
||
}
|
||
|
||
fConnectedO = TRUE;
|
||
}
|
||
|
||
if (AllowMove)
|
||
{
|
||
// Get the machine's current domain membership. This must be done after
|
||
// the NetpManageIPCConnect above so as to have rights to read the info.
|
||
//
|
||
Win32Err = NetDompGetDomainForOperation(NULL,
|
||
pwzWksta,
|
||
TRUE,
|
||
&pwzOldDomain);
|
||
|
||
if (ERROR_INVALID_PARAMETER == Win32Err)
|
||
{
|
||
// ERROR_INVALID_PARAMETER is returned by NetDompGetDomainForOperation
|
||
// if the machine is not joined to a domain.
|
||
//
|
||
LOG_VERBOSE((MSG_VERBOSE_NOT_JOINED, pwzWksta, pwzNewDomain));
|
||
|
||
pwzOldDomain = NULL;
|
||
|
||
AllowMove = FALSE;
|
||
}
|
||
else
|
||
{
|
||
if (ERROR_SUCCESS != Win32Err)
|
||
{
|
||
ERROR_VERBOSE(Win32Err);
|
||
goto HandleJoinExit;
|
||
}
|
||
if (_wcsicmp(pwzNewDomain, pwzOldDomain) == 0)
|
||
{
|
||
NetDompDisplayMessage(MSG_ALREADY_JOINED, pwzNewDomain);
|
||
Win32Err = ERROR_DS_CROSS_DOM_MOVE_ERROR;
|
||
goto HandleJoinExit;
|
||
}
|
||
}
|
||
}
|
||
|
||
if (AllowMove && CmdFlagOn(rgNetDomArgs, eMoveUserNameF))
|
||
{
|
||
//
|
||
// Get the password and user for the former domain if specified on command line.
|
||
//
|
||
Win32Err = NetDompGetUserAndPasswordForOperation(rgNetDomArgs,
|
||
eMoveUserNameF,
|
||
pwzOldDomain,
|
||
&FormerDomainUser);
|
||
if (ERROR_SUCCESS != Win32Err)
|
||
{
|
||
goto HandleJoinExit;
|
||
}
|
||
}
|
||
|
||
//
|
||
// See if the reboot argument is specified
|
||
//
|
||
NeedReboot = NetDompGetArgumentBoolean(rgNetDomArgs,
|
||
eCommRestart);
|
||
//
|
||
// Get the OU if it exists
|
||
//
|
||
Win32Err = NetDompGetArgumentString(rgNetDomArgs,
|
||
eCommOU,
|
||
&OU);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleJoinExit;
|
||
}
|
||
|
||
//
|
||
// Try and join the specified machine to the domain by speaking directly to that
|
||
// machine
|
||
//
|
||
JoinOptions = NETSETUP_JOIN_DOMAIN | NETSETUP_ACCT_CREATE;
|
||
|
||
if ( AllowMove ) {
|
||
|
||
JoinOptions |= NETSETUP_DOMAIN_JOIN_IF_JOINED;
|
||
}
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_DOMAIN_JOIN, pwzNewDomain ));
|
||
Win32Err = NetJoinDomain( pwzWksta,
|
||
pwzNewDomain,
|
||
OU,
|
||
DomainUser.User,
|
||
DomainUser.Password,
|
||
JoinOptions );
|
||
|
||
if (Win32Err == RPC_S_PROCNUM_OUT_OF_RANGE)
|
||
{
|
||
//
|
||
// Try the NT4 unjoin
|
||
//
|
||
PDOMAIN_CONTROLLER_INFO pDcInfo = NULL;
|
||
NeedReboot = TRUE;
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_FIND_DC, pwzNewDomain ));
|
||
|
||
Win32Err = DsGetDcName( NULL,
|
||
pwzNewDomain,
|
||
NULL,
|
||
NULL,
|
||
DS_WRITABLE_REQUIRED | DS_DIRECTORY_SERVICE_PREFERRED,
|
||
&pDcInfo );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_ESTABLISH_SESSION, pDcInfo->DomainControllerName ));
|
||
Win32Err = NetpManageIPCConnect( pDcInfo->DomainControllerName,
|
||
DomainUser.User,
|
||
DomainUser.Password,
|
||
NETSETUPP_CONNECT_IPC );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
Win32Err = NetDompJoinDownlevel( pwzWksta,
|
||
DomainUser.User,
|
||
DomainUser.Password,
|
||
pDcInfo->DomainControllerName,
|
||
pDcInfo->Flags,
|
||
AllowMove );
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_DELETE_SESSION, pDcInfo->DomainControllerName ));
|
||
NetpManageIPCConnect( pDcInfo->DomainControllerName,
|
||
DomainUser.User,
|
||
DomainUser.Password,
|
||
NETSETUPP_DISCONNECT_IPC );
|
||
} else {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_SESSION_FAILED, pDcInfo->DomainControllerName ));
|
||
ERROR_VERBOSE( Win32Err );
|
||
}
|
||
}
|
||
NetApiBufferFree( pDcInfo );
|
||
}
|
||
else
|
||
{
|
||
if (ERROR_SUCCESS != Win32Err)
|
||
{
|
||
LOG_VERBOSE(( MSG_VERBOSE_MOVE_COMPUTER_FAILED, Win32Err ));
|
||
goto HandleJoinExit;
|
||
}
|
||
//
|
||
// Uplevel join successful. If a Move operation, disable the old account.
|
||
//
|
||
if (AllowMove && pwzOldDomain)
|
||
{
|
||
PDOMAIN_CONTROLLER_INFO pOldDcInfo = NULL;
|
||
|
||
LOG_VERBOSE((MSG_VERBOSE_DISABLE_OLD_ACCT, pwzOldDomain));
|
||
|
||
Win32Err = DsGetDcName(NULL,
|
||
pwzOldDomain,
|
||
NULL,
|
||
NULL,
|
||
DS_WRITABLE_REQUIRED,
|
||
&pOldDcInfo);
|
||
|
||
if (ERROR_SUCCESS == Win32Err)
|
||
{
|
||
LOG_VERBOSE((MSG_VERBOSE_ESTABLISH_SESSION, pOldDcInfo->DomainControllerName));
|
||
Win32Err = NetpManageIPCConnect(pOldDcInfo->DomainControllerName,
|
||
FormerDomainUser.User,
|
||
FormerDomainUser.Password,
|
||
NETSETUPP_CONNECT_IPC );
|
||
if (ERROR_SUCCESS == Win32Err)
|
||
{
|
||
PWSTR pwzWkstaDollar;
|
||
|
||
Win32Err = NetApiBufferAllocate((wcslen(pwzWksta) + 2) * sizeof(WCHAR),
|
||
(PVOID*)&pwzWkstaDollar);
|
||
if (ERROR_SUCCESS == Win32Err)
|
||
{
|
||
wcscpy(pwzWkstaDollar, pwzWksta);
|
||
wcscat(pwzWkstaDollar, L"$");
|
||
|
||
Win32Err = NetUserGetInfo(pOldDcInfo->DomainControllerName,
|
||
pwzWkstaDollar, 1, (PBYTE *)&pui1);
|
||
|
||
if (ERROR_SUCCESS == Win32Err)
|
||
{
|
||
pui1->usri1_flags |= UF_ACCOUNTDISABLE;
|
||
|
||
Win32Err = NetUserSetInfo(pOldDcInfo->DomainControllerName,
|
||
pwzWkstaDollar, 1, (PBYTE)pui1, NULL);
|
||
NetApiBufferFree(pui1);
|
||
}
|
||
|
||
NetApiBufferFree(pwzWkstaDollar);
|
||
}
|
||
|
||
LOG_VERBOSE((MSG_VERBOSE_DELETE_SESSION, pOldDcInfo->DomainControllerName));
|
||
NetpManageIPCConnect(pOldDcInfo->DomainControllerName,
|
||
FormerDomainUser.User,
|
||
FormerDomainUser.Password,
|
||
NETSETUPP_DISCONNECT_IPC);
|
||
}
|
||
|
||
NetApiBufferFree(pOldDcInfo);
|
||
}
|
||
}
|
||
}
|
||
|
||
if (NeedReboot && (ERROR_SUCCESS == Win32Err))
|
||
{
|
||
NetDompRestartAsRequired(rgNetDomArgs,
|
||
pwzWksta,
|
||
WkstaUser.User,
|
||
Win32Err,
|
||
MSG_DOMAIN_CHANGE_RESTART_MSG);
|
||
}
|
||
|
||
HandleJoinExit:
|
||
|
||
if (fConnectedO)
|
||
{
|
||
LOG_VERBOSE((MSG_VERBOSE_DELETE_SESSION, pwzWksta));
|
||
NetpManageIPCConnect(pwzWksta,
|
||
WkstaUser.User,
|
||
WkstaUser.Password,
|
||
NETSETUPP_DISCONNECT_IPC);
|
||
}
|
||
|
||
NetApiBufferFree(pwzNewDomain);
|
||
NetDompFreeAuthIdent(&DomainUser);
|
||
NetDompFreeAuthIdent(&FormerDomainUser);
|
||
NetDompFreeAuthIdent(&WkstaUser);
|
||
if (pwzOldDomain)
|
||
{
|
||
NetApiBufferFree(pwzOldDomain);
|
||
}
|
||
|
||
if (NO_ERROR != Win32Err)
|
||
{
|
||
NetDompDisplayErrorMessage(Win32Err);
|
||
}
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
|
||
|
||
DWORD
|
||
NetDompHandleMove(ARG_RECORD * rgNetDomArgs)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This function will move a machine from one domain to another
|
||
|
||
Arguments:
|
||
|
||
SelectedOptions - List of arguments present in the Args list
|
||
|
||
Args - List of command line arguments
|
||
|
||
ArgCount - Number of arguments in the list
|
||
|
||
Object - Name of the machine to join to the domain
|
||
|
||
Return Value:
|
||
|
||
ERROR_INVALID_PARAMETER - No object name was supplied
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
|
||
Win32Err = NetDompHandleJoin(rgNetDomArgs, TRUE);
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
|
||
|
||
|
||
|
||
DWORD
|
||
NetDompResetServerSC(
|
||
IN PWSTR Domain,
|
||
IN PWSTR Server,
|
||
IN PWSTR DomainController, OPTIONAL
|
||
IN PND5_AUTH_INFO AuthInfo,
|
||
IN ULONG OkMessageId,
|
||
IN ULONG FailedMessageId
|
||
)
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
PWSTR ScDomain = NULL;
|
||
PNETLOGON_INFO_2 NetlogonInfo2 = NULL;
|
||
BOOL DomainMember = FALSE, SessionEstablished = FALSE;
|
||
|
||
//
|
||
// If it doesn't, get the name of a server for the domain
|
||
//
|
||
if ( DomainController != NULL ) {
|
||
|
||
Win32Err = NetApiBufferAllocate( ( wcslen( Domain ) + 1 +
|
||
wcslen( DomainController ) + 1 ) * sizeof( WCHAR ),
|
||
(PVOID*)&ScDomain );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
swprintf( ScDomain, L"%ws\\%ws", Domain, DomainController );
|
||
}
|
||
|
||
} else {
|
||
|
||
ScDomain = Domain;
|
||
}
|
||
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_ESTABLISH_SESSION, Server ));
|
||
Win32Err = NetpManageIPCConnect( Server,
|
||
AuthInfo->User,
|
||
AuthInfo->Password,
|
||
NETSETUPP_CONNECT_IPC );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
SessionEstablished = TRUE;
|
||
}
|
||
}
|
||
|
||
//
|
||
// See if we're a domain member or not
|
||
//
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
Win32Err = NetDompCheckDomainMembership( Server,
|
||
AuthInfo,
|
||
FALSE,
|
||
&DomainMember );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS && !DomainMember ) {
|
||
|
||
Win32Err = NERR_SetupNotJoined;
|
||
}
|
||
}
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_RESET_SC, ScDomain ));
|
||
Win32Err = I_NetLogonControl2( Server,
|
||
NETLOGON_CONTROL_REDISCOVER,
|
||
2,
|
||
( LPBYTE )&ScDomain,
|
||
( LPBYTE *)&NetlogonInfo2 );
|
||
|
||
if ( Win32Err == ERROR_NO_SUCH_DOMAIN && ScDomain != Domain ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_RETRY_RESET_SC, ScDomain, Domain ));
|
||
|
||
//
|
||
// Must be using an downlevel domain, so try it again with out the server
|
||
//
|
||
Win32Err = I_NetLogonControl2( Server,
|
||
NETLOGON_CONTROL_REDISCOVER,
|
||
2,
|
||
( LPBYTE )&Domain,
|
||
( LPBYTE *)&NetlogonInfo2 );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_RESET_NOT_NAMED, Server ));
|
||
Win32Err = I_NetLogonControl2( Server,
|
||
NETLOGON_CONTROL_TC_QUERY,
|
||
2,
|
||
( LPBYTE )&Domain,
|
||
( LPBYTE *)&NetlogonInfo2 );
|
||
}
|
||
}
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
NetDompDisplayMessage( OkMessageId, _wcsupr( Server ), _wcsupr( Domain ),
|
||
_wcsupr( NetlogonInfo2->netlog2_trusted_dc_name ) );
|
||
|
||
} else {
|
||
|
||
if ( FailedMessageId ) {
|
||
|
||
NetDompDisplayMessage( FailedMessageId, _wcsupr( Server ), _wcsupr( Domain ) );
|
||
NetDompDisplayErrorMessage( Win32Err );
|
||
}
|
||
}
|
||
}
|
||
|
||
|
||
if ( SessionEstablished ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_DELETE_SESSION, Server ));
|
||
NetpManageIPCConnect( Server,
|
||
AuthInfo->User,
|
||
AuthInfo->Password,
|
||
NETSETUPP_DISCONNECT_IPC );
|
||
|
||
}
|
||
|
||
NetApiBufferFree( NetlogonInfo2 );
|
||
return( Win32Err );
|
||
}
|
||
|
||
|
||
|
||
DWORD
|
||
NetDompHandleReset(ARG_RECORD * rgNetDomArgs)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This function will reset the secure channel with the domain
|
||
|
||
Arguments:
|
||
|
||
Args - List of command line arguments
|
||
|
||
Return Value:
|
||
|
||
ERROR_INVALID_PARAMETER - No object name was supplied
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
PWSTR Domain = NULL;
|
||
ND5_AUTH_INFO ObjectUser;
|
||
PWSTR Server = NULL;
|
||
|
||
RtlZeroMemory( &ObjectUser, sizeof( ND5_AUTH_INFO ) );
|
||
|
||
Win32Err = NetDompValidateSecondaryArguments(rgNetDomArgs,
|
||
eObject,
|
||
eCommDomain,
|
||
eCommUserNameO,
|
||
eCommPasswordO,
|
||
eCommServer,
|
||
eCommVerbose,
|
||
eArgEnd);
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
DisplayHelp(ePriReset);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
PWSTR Object = rgNetDomArgs[eObject].strValue;
|
||
|
||
if ( !Object ) {
|
||
|
||
DisplayHelp(ePriReset);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
//
|
||
// Make sure that the object name we were given is valid
|
||
//
|
||
Win32Err = I_NetNameValidate( NULL,
|
||
Object,
|
||
NAMETYPE_COMPUTER,
|
||
LM2X_COMPATIBLE );
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleResetExit;
|
||
}
|
||
|
||
//
|
||
// Ok, make sure that we have a specified domain...
|
||
//
|
||
Win32Err = NetDompGetDomainForOperation(rgNetDomArgs,
|
||
Object,
|
||
TRUE,
|
||
&Domain);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleResetExit;
|
||
}
|
||
|
||
//
|
||
// Get the password and user if it exists
|
||
//
|
||
Win32Err = NetDompGetUserAndPasswordForOperation(rgNetDomArgs,
|
||
eCommUserNameO,
|
||
Domain,
|
||
&ObjectUser);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleResetExit;
|
||
}
|
||
|
||
|
||
//
|
||
// Get the server if it exists
|
||
//
|
||
Win32Err = NetDompGetArgumentString(rgNetDomArgs,
|
||
eCommServer,
|
||
&Server);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleResetExit;
|
||
}
|
||
|
||
Win32Err = NetDompResetServerSC( Domain,
|
||
Object,
|
||
Server,
|
||
&ObjectUser,
|
||
MSG_RESET_OK,
|
||
MSG_RESET_BAD );
|
||
|
||
HandleResetExit:
|
||
|
||
NetDompFreeAuthIdent( &ObjectUser );
|
||
|
||
NetApiBufferFree( Server );
|
||
|
||
NetApiBufferFree( Domain );
|
||
|
||
if (NO_ERROR != Win32Err)
|
||
{
|
||
NetDompDisplayErrorMessage(Win32Err);
|
||
}
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
|
||
DWORD
|
||
NetDompResetPwd(
|
||
IN PWSTR DomainController,
|
||
IN PND5_AUTH_INFO AuthInfo,
|
||
IN ULONG OkMessageId,
|
||
IN ULONG FailedMessageId
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This function reset machine account password for the local machine
|
||
on the specified domain controller.
|
||
|
||
Arguments:
|
||
DomainController - name of dc
|
||
|
||
AuthInfo - user/password that has admin access on
|
||
the local machine and on DomainController
|
||
|
||
OkMessageId - message to display on success
|
||
|
||
FailedMessageId - message to display on failure
|
||
|
||
Return Value:
|
||
|
||
win32 error as returned by NetpSetComputerAccountPassword
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
BOOL DomainMember = FALSE, SessionEstablished = FALSE;
|
||
|
||
Win32Err = NetpSetComputerAccountPassword( NULL,
|
||
DomainController,
|
||
AuthInfo->User,
|
||
AuthInfo->Password,
|
||
NULL );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
NetDompDisplayMessage( OkMessageId );
|
||
|
||
} else {
|
||
|
||
NetDompDisplayMessage( FailedMessageId );
|
||
}
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
|
||
DWORD
|
||
NetDompHandleResetPwd(ARG_RECORD * rgNetDomArgs)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This function resets the machine account password for the local.
|
||
Currently there is no support for resetting machine password of
|
||
a remote machine.
|
||
|
||
Arguments:
|
||
|
||
Args - List of command line arguments
|
||
|
||
Return Value:
|
||
|
||
ERROR_INVALID_PARAMETER - if any param is invalid
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
PWSTR Domain = NULL;
|
||
ND5_AUTH_INFO ObjectUser = {0};
|
||
PWSTR Server = NULL;
|
||
|
||
RtlZeroMemory( &ObjectUser, sizeof( ND5_AUTH_INFO ) );
|
||
|
||
Win32Err = NetDompValidateSecondaryArguments(rgNetDomArgs,
|
||
eCommServer,
|
||
eCommUserNameD,
|
||
eCommPasswordD,
|
||
eCommVerbose,
|
||
eArgEnd);
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
DisplayHelp(ePriResetPwd);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
//
|
||
// Get the server
|
||
//
|
||
Win32Err = NetDompGetArgumentString(rgNetDomArgs,
|
||
eCommServer,
|
||
&Server);
|
||
|
||
if (ERROR_SUCCESS != Win32Err)
|
||
{
|
||
NetDompDisplayErrorMessage(Win32Err);
|
||
return Win32Err;
|
||
}
|
||
|
||
if (!Server)
|
||
{
|
||
DisplayHelp(ePriResetPwd);
|
||
return ERROR_INVALID_PARAMETER;
|
||
}
|
||
|
||
Win32Err = NetDompGetDomainForOperation(rgNetDomArgs,
|
||
NULL,
|
||
TRUE,
|
||
&Domain);
|
||
if (ERROR_SUCCESS != Win32Err)
|
||
{
|
||
NetDompDisplayErrorMessage(Win32Err);
|
||
return Win32Err;
|
||
}
|
||
|
||
//
|
||
// Get the password and user
|
||
//
|
||
Win32Err = NetDompGetUserAndPasswordForOperation(rgNetDomArgs,
|
||
eCommUserNameD,
|
||
Domain,
|
||
&ObjectUser);
|
||
if (ERROR_SUCCESS != Win32Err)
|
||
{
|
||
NetDompDisplayErrorMessage(Win32Err);
|
||
goto HandleResetExit;
|
||
}
|
||
|
||
if (!ObjectUser.User)
|
||
{
|
||
DisplayHelp(ePriResetPwd);
|
||
Win32Err = ERROR_INVALID_PARAMETER;
|
||
goto HandleResetExit;
|
||
}
|
||
|
||
Win32Err = NetDompResetPwd( Server,
|
||
&ObjectUser,
|
||
MSG_RESETPWD_OK,
|
||
MSG_RESETPWD_BAD );
|
||
if (NO_ERROR != Win32Err)
|
||
{
|
||
NetDompDisplayErrorMessage(Win32Err);
|
||
}
|
||
|
||
HandleResetExit:
|
||
|
||
NetDompFreeAuthIdent( &ObjectUser );
|
||
|
||
NetApiBufferFree( Server );
|
||
|
||
NetApiBufferFree( Domain );
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
|
||
DWORD
|
||
NetDompVerifyServerSC(
|
||
IN PWSTR Domain,
|
||
IN PWSTR Server,
|
||
IN PND5_AUTH_INFO AuthInfo,
|
||
IN ULONG OkMessageId,
|
||
IN ULONG FailedMessageId
|
||
)
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
PNETLOGON_INFO_2 NetlogonInfo2 = NULL;
|
||
BOOL DomainMember = FALSE, SessionEstablished = FALSE;
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_ESTABLISH_SESSION, Server ));
|
||
Win32Err = NetpManageIPCConnect( Server,
|
||
AuthInfo->User,
|
||
AuthInfo->Password,
|
||
NETSETUPP_CONNECT_IPC );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
SessionEstablished = TRUE;
|
||
|
||
}
|
||
|
||
//
|
||
// See if we're a domain member or not
|
||
//
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
Win32Err = NetDompCheckDomainMembership( Server,
|
||
AuthInfo,
|
||
FALSE,
|
||
&DomainMember );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS && !DomainMember ) {
|
||
|
||
Win32Err = NERR_SetupNotJoined;
|
||
}
|
||
}
|
||
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_CHECKING_SC, Domain ));
|
||
Win32Err = I_NetLogonControl2( Server,
|
||
NETLOGON_CONTROL_TC_QUERY,
|
||
2,
|
||
( LPBYTE )&Domain,
|
||
( LPBYTE *)&NetlogonInfo2 );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
Win32Err = NetlogonInfo2->netlog2_pdc_connection_status;
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
NetDompDisplayMessage( OkMessageId, _wcsupr( Server ), _wcsupr( Domain ),
|
||
_wcsupr( NetlogonInfo2->netlog2_trusted_dc_name ) );
|
||
|
||
} else {
|
||
|
||
if ( FailedMessageId ) {
|
||
|
||
NetDompDisplayMessage( FailedMessageId, _wcsupr( Server ), _wcsupr( Domain ) );
|
||
NetDompDisplayErrorMessage( Win32Err );
|
||
}
|
||
}
|
||
|
||
NetApiBufferFree( NetlogonInfo2 );
|
||
|
||
}
|
||
}
|
||
|
||
if ( SessionEstablished ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_DELETE_SESSION, Server ));
|
||
NetpManageIPCConnect( Server,
|
||
AuthInfo->User,
|
||
AuthInfo->Password,
|
||
NETSETUPP_DISCONNECT_IPC );
|
||
|
||
}
|
||
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
|
||
DWORD
|
||
NetDompHandleVerify(ARG_RECORD * rgNetDomArgs)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This function will verify the secure channel with the domain
|
||
|
||
Arguments:
|
||
|
||
Args - List of command line arguments
|
||
|
||
Return Value:
|
||
|
||
ERROR_INVALID_PARAMETER - No object name was supplied
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
PWSTR Domain = NULL;
|
||
ND5_AUTH_INFO ObjectUser;
|
||
|
||
RtlZeroMemory( &ObjectUser, sizeof( ND5_AUTH_INFO ) );
|
||
|
||
Win32Err = NetDompValidateSecondaryArguments(rgNetDomArgs,
|
||
eObject,
|
||
eCommDomain,
|
||
eCommUserNameO,
|
||
eCommPasswordO,
|
||
eCommVerbose,
|
||
eArgEnd);
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
DisplayHelp(ePriVerify);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
PWSTR Object = rgNetDomArgs[eObject].strValue;
|
||
|
||
if ( !Object ) {
|
||
|
||
DisplayHelp(ePriVerify);
|
||
return( ERROR_INVALID_PARAMETER );
|
||
}
|
||
|
||
//
|
||
// Make sure that the object name we were given is valid
|
||
//
|
||
Win32Err = I_NetNameValidate( NULL,
|
||
Object,
|
||
NAMETYPE_COMPUTER,
|
||
LM2X_COMPATIBLE );
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleVerifyExit;
|
||
}
|
||
|
||
//
|
||
// Ok, make sure that we have a specified domain...
|
||
//
|
||
Win32Err = NetDompGetDomainForOperation(rgNetDomArgs,
|
||
Object,
|
||
TRUE,
|
||
&Domain);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleVerifyExit;
|
||
}
|
||
|
||
//
|
||
// Get the password and user if it exists
|
||
//
|
||
Win32Err = NetDompGetUserAndPasswordForOperation(rgNetDomArgs,
|
||
eCommUserNameO,
|
||
Domain,
|
||
&ObjectUser);
|
||
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
goto HandleVerifyExit;
|
||
}
|
||
|
||
Win32Err = NetDompVerifyServerSC( Domain,
|
||
Object,
|
||
&ObjectUser,
|
||
MSG_SC_OK,
|
||
MSG_SC_BAD );
|
||
|
||
|
||
|
||
HandleVerifyExit:
|
||
|
||
NetDompFreeAuthIdent( &ObjectUser );
|
||
|
||
NetApiBufferFree( Domain );
|
||
|
||
if (NO_ERROR != Win32Err)
|
||
{
|
||
NetDompDisplayErrorMessage(Win32Err);
|
||
}
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
DWORD
|
||
NetDompJoinDownlevel(
|
||
IN PWSTR Server,
|
||
IN PWSTR Account,
|
||
IN PWSTR Password,
|
||
IN PWSTR Dc,
|
||
IN ULONG DcFlags,
|
||
IN BOOL AllowMove
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This function will join an NT4 machine to the domain. It does this remotely
|
||
|
||
Arguments:
|
||
|
||
Server - Server to join
|
||
|
||
Account - Account to use to contact the domain controller
|
||
|
||
Password - Password to use with the above account
|
||
|
||
Dc - Domain controller to speak to
|
||
|
||
DcFlags - Flags specifying various properties of Dc
|
||
|
||
AllowMove - If TRUE, allow the machine to join the domain even if it's already
|
||
joined to a domain
|
||
|
||
Return Value:
|
||
|
||
ERROR_INVALID_PARAMETER - No object name was supplied
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
NTSTATUS Status = STATUS_SUCCESS;
|
||
LSA_HANDLE ClientLsaHandle = NULL, ServerLsaHandle = NULL, SecretHandle = NULL;
|
||
PPOLICY_PRIMARY_DOMAIN_INFO CurrentPolicyPDI = NULL, DomainPolicyPDI = NULL;
|
||
OBJECT_ATTRIBUTES OA;
|
||
UNICODE_STRING ServerU, Secret;
|
||
WCHAR AccountPassword[ LM20_PWLEN + 1 ];
|
||
BOOL DefaultJoin = FALSE, ServiceSet = FALSE, GroupsSet = FALSE, SidSet = FALSE;
|
||
|
||
//
|
||
// We will do things in the following order:
|
||
//
|
||
// - Create the computer account on the domain controller
|
||
// - Set the domain sid
|
||
// - Configure the netlogon service
|
||
// - Set the group memberships
|
||
// - Set the local secret. No rollback after this succeeds.
|
||
|
||
|
||
InitializeObjectAttributes(
|
||
&OA,
|
||
NULL,
|
||
0L,
|
||
NULL,
|
||
NULL
|
||
);
|
||
|
||
|
||
if ( Server ) {
|
||
|
||
RtlInitUnicodeString( &ServerU, Server );
|
||
}
|
||
|
||
//InitializeObjectAttributes( &OA, NULL, 0, NULL, NULL );
|
||
|
||
Status = LsaOpenPolicy( Server ? &ServerU : NULL,
|
||
&OA,
|
||
MAXIMUM_ALLOWED,
|
||
&ClientLsaHandle );
|
||
|
||
if ( NT_SUCCESS( Status ) ) {
|
||
|
||
RtlInitUnicodeString( &ServerU, Dc );
|
||
|
||
InitializeObjectAttributes( &OA, NULL, 0, NULL, NULL );
|
||
|
||
Status = LsaOpenPolicy( &ServerU,
|
||
&OA,
|
||
MAXIMUM_ALLOWED,
|
||
&ServerLsaHandle );
|
||
}
|
||
|
||
//
|
||
// Read the current LSA policy
|
||
//
|
||
if ( NT_SUCCESS( Status ) ) {
|
||
|
||
Status = LsaQueryInformationPolicy( ClientLsaHandle,
|
||
PolicyPrimaryDomainInformation,
|
||
( PVOID * )&CurrentPolicyPDI );
|
||
|
||
if ( NT_SUCCESS( Status ) ) {
|
||
|
||
Status = LsaQueryInformationPolicy( ServerLsaHandle,
|
||
PolicyPrimaryDomainInformation,
|
||
( PVOID * )&DomainPolicyPDI );
|
||
}
|
||
}
|
||
|
||
Win32Err = RtlNtStatusToDosError( Status );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
if ( CurrentPolicyPDI->Sid && !AllowMove ) {
|
||
|
||
Win32Err = NERR_SetupAlreadyJoined;
|
||
}
|
||
}
|
||
|
||
//
|
||
// Ok, now generate the password to use on the account
|
||
//
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
Win32Err = NetpGetNt4RefusePasswordChangeStatus( Dc, &DefaultJoin );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
if ( (Server != NULL) & DefaultJoin ) {
|
||
|
||
wcsncpy( AccountPassword, Server, LM20_PWLEN );
|
||
AccountPassword[ LM20_PWLEN ] = UNICODE_NULL;
|
||
_wcslwr( AccountPassword );
|
||
|
||
} else {
|
||
|
||
Win32Err = NetDompGenerateRandomPassword( AccountPassword,
|
||
LM20_PWLEN );
|
||
}
|
||
}
|
||
}
|
||
|
||
//
|
||
// Ok, if that worked, we'll start the actual set
|
||
//
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
//
|
||
// Manage the account
|
||
//
|
||
Win32Err = NetpManageMachineAccountWithSid( Server,
|
||
NULL,
|
||
Dc,
|
||
AccountPassword,
|
||
DomainPolicyPDI->Sid,
|
||
NETSETUPP_CREATE,
|
||
0,
|
||
(DcFlags & DS_DS_FLAG) == 0 ?
|
||
TRUE : // NT4 or older DC
|
||
FALSE ); // NT5 DC
|
||
}
|
||
|
||
//
|
||
// Now, set the domain information
|
||
//
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
Status = LsaSetInformationPolicy( ClientLsaHandle,
|
||
PolicyPrimaryDomainInformation,
|
||
DomainPolicyPDI );
|
||
|
||
Win32Err = RtlNtStatusToDosError( Status );
|
||
}
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
SidSet = TRUE;
|
||
Win32Err = NetDompManageGroupMembership( Server,
|
||
DomainPolicyPDI->Sid,
|
||
FALSE );
|
||
}
|
||
|
||
//
|
||
// Configure netlogon
|
||
//
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
GroupsSet = TRUE;
|
||
Win32Err = NetDompControlService( Server,
|
||
SERVICE_NETLOGON,
|
||
SERVICE_AUTO_START );
|
||
}
|
||
|
||
//
|
||
// Finally, the secret
|
||
//
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
ServiceSet = TRUE;
|
||
|
||
Win32Err = NetDompManageMachineSecret(ClientLsaHandle,
|
||
AccountPassword,
|
||
NETSETUPP_CREATE);
|
||
|
||
}
|
||
|
||
//
|
||
// Unwind, if something failed
|
||
//
|
||
if ( Win32Err != ERROR_SUCCESS ) {
|
||
|
||
if ( ServiceSet ) {
|
||
|
||
NetDompControlService( Server,
|
||
SERVICE_NETLOGON,
|
||
SERVICE_DEMAND_START );
|
||
}
|
||
|
||
if ( GroupsSet ) {
|
||
|
||
NetDompManageGroupMembership( Server,
|
||
DomainPolicyPDI->Sid,
|
||
TRUE );
|
||
}
|
||
|
||
if ( SidSet ) {
|
||
|
||
LsaSetInformationPolicy( ClientLsaHandle,
|
||
PolicyPrimaryDomainInformation,
|
||
CurrentPolicyPDI );
|
||
}
|
||
}
|
||
|
||
LsaFreeMemory( CurrentPolicyPDI );
|
||
LsaFreeMemory( DomainPolicyPDI );
|
||
LsaClose( ClientLsaHandle );
|
||
LsaClose( ServerLsaHandle );
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
DWORD
|
||
NetDompManageGroupMembership(
|
||
IN PWSTR Server,
|
||
IN PSID DomainSid,
|
||
IN BOOL Delete
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
Performs SAM account handling to either add or remove the DomainAdmins,
|
||
etc groups from the local groups.
|
||
|
||
|
||
Arguments:
|
||
|
||
Server - Server on which to perform the operation
|
||
|
||
DomainSid - SID of the domain being joined/left
|
||
|
||
Delete - Whether to add or remove the admin alias
|
||
|
||
Returns:
|
||
|
||
ERROR_SUCCESS -- Success
|
||
|
||
--*/
|
||
{
|
||
DWORD Win32Err = ERROR_SUCCESS;
|
||
//
|
||
// Keep these in synch with the rids and Sids below
|
||
//
|
||
ULONG LocalRids[] = {
|
||
|
||
DOMAIN_ALIAS_RID_ADMINS,
|
||
DOMAIN_ALIAS_RID_USERS
|
||
};
|
||
|
||
PWSTR LocalGroups[ sizeof( LocalRids ) / sizeof( ULONG )] = {
|
||
NULL,
|
||
NULL,
|
||
};
|
||
|
||
ULONG Rids[] = {
|
||
DOMAIN_GROUP_RID_ADMINS,
|
||
DOMAIN_GROUP_RID_USERS
|
||
};
|
||
|
||
static SID_IDENTIFIER_AUTHORITY BultinAuth = SECURITY_NT_AUTHORITY;
|
||
DWORD Sids[sizeof( SID )/sizeof( DWORD ) +
|
||
SID_MAX_SUB_AUTHORITIES ][ sizeof( Rids ) / sizeof( ULONG ) ];
|
||
DWORD DSidSize, *LastSub, i, j;
|
||
PUCHAR SubAuthCnt;
|
||
PWSTR LocalGroupName = NULL;
|
||
WCHAR DomainName[ sizeof( L"BUILTIN" )];
|
||
ULONG Size, DomainSize;
|
||
SID_NAME_USE SNE;
|
||
PWSTR FullServer = NULL;
|
||
|
||
if ( DomainSid == NULL ) {
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
if ( Server && *Server != L'\\' ) {
|
||
|
||
Win32Err = NetApiBufferAllocate( ( wcslen( Server ) + 3 ) * sizeof( WCHAR ),
|
||
(PVOID*)&FullServer );
|
||
|
||
if ( Win32Err == ERROR_SUCCESS ) {
|
||
|
||
swprintf( FullServer, L"\\\\%ws", Server );
|
||
}
|
||
|
||
} else {
|
||
|
||
FullServer = Server;
|
||
}
|
||
|
||
|
||
DSidSize = RtlLengthSid( DomainSid );
|
||
|
||
for ( i = 0 ; i < sizeof(Rids) / sizeof(ULONG) && Win32Err == NERR_Success; i++) {
|
||
|
||
Size = 0;
|
||
DomainSize = sizeof( DomainName );
|
||
|
||
//
|
||
// Get the name of the local group first...
|
||
//
|
||
RtlInitializeSid( ( PSID )Sids[ i ], &BultinAuth, 2 );
|
||
|
||
*( RtlSubAuthoritySid( ( PSID )Sids[ i ], 0 ) ) = SECURITY_BUILTIN_DOMAIN_RID;
|
||
*( RtlSubAuthoritySid( ( PSID )Sids[ i ], 1 ) ) = LocalRids[ i ];
|
||
|
||
LookupAccountSidW( FullServer,
|
||
( PSID )Sids[ i ],
|
||
NULL,
|
||
&Size,
|
||
DomainName,
|
||
&DomainSize,
|
||
&SNE );
|
||
|
||
if ( GetLastError() == ERROR_INSUFFICIENT_BUFFER ) {
|
||
|
||
Win32Err = NetApiBufferAllocate( Size * sizeof( WCHAR ),
|
||
(PVOID*)&LocalGroupName );
|
||
|
||
if ( Win32Err == NERR_Success ) {
|
||
|
||
if ( !LookupAccountSidW( FullServer, ( PSID )Sids[ i ], LocalGroupName,
|
||
&Size, DomainName, &DomainSize, &SNE ) ) {
|
||
|
||
Win32Err = GetLastError();
|
||
|
||
if ( Win32Err == ERROR_NONE_MAPPED ) {
|
||
|
||
Win32Err = NERR_Success;
|
||
continue;
|
||
}
|
||
|
||
} else {
|
||
|
||
LocalGroups[ i ] = LocalGroupName;
|
||
}
|
||
|
||
} else {
|
||
|
||
break;
|
||
}
|
||
}
|
||
|
||
RtlCopyMemory( ( PBYTE )Sids[i], DomainSid, DSidSize );
|
||
|
||
//
|
||
// Now, add the new domain relative rid
|
||
//
|
||
SubAuthCnt = GetSidSubAuthorityCount( ( PSID )Sids[ i ] );
|
||
|
||
( *SubAuthCnt )++;
|
||
|
||
LastSub = GetSidSubAuthority( ( PSID )Sids[ i ], ( *SubAuthCnt ) - 1 );
|
||
|
||
*LastSub = Rids[ i ];
|
||
|
||
|
||
if ( !Delete ) {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_ADD_LOCALGRP, LocalGroups[ i ] ));
|
||
Win32Err = NetLocalGroupAddMember( FullServer,
|
||
LocalGroups[i],
|
||
( PSID )Sids[ i ] );
|
||
|
||
if ( Win32Err == ERROR_MEMBER_IN_ALIAS ) {
|
||
|
||
Win32Err = NERR_Success;
|
||
}
|
||
|
||
} else {
|
||
|
||
LOG_VERBOSE(( MSG_VERBOSE_REMOVE_LOCALGRP, LocalGroups[ i ] ));
|
||
Win32Err = NetLocalGroupDelMember( FullServer,
|
||
LocalGroups[i],
|
||
( PSID )Sids[ i ] );
|
||
|
||
if ( Win32Err == ERROR_MEMBER_NOT_IN_ALIAS ) {
|
||
|
||
Win32Err = NERR_Success;
|
||
}
|
||
}
|
||
}
|
||
|
||
//
|
||
// If something failed, try to restore what was deleted
|
||
//
|
||
if ( Win32Err != NERR_Success ) {
|
||
|
||
for ( j = 0; j < i; j++ ) {
|
||
|
||
if ( !Delete ) {
|
||
|
||
NetLocalGroupAddMember( FullServer,
|
||
LocalGroups[ j ],
|
||
( PSID )Sids[ j ] );
|
||
|
||
} else {
|
||
|
||
NetLocalGroupDelMember( FullServer,
|
||
LocalGroups[ j ],
|
||
( PSID )Sids[ j ] );
|
||
}
|
||
}
|
||
}
|
||
|
||
for ( i = 0; i < sizeof( LocalRids ) / sizeof( ULONG ); i++ ) {
|
||
|
||
if ( LocalGroups[ i ] ) {
|
||
|
||
NetApiBufferFree( LocalGroups[ i ] );
|
||
}
|
||
}
|
||
|
||
if ( FullServer != Server ) {
|
||
|
||
NetApiBufferFree( FullServer );
|
||
}
|
||
|
||
return( Win32Err );
|
||
}
|
||
|
||
DWORD
|
||
NetDompManageMachineSecret(
|
||
IN LSA_HANDLE PolicyHandle,
|
||
IN LPWSTR lpPassword,
|
||
IN INT fControl
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
Create/delete the machine secret
|
||
|
||
|
||
Arguments:
|
||
|
||
PolicyHandle -- Optional open handle to the policy
|
||
lpPassword -- Machine password to use.
|
||
fControl -- create/remove flags
|
||
|
||
Returns:
|
||
|
||
NERR_Success -- Success
|
||
|
||
--*/
|
||
{
|
||
NTSTATUS Status = STATUS_SUCCESS;
|
||
LSA_HANDLE SecretHandle = NULL;
|
||
UNICODE_STRING Key, Data;
|
||
BOOLEAN SecretCreated = FALSE;
|
||
|
||
//
|
||
// open/create the secret
|
||
//
|
||
|
||
RtlInitUnicodeString( &Key, L"$MACHINE.ACC" );
|
||
RtlInitUnicodeString( &Data, lpPassword );
|
||
|
||
Status = LsaOpenSecret(PolicyHandle,
|
||
&Key,
|
||
fControl == NETSETUPP_CREATE ?
|
||
SECRET_SET_VALUE | SECRET_QUERY_VALUE :
|
||
DELETE,
|
||
&SecretHandle );
|
||
|
||
if ( Status == STATUS_OBJECT_NAME_NOT_FOUND )
|
||
{
|
||
if ( fControl == NETSETUPP_DELETE )
|
||
{
|
||
Status = STATUS_SUCCESS;
|
||
}
|
||
else
|
||
{
|
||
Status = LsaCreateSecret( PolicyHandle, &Key,
|
||
SECRET_SET_VALUE, &SecretHandle );
|
||
|
||
if ( NT_SUCCESS( Status ) )
|
||
{
|
||
SecretCreated = TRUE;
|
||
}
|
||
}
|
||
}
|
||
|
||
if ( !NT_SUCCESS( Status ) )
|
||
{
|
||
NetpLog(( "NetpManageMachineSecret: Open/Create secret failed: 0x%lx\n", Status ));
|
||
}
|
||
|
||
if ( NT_SUCCESS( Status ) )
|
||
{
|
||
if ( fControl == NETSETUPP_CREATE )
|
||
{
|
||
#if !defined(USE_LSA_STORE_PRIVATE_DATA)
|
||
//
|
||
// cannot read the current value over the net for NT4 machine,
|
||
// so save the new value as current value
|
||
//
|
||
Status = LsaSetSecret( SecretHandle, &Data, &Data );
|
||
#else
|
||
//
|
||
// LsaStorePrivateData sets the old pw to be the current pw and then
|
||
// stores the new pw as the current.
|
||
//
|
||
Status = LsaStorePrivateData(PolicyHandle, &Key, &Data);
|
||
#endif
|
||
}
|
||
else
|
||
{
|
||
//
|
||
// No secret handle means we failed earlier in
|
||
// some intermediate state. That's ok, just press on.
|
||
//
|
||
if ( SecretHandle != NULL )
|
||
{
|
||
Status = LsaDelete( SecretHandle );
|
||
|
||
if ( NT_SUCCESS( Status ) )
|
||
{
|
||
SecretHandle = NULL;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
if ( SecretHandle )
|
||
{
|
||
LsaClose( SecretHandle );
|
||
}
|
||
|
||
return( RtlNtStatusToDosError( Status ) );
|
||
}
|
||
|
||
|