/*++
Copyright (c) 1998 - 1998 Microsoft Corporation
Module Name:
ldapjoin.c
Abstract:
NetJoin support functions for accessing the DS via LDAP, validating names, and handling LSA
functionality
Author:
Mac McLain (MacM) 27-Jan-1998 Name validation code based on ui\common\lmobj\lmobj code
by ThomasPa
Environment:
User mode only.
Revision History:
--*/
// Netlib uses DsGetDcName AND is linked into netapi32 where DsGetDcName is
// implemented. So define that we aren't importing the API.
#define _DSGETDCAPI_
#include <netsetp.h>
#include <lmaccess.h>
#include <wincrypt.h>
#define WKSTA_NETLOGON
#define NETSETUP_JOIN
#include <confname.h>
#include <winldap.h>
#include <nb30.h>
#include <msgrutil.h>
#include <lmaccess.h>
#include <lmuse.h>
#include <lmwksta.h>
#include <stdio.h>
#include <ntddbrow.h>
#include <netlibnt.h>
#include <ntddnfs.h>
#include <remboot.h>
#include <dns.h>
#include <ntsam.h>
#include <rpc.h>
#include <ntdsapi.h>
#include <netlogon.h>
#include <logonp.h>
#include <wchar.h>
#include <icanon.h> // NetpNameCanonicalize
#include <tstring.h> // STRLEN
#include <autoenr.h> // Autoenrol routine
#include "joinp.h"
#define NETSETUPP_WINLOGON_PATH L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\"
#define NETSETUPP_WINLOGON_CAD L"DisableCAD"
#define NETSETUPP_ALL_FILTER L"(ObjectClass=*)"
#define NETSETUPP_OU_FILTER L"(ObjectClass=OrganizationalUnit)"
#define NETSETUPP_RETURNED_ATTR L"AllowedChildClassesEffective"
#define NETSETUPP_DN_ATTR L"DistinguishedName"
#define NETSETUPP_WELL_KNOWN L"WellKnownObjects"
#define NETSETUPP_COMPUTER_OBJECT L"Computer"
#define NETSETUPP_OBJ_PREFIX L"CN="
#define NETSETUPP_ACCNT_TYPE_ENABLED L"4096"
#define NETSETUPP_ACCNT_TYPE_DISABLED L"4098"
//
// DNS registration removal function prototype
//
typedef DWORD (APIENTRY *DNS_REGISTRATION_REMOVAL_FN) ( VOID );
//
// Locally defined macros
//
#define clearncb(x) memset((char *)x,'\0',sizeof(NCB))
NTSTATUS
NetpGetLsaHandle(
IN LPWSTR lpServer, OPTIONAL
IN LSA_HANDLE PolicyHandle, OPTIONAL
OUT PLSA_HANDLE pPolicyHandle
)
/*++
Routine Description:
Either returns the given LSA handle if it's valid, or opens a new one
Arguments:
lpServer -- server name : NULL == local policy
PolicyHandle -- Potentially open policy handle
pPolicyHandle -- Open policy handle returned here
Returns:
STATUS_SUCCESS -- Success
--*/
{
NTSTATUS Status = STATUS_SUCCESS;
OBJECT_ATTRIBUTES OA;
UNICODE_STRING Server, *pServer = NULL;
if ( PolicyHandle == NULL )
{
if ( lpServer != NULL )
{
RtlInitUnicodeString( &Server, lpServer );
pServer = &Server;
}
//
// Open the local policy
//
InitializeObjectAttributes( &OA, NULL, 0, NULL, NULL );
Status = LsaOpenPolicy( pServer, &OA, MAXIMUM_ALLOWED, pPolicyHandle );
if ( !NT_SUCCESS( Status ) )
{
NetpLog(( "NetpGetLsaHandle: LsaOpenPolicy on %ws failed: 0x%lx\n",
GetStrPtr(lpServer), Status ));
}
}
else
{
*pPolicyHandle = PolicyHandle;
}
return( Status );
}
VOID
NetpSetLsaHandle(
IN LSA_HANDLE PassedHandle,
IN LSA_HANDLE OpenHandle,
OUT PLSA_HANDLE pReturnedHandle
)
/*++
Routine Description:
Either closes the opened handle or returns it
Arguments:
PassedHandle -- Handle passed to the original API call
OpenHandle -- Handle returned from NetpGetLsaHandle
pReturnedHandle -- handle is passed back to the caller if requested
Returns:
VOID
--*/
{
if ( pReturnedHandle == NULL )
{
if ((PassedHandle == NULL) && (OpenHandle != NULL))
{
LsaClose( OpenHandle );
}
}
else
{
*pReturnedHandle = OpenHandle;
}
}
NET_API_STATUS
NET_API_FUNCTION
NetpSetLsaPrimaryDomain(
IN LSA_HANDLE PolicyHandle, OPTIONAL
IN LPWSTR lpDomain,
IN PSID pDomainSid, OPTIONAL
IN PPOLICY_DNS_DOMAIN_INFO pPolicyDns, OPTIONAL
OUT PLSA_HANDLE pPolicyHandle OPTIONAL
)
/*++
Routine Description:
Sets the primary domain in the local LSA policy
Arguments:
PolicyHandle -- Handle to the open policy
lpDomain -- Name of the domain to join
pDomainSid -- Primary domain sid to be set
pPolicyDns -- DNS domain info
pPolicyHandle -- handle returned if non-null
Returns:
NERR_Success -- Success
--*/
{
NTSTATUS Status = STATUS_SUCCESS;
LSA_HANDLE LocalPolicy = NULL;
POLICY_PRIMARY_DOMAIN_INFO PolicyPDI;
Status = NetpGetLsaHandle( NULL, PolicyHandle, &LocalPolicy );
//
// Now, build the primary domain info, and set it
//
if ( NT_SUCCESS( Status ) )
{
RtlInitUnicodeString( &(PolicyPDI.Name), lpDomain );
PolicyPDI.Sid = pDomainSid;
Status = LsaSetInformationPolicy( LocalPolicy,
PolicyPrimaryDomainInformation,
( PVOID )&PolicyPDI );
if ( NT_SUCCESS( Status ) && pPolicyDns )
{
Status = LsaSetInformationPolicy( LocalPolicy,
PolicyDnsDomainInformation,
( PVOID )pPolicyDns );
}
}
NetpSetLsaHandle( PolicyHandle, LocalPolicy, pPolicyHandle );
NetpLog(( "NetpSetLsaPrimaryDomain: for '%ws' status: 0x%lx\n", GetStrPtr(lpDomain), Status ));
return( RtlNtStatusToDosError( Status ) );
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetLsaPrimaryDomain(
IN LSA_HANDLE PolicyHandle, OPTIONAL
IN LPWSTR lpServer, OPTIONAL
OUT PPOLICY_PRIMARY_DOMAIN_INFO *ppPolicyPDI,
OUT PPOLICY_DNS_DOMAIN_INFO *ppPolicyDns,
OUT PLSA_HANDLE pPolicyHandle OPTIONAL
)
/*++
Routine Description:
Gets the primary domain info in the local LSA policy
Arguments:
PolicyHandle -- Handle to the open policy. If NULL, a new handle is
opened.
lpServer -- Optional server name on which to read the policy
ppPolicyPDI -- Primary domain policy returned here
ppPolicyDNS -- Dns domain information is returned here if it exists
pPolicyHandle -- Optional. Policy handle returned here if not null
Returns:
NERR_Success -- Success
--*/
{
NTSTATUS Status = STATUS_SUCCESS;
LSA_HANDLE LocalPolicy = NULL;
UNICODE_STRING Server, *pServer = NULL;
//
// Initialization
//
*ppPolicyPDI = NULL;
*ppPolicyDns = NULL;
if ( lpServer != NULL )
{
RtlInitUnicodeString( &Server, lpServer );
pServer = &Server;
}
Status = NetpGetLsaHandle( lpServer, PolicyHandle, &LocalPolicy );
//
// Now, get the primary domain info
//
if ( NT_SUCCESS( Status ) )
{
Status = LsaQueryInformationPolicy( LocalPolicy,
PolicyDnsDomainInformation,
( PVOID * )ppPolicyDns );
if ( Status == RPC_NT_PROCNUM_OUT_OF_RANGE )
{
Status = STATUS_SUCCESS;
*ppPolicyDns = NULL;
}
if ( NT_SUCCESS( Status ) )
{
Status = LsaQueryInformationPolicy( LocalPolicy,
PolicyPrimaryDomainInformation,
(PVOID *)ppPolicyPDI);
if ( !NT_SUCCESS( Status ) && (*ppPolicyDns) != NULL )
{
LsaFreeMemory( *ppPolicyDns );
*ppPolicyDns = NULL;
}
}
}
NetpSetLsaHandle( PolicyHandle, LocalPolicy, pPolicyHandle );
NetpLog(( "NetpGetLsaPrimaryDomain: status: 0x%lx\n", Status ));
return( RtlNtStatusToDosError( Status ) );
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetLsaDcRole(
IN LPWSTR lpMachine,
OUT BOOL *pfIsDC
)
/*++
Routine Description:
Gets the role of the DC in the domain
Arguments:
lpMachine -- Machine to connect to
pfIsDC -- If TRUE, this is a DC.
Returns:
NERR_Success -- Success
--*/
{
NTSTATUS Status = STATUS_SUCCESS;
PBYTE pBuff;
LSA_HANDLE hPolicy;
Status = NetpGetLsaHandle( lpMachine, NULL, &hPolicy );
//
// Now, get the server role info
//
if ( NT_SUCCESS( Status ) ) {
Status = LsaQueryInformationPolicy( hPolicy,
PolicyLsaServerRoleInformation,
&pBuff);
if ( *(PPOLICY_LSA_SERVER_ROLE)pBuff == PolicyServerRoleBackup ||
*(PPOLICY_LSA_SERVER_ROLE)pBuff == PolicyServerRolePrimary ) {
*pfIsDC = TRUE;
} else {
*pfIsDC = FALSE;
}
LsaFreeMemory( pBuff );
LsaClose( hPolicy );
}
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "NetpGetLsaDcRole failed with 0x%lx\n", Status ));
}
return( RtlNtStatusToDosError( Status ) );
}
NTSTATUS
NetpLsaOpenSecret(
IN LSA_HANDLE hLsa,
IN PUNICODE_STRING pusSecretName,
IN ACCESS_MASK DesiredAccess,
OUT PLSA_HANDLE phSecret
)
/*++
Routine Description:
Open the specified LSA secret as self.
LsaQuerySecret fails for a network client whent the client is not
trusted (see lsa\server\dbsecret.c). This causes remote join
operation to fail. To get around this, this function temporarily
un-impersonates, opens the secrets and impersonates again.
Thus the open secret occurrs in LocalSystem context.
$ REVIEW kumarp 15-July-1999
This is obviously not a good design. This should be changed post NT5.
Arguments:
same as those for LsaOpenSecret
Returns:
NTSTATUS, see help for LsaOpenSecret
--*/
{
NTSTATUS Status = STATUS_UNSUCCESSFUL;
HANDLE hToken=NULL;
__try
{
if (OpenThreadToken(GetCurrentThread(), TOKEN_IMPERSONATE,
TRUE, &hToken))
{
if (SetThreadToken(NULL, NULL))
{
Status = LsaOpenSecret(hLsa, pusSecretName,
DesiredAccess, phSecret);
}
}
}
__finally
{
if (hToken)
{
SetThreadToken(NULL, hToken);
}
}
NetpLog(( "NetpLsaOpenSecret: status: 0x%lx\n", Status ));
return Status;
}
//$ REVIEW kumarp 13-May-1999
// the fDelete param is used as uint but is declared as BOOL
NET_API_STATUS
NET_API_FUNCTION
NetpManageMachineSecret(
IN LSA_HANDLE PolicyHandle, OPTIONAL
IN LPWSTR lpMachine,
IN LPWSTR lpPassword,
IN BOOL fDelete,
IN BOOL UseDefaultForOldPwd,
OUT PLSA_HANDLE pPolicyHandle OPTIONAL
)
/*++
Routine Description:
Create/delete the machine secret
Arguments:
PolicyHandle -- Optional open handle to the policy
lpMachine -- Machine to add/delete the secret for
lpPassword -- Machine password to use.
fDelete -- if TRUE, the secret is removed
UseDefaultForOldPwd - if TRUE, the default password should be set
for the old password value. Used only if
secret is created.
pPolicyHandle -- If present, the opened policy handle is returned here
Returns:
NERR_Success -- Success
--*/
{
NTSTATUS Status = STATUS_SUCCESS;
LSA_HANDLE LocalPolicy = NULL, SecretHandle = NULL;
UNICODE_STRING Key, Data, *CurrentValue = NULL;
BOOLEAN SecretCreated = FALSE;
WCHAR MachinePasswordBuffer[PWLEN + 1];
UNICODE_STRING MachinePassword;
BOOLEAN FreeCurrentValue = FALSE;
if( fDelete == FALSE )
{
ASSERT( lpPassword );
}
Status = NetpGetLsaHandle( NULL, PolicyHandle, &LocalPolicy );
//
// open/create the secret
//
if ( NT_SUCCESS( Status ) )
{
RtlInitUnicodeString( &Key, L"$MACHINE.ACC" );
RtlInitUnicodeString( &Data, lpPassword );
Status = NetpLsaOpenSecret( LocalPolicy, &Key,
fDelete == NETSETUPP_CREATE ?
SECRET_SET_VALUE | SECRET_QUERY_VALUE : DELETE,
&SecretHandle );
if ( Status == STATUS_OBJECT_NAME_NOT_FOUND )
{
if ( fDelete )
{
Status = STATUS_SUCCESS;
}
else
{
Status = LsaCreateSecret( LocalPolicy, &Key,
SECRET_SET_VALUE, &SecretHandle );
if ( NT_SUCCESS( Status ) )
{
SecretCreated = TRUE;
}
}
}
if ( !NT_SUCCESS( Status ) )
{
NetpLog(( "NetpManageMachineSecret: Open/Create secret failed: 0x%lx\n", Status ));
}
if ( NT_SUCCESS( Status ) )
{
if ( fDelete == NETSETUPP_CREATE )
{
//
// First, read the current value, so we can save it as the old value
//
if ( !UseDefaultForOldPwd ) {
if ( SecretCreated )
{
CurrentValue = &Data;
}
else
{
Status = LsaQuerySecret( SecretHandle, &CurrentValue,
NULL, NULL, NULL );
FreeCurrentValue = TRUE;
}
//
// If we are to use the default value for old password,
// generate the default value
//
} else {
NetpGenerateDefaultPassword(lpMachine, MachinePasswordBuffer);
RtlInitUnicodeString( &MachinePassword, MachinePasswordBuffer );
CurrentValue = &MachinePassword;
}
if ( NT_SUCCESS( Status ) )
{
//
// Now, store both the new password and the old
//
Status = LsaSetSecret( SecretHandle, &Data, CurrentValue );
if ( FreeCurrentValue )
{
LsaFreeMemory( CurrentValue );
}
}
}
else
{
//
// No secret handle means we failed earlier in
// some intermediate state. That's ok, just press on.
//
if ( SecretHandle != NULL )
{
Status = LsaDelete( SecretHandle );
if ( NT_SUCCESS( Status ) )
{
SecretHandle = NULL;
}
}
}
}
if ( SecretHandle )
{
LsaClose( SecretHandle );
}
}
NetpSetLsaHandle( PolicyHandle, LocalPolicy, pPolicyHandle );
if ( !NT_SUCCESS( Status ) )
{
NetpLog(( "NetpManageMachineSecret: '%s' operation failed: 0x%lx\n",
fDelete == NETSETUPP_CREATE ? "CREATE" : "DELETE", Status ));
}
return( RtlNtStatusToDosError( Status ) );
}
NET_API_STATUS
NET_API_FUNCTION
NetpReadCurrentSecret(
IN LSA_HANDLE PolicyHandle, OPTIONAL
OUT LPWSTR *lpCurrentSecret,
OUT PLSA_HANDLE pPolicyHandle OPTIONAL
)
/*++
Routine Description:
Reads the value of the current secret
Arguments:
PolicyHandle -- Optional open handle to the policy
lpCurrentSecret -- Where the current secret is returned
pPolicyHandle -- If present, the opened policy handle is returned here
Returns:
NERR_Success -- Success
--*/
{
NTSTATUS Status = STATUS_SUCCESS;
LSA_HANDLE LocalPolicy = NULL, SecretHandle;
UNICODE_STRING Secret, *Data;
Status = NetpGetLsaHandle( NULL, PolicyHandle, &LocalPolicy );
//
// Now, read the secret
//
if ( NT_SUCCESS( Status ) ) {
RtlInitUnicodeString( &Secret, L"$MACHINE.ACC" );
// Status = LsaRetrievePrivateData( LocalPolicy, &Key, &Data );
Status = NetpLsaOpenSecret( LocalPolicy,
&Secret,
SECRET_QUERY_VALUE,
&SecretHandle );
if ( NT_SUCCESS(Status) ) {
Status = LsaQuerySecret( SecretHandle,
&Data,
NULL,
NULL,
NULL );
LsaClose( SecretHandle );
}
if ( NT_SUCCESS( Status ) ) {
if( NetApiBufferAllocate( Data->Length + sizeof( WCHAR ),
( PBYTE * )lpCurrentSecret ) != NERR_Success ) {
Status = STATUS_INSUFFICIENT_RESOURCES;
} else {
RtlCopyMemory( ( PVOID )*lpCurrentSecret,
Data->Buffer,
Data->Length );
( *lpCurrentSecret )[ Data->Length / sizeof( WCHAR ) ] = UNICODE_NULL;
}
}
}
NetpSetLsaHandle( PolicyHandle, LocalPolicy, pPolicyHandle );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "NetpReadCurrentSecret: failed: 0x%lx\n", Status ));
}
return( RtlNtStatusToDosError( Status ) );
}
NET_API_STATUS
NET_API_FUNCTION
NetpSetNetlogonDomainCache(
IN LPWSTR lpDc
)
/*++
Routine Description:
Initializes NetLogons trusted domain cache, using the trusted
domain list on the DC.
Arguments:
lpDc -- Name of a DC in the domain
The caller should already have an valid connection to IPC$
Returns:
NERR_Success -- Success
--*/
{
DWORD dwErr = ERROR_SUCCESS;
PDS_DOMAIN_TRUSTSW TrustedDomains=NULL;
ULONG TrustedDomainCount=0;
//
// Get the trusted domain list from the DC.
//
dwErr = DsEnumerateDomainTrustsW( lpDc, DS_DOMAIN_VALID_FLAGS,
&TrustedDomains, &TrustedDomainCount );
//
// If the server does not support returning all trust types
// (i.e. the server is an NT4 machine) ask for only those
// which it can return.
//
if ( dwErr == ERROR_NOT_SUPPORTED )
{
dwErr = DsEnumerateDomainTrustsW(
lpDc,
DS_DOMAIN_PRIMARY | DS_DOMAIN_DIRECT_OUTBOUND,
&TrustedDomains,
&TrustedDomainCount );
if ( dwErr == ERROR_NOT_SUPPORTED )
{
//
// looks like the DC is running NT3.51. In this case, we do not want
// to fail the join operation because we could not write
// the netlogon cache. reset the error code.
//
// see bug "359684 Win2k workstation unable to join NT3.51Domain"
//
NetpLog(( "NetpSetNetlogonDomainCache: DsEnumerateDomainTrustsW failed with ERROR_NOT_SUPPORTED, this looks like a NT3.51 DC. The failure was ignored. dc list not written to netlogon cache.\n"));
dwErr = ERROR_SUCCESS;
}
}
if ( ( dwErr == NO_ERROR ) && TrustedDomainCount )
{
//
// Write the trusted domain list to a file where netlogon will find it.
//
dwErr = NlWriteFileForestTrustList (
NL_FOREST_BINARY_LOG_FILE_JOIN,
TrustedDomains,
TrustedDomainCount );
}
else
{
NetpLog(( "NetpSetNetlogonDomainCache: NlWriteFileForestTrustList failed: 0x%lx\n", dwErr ));
}
//
// Disable the no Ctrl-Alt-Del from the winlogon side of things
//
if ( dwErr == ERROR_SUCCESS ) {
HKEY hWinlogon;
dwErr = RegOpenKey( HKEY_LOCAL_MACHINE,
NETSETUPP_WINLOGON_PATH, &hWinlogon );
if ( dwErr == ERROR_SUCCESS ) {
DWORD Value;
Value = 0;
dwErr = RegSetValueEx( hWinlogon, NETSETUPP_WINLOGON_CAD, 0,
REG_DWORD, (PBYTE)&Value, sizeof( ULONG ) );
RegCloseKey( hWinlogon );
}
//
// Failing to set this never causes failure
//
if ( dwErr != ERROR_SUCCESS ) {
NetpLog(( "Setting Winlogon DisableCAD failed with %lu\n", dwErr ));
dwErr = ERROR_SUCCESS;
}
}
//
// Free locally used resources
//
if ( TrustedDomains != NULL ) {
NetApiBufferFree( TrustedDomains );
}
return dwErr;
}
/*++
Routine Description:
Is this a terminal-server-application-server?
Arguments:
Args - none
Return Value:
TRUE or FALSE
--*/
BOOL IsAppServer(void)
{
OSVERSIONINFOEX osVersionInfo;
DWORDLONG dwlConditionMask = 0;
BOOL fIsWTS;
osVersionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
fIsWTS = GetVersionEx((OSVERSIONINFO *)&osVersionInfo) &&
(osVersionInfo.wSuiteMask & VER_SUITE_TERMINAL) &&
!(osVersionInfo.wSuiteMask & VER_SUITE_SINGLEUSERTS);
return fIsWTS;
}
NET_API_STATUS
NET_API_FUNCTION
NetpManageLocalGroups(
IN PSID pDomainSid,
IN BOOL fDelete
)
/*++
Routine Description:
Performs SAM account handling to either add or remove the DomainAdmins,
etc groups from the local groups.
Arguments:
pDomainSid -- SID of the domain being joined/left
fDelete -- Whether to add or remove the admin alias
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
//
// Keep these in synch with the rids and Sids below
//
ULONG LocalRids[] =
{
DOMAIN_ALIAS_RID_ADMINS,
DOMAIN_ALIAS_RID_USERS,
DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS // this LAST item is only used on TS-App-Servers
};
PWSTR ppwszLocalGroups[ sizeof( LocalRids ) / sizeof( ULONG )] =
{
NULL,
NULL,
NULL
};
ULONG Rids[] =
{
DOMAIN_GROUP_RID_ADMINS,
DOMAIN_GROUP_RID_USERS,
DOMAIN_GROUP_RID_USERS // this LAST item is only used on TS-App-Servers
};
BOOLEAN GroupMustExist[ sizeof( LocalRids ) / sizeof( ULONG )] =
{
TRUE,
TRUE,
TRUE,
};
static SID_IDENTIFIER_AUTHORITY BultinAuth = SECURITY_NT_AUTHORITY;
DWORD Sids[sizeof( SID )/sizeof( DWORD ) + SID_MAX_SUB_AUTHORITIES][sizeof(Rids) / sizeof(ULONG)];
DWORD cDSidSize, *pLastSub, i, j;
PUCHAR pSubAuthCnt;
PWSTR LocalGroupName = NULL;
PWCHAR DomainName = NULL;
ULONG Size, DomainSize;
SID_NAME_USE SNE;
ULONG numOfGroups;
cDSidSize = RtlLengthSid( pDomainSid );
// number of groups to process
numOfGroups = sizeof(Rids) / sizeof(ULONG);
// if we are NOT on an app server, we ignore the last entry
if ( ! IsAppServer() )
{
numOfGroups -= 1;
}
for ( i = 0 ; i < numOfGroups && NetStatus == NERR_Success; i++)
{
Size = 0;
DomainSize = 0;
if ( DomainName != NULL ) {
NetApiBufferFree( DomainName );
DomainName = NULL;
}
//
// Get the name of the local group first...
//
RtlInitializeSid( ( PSID )Sids[ i ], &BultinAuth, 2 );
*(RtlSubAuthoritySid(( PSID )Sids[ i ], 0)) = SECURITY_BUILTIN_DOMAIN_RID;
*(RtlSubAuthoritySid(( PSID )Sids[ i ], 1)) = LocalRids[ i ];
LookupAccountSidW( NULL, ( PSID )Sids[ i ], NULL, &Size,
DomainName, &DomainSize, &SNE );
if ( GetLastError() == ERROR_INSUFFICIENT_BUFFER )
{
NetStatus = NetApiBufferAllocate( Size * sizeof(WCHAR),
&LocalGroupName );
if ( NetStatus == NERR_Success ) {
NetStatus = NetApiBufferAllocate( DomainSize * sizeof(WCHAR),
&DomainName );
}
if ( NetStatus == NERR_Success )
{
if ( !LookupAccountSid( NULL, ( PSID )Sids[ i ], LocalGroupName,
&Size, DomainName, &DomainSize, &SNE ) )
{
NetStatus = GetLastError();
if ( NetStatus == ERROR_NONE_MAPPED && GroupMustExist[ i ] == FALSE )
{
NetStatus = NERR_Success;
continue;
}
else
{
#ifdef NETSETUP_VERBOSE_LOGGING
UNICODE_STRING DisplaySid;
NTSTATUS Status2;
RtlZeroMemory( &DisplaySid, sizeof( UNICODE_STRING ) );
Status2 = RtlConvertSidToUnicodeString( &DisplaySid,
( PSID )Sids[ i ], TRUE );
if ( NT_SUCCESS( Status2 ) )
{
NetpLog(( "LookupAccounSid on %wZ failed with %lu\n",
&DisplaySid,
NetStatus ));
RtlFreeUnicodeString(&DisplaySid);
}
else
{
NetpLog(( "LookupAccounSid on <undisplayable sid> "
"[Rid 0x%lx] failed with %lu\n",
NetStatus ));
}
#endif
}
}
else
{
ppwszLocalGroups[ i ] = LocalGroupName;
}
}
else
{
break;
}
}
RtlCopyMemory( (PBYTE)Sids[i], pDomainSid, cDSidSize );
//
// Now, add the new domain relative rid
//
pSubAuthCnt = GetSidSubAuthorityCount( (PSID)Sids[i] );
(*pSubAuthCnt)++;
pLastSub = GetSidSubAuthority( (PSID)Sids[i], (*pSubAuthCnt) - 1 );
*pLastSub = Rids[i];
if ( fDelete == NETSETUPP_CREATE)
{
NetStatus = NetLocalGroupAddMember( NULL,
ppwszLocalGroups[i],
(PSID)Sids[i] );
if ( NetStatus == ERROR_MEMBER_IN_ALIAS )
{
NetStatus = NERR_Success;
}
}
else
{
NetStatus = NetLocalGroupDelMember( NULL,
ppwszLocalGroups[i],
(PSID)Sids[i] );
if ( NetStatus == ERROR_MEMBER_NOT_IN_ALIAS )
{
NetStatus = NERR_Success;
}
}
}
//
// If something failed, try to restore what was deleted
//
if ( NetStatus != NERR_Success )
{
for ( j = 0; j < i; j++ ) {
if ( fDelete == NETSETUPP_DELETE)
{
NetLocalGroupAddMember( NULL,
ppwszLocalGroups[j],
(PSID)Sids[j] );
}
else
{
NetLocalGroupDelMember( NULL,
ppwszLocalGroups[j],
(PSID)Sids[j] );
}
}
}
if ( DomainName != NULL ) {
NetApiBufferFree( DomainName );
}
for ( i = 0; i < numOfGroups ; i++ )
{
if ( ppwszLocalGroups[ i ] )
{
NetApiBufferFree( ppwszLocalGroups[ i ] );
}
}
if ( NetStatus != NERR_Success )
{
NetpLog(( "NetpManageLocalGroups failed with %lu\n", NetStatus ));
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpHandleJoinedStateInfo(
IN LSA_HANDLE PolicyHandle, OPTIONAL
IN PNETSETUP_SAVED_JOIN_STATE SavedState,
IN BOOLEAN Save,
OUT PLSA_HANDLE ReturnedPolicyHandle OPTIONAL
)
/*++
Routine Description:
Saves or restores the join state info.
Arguments:
PolicyHandle -- Local LSA policy handle.
If not supplied, this fn. opens it
SavedState -- join state info
This includes:
- machine account secret value
- primary domain info
- dns domain info
Save -- TRUE == save state, FALSE == restore state
ReturnedPolicyHandle -- local LSA handle returned in this
Returns:
NERR_Success -- Success
--*/
{
NTSTATUS Status = STATUS_SUCCESS;
LSA_HANDLE LocalPolicy = NULL, SecretHandle;
UNICODE_STRING Secret;
if ( Save )
{
RtlZeroMemory( SavedState, sizeof( NETSETUP_SAVED_JOIN_STATE ) );
}
//
// get handle to local LSA policy
//
Status = NetpGetLsaHandle( NULL, PolicyHandle, &LocalPolicy );
if ( NT_SUCCESS( Status ) )
{
//
// First, read the machine account secret
//
RtlInitUnicodeString( &Secret, L"$MACHINE.ACC" );
Status = NetpLsaOpenSecret( LocalPolicy,
&Secret,
SECRET_QUERY_VALUE | SECRET_SET_VALUE,
&SecretHandle );
if ( NT_SUCCESS( Status ) )
{
if ( Save )
{
SavedState->MachineSecret = TRUE;
Status = LsaQuerySecret( SecretHandle,
&( SavedState->CurrentValue ),
NULL,
&( SavedState->PreviousValue ),
NULL );
}
else
{
if ( SavedState ->MachineSecret )
{
Status = LsaSetSecret( SecretHandle,
SavedState->CurrentValue,
SavedState->PreviousValue );
}
}
LsaClose( SecretHandle );
}
//
// If machine secret is not present, it is not an error.
//
if ( Status == STATUS_OBJECT_NAME_NOT_FOUND )
{
if ( Save )
{
SavedState->MachineSecret = FALSE;
}
Status = STATUS_SUCCESS;
}
//
// Now, save/restore the policy information
//
if ( NT_SUCCESS( Status ) )
{
if ( Save )
{
Status = NetpGetLsaPrimaryDomain( LocalPolicy, NULL,
&( SavedState->PrimaryDomainInfo ),
&( SavedState->DnsDomainInfo ),
NULL );
}
else
{
Status = LsaSetInformationPolicy( LocalPolicy,
PolicyPrimaryDomainInformation,
SavedState->PrimaryDomainInfo );
if ( NT_SUCCESS( Status ) )
{
Status = LsaSetInformationPolicy( LocalPolicy,
PolicyDnsDomainInformation,
SavedState->DnsDomainInfo );
}
}
}
}
NetpSetLsaHandle( PolicyHandle, LocalPolicy, ReturnedPolicyHandle );
if ( !NT_SUCCESS( Status ) )
{
NetpLog((
"NetpHandleJoinedStateInfo: '%s' operation failed: 0x%lx\n",
Save ? "Save" : "Restore", Status ));
}
return( RtlNtStatusToDosError( Status ) );
}
NET_API_STATUS
MsgFmtNcbName(
OUT PCHAR DestBuf,
IN LPTSTR Name,
IN DWORD Type)
/*++
Routine Description:
FmtNcbName - format a name NCB-style
Given a name, a name type, and a destination address, this
function copies the name and the type to the destination in
the format used in the name fields of a Network Control
Block.
SIDE EFFECTS
Modifies 16 bytes starting at the destination address.
Arguments:
DestBuf - Pointer to the destination buffer.
Name - Unicode NUL-terminated name string
Type - Name type number (0, 3, 5, or 32) (3=NON_FWD, 5=FWD)
Return Value:
NERR_Success - The operation was successful
Translated Return Code from the Rtl Translate routine.
--*/
{
DWORD i; // Counter
NTSTATUS ntStatus;
NET_API_STATUS status;
OEM_STRING ansiString;
UNICODE_STRING unicodeString;
PCHAR pAnsiString;
//
// Force the name to be upper case.
//
status = NetpNameCanonicalize(
NULL,
Name,
Name,
STRSIZE(Name),
NAMETYPE_MESSAGEDEST,
0);
if (status != NERR_Success) {
return(status);
}
//
// Convert the unicode name string into an ansi string - using the
// current locale.
//
#ifdef UNICODE
unicodeString.Length = (USHORT)(STRLEN(Name)*sizeof(WCHAR));
unicodeString.MaximumLength = (USHORT)((STRLEN(Name)+1) * sizeof(WCHAR));
unicodeString.Buffer = Name;
ntStatus = RtlUnicodeStringToOemString(
&ansiString,
&unicodeString,
TRUE); // Allocate the ansiString Buffer.
if (!NT_SUCCESS(ntStatus))
{
NetpLog(( "FmtNcbName: RtlUnicodeStringToOemString failed 0x%lx\n",
ntStatus ));
return NetpNtStatusToApiStatus(ntStatus);
}
pAnsiString = ansiString.Buffer;
*(pAnsiString+ansiString.Length) = '\0';
#else
UNUSED(ntStatus);
UNUSED(unicodeString);
UNUSED(ansiString);
pAnsiString = Name;
#endif // UNICODE
//
// copy each character until a NUL is reached, or until NCBNAMSZ-1
// characters have been copied.
//
for (i=0; i < NCBNAMSZ - 1; ++i) {
if (*pAnsiString == '\0') {
break;
}
//
// Copy the Name
//
*DestBuf++ = *pAnsiString++;
}
//
// Free the buffer that RtlUnicodeStringToOemString created for us.
// NOTE: only the ansiString.Buffer portion is free'd.
//
#ifdef UNICODE
RtlFreeOemString( &ansiString);
#endif // UNICODE
//
// Pad the name field with spaces
//
for(; i < NCBNAMSZ - 1; ++i) {
*DestBuf++ = ' ';
}
//
// Set the name type.
//
NetpAssert( Type!=5 ); // 5 is not valid for NT.
*DestBuf = (CHAR) Type; // Set name type
return(NERR_Success);
}
NET_API_STATUS
NET_API_FUNCTION
NetpCheckNetBiosNameNotInUse(
IN LPWSTR pszName,
IN BOOLEAN MachineName,
IN BOOLEAN Unique
)
{
NCB ncb;
LANA_ENUM lanaBuffer;
unsigned char i;
unsigned char nbStatus;
NET_API_STATUS NetStatus = NERR_Success;
WCHAR szMachineNameBuf[MAX_COMPUTERNAME_LENGTH + 1];
LPWSTR szMachineName=szMachineNameBuf;
//
// Find the number of networks by sending an enum request via Netbios.
//
clearncb(&ncb);
ncb.ncb_command = NCBENUM; // Enumerate LANA nums (wait)
ncb.ncb_buffer = (PUCHAR)&lanaBuffer;
ncb.ncb_length = sizeof(LANA_ENUM);
nbStatus = Netbios (&ncb);
if (nbStatus != NRC_GOODRET)
{
NetStatus = NetpNetBiosStatusToApiStatus( nbStatus );
goto Cleanup;
}
clearncb(&ncb);
NetStatus = MsgFmtNcbName( (char *)ncb.ncb_name, pszName,
MachineName ? 0 : 0x1c );
if ( NetStatus != NERR_Success )
{
goto Cleanup;
}
//
// Move the Adapter Numbers (lana) into the array that will contain them.
//
for ( i = 0; i < lanaBuffer.length && NetStatus == NERR_Success; i++ )
{
NetpNetBiosReset( lanaBuffer.lana[i] );
if ( Unique )
{
ncb.ncb_command = NCBADDNAME;
}
else
{
ncb.ncb_command = NCBADDGRNAME;
}
ncb.ncb_lana_num = lanaBuffer.lana[i];
nbStatus = Netbios( &ncb );
switch ( nbStatus )
{
case NRC_DUPNAME:
// NRC_DUPNAME ==
// "A duplicate name existed in the local name table"
//
// In this case, we need to check if the name being checked
// is the same as the local computer name. If so,
// the name is expected to be in the local table therefore
// we convert this errcode to a success code
//
NetStatus = NetpGetComputerNameAllocIfReqd(
&szMachineName, MAX_COMPUTERNAME_LENGTH+1);
if (NetStatus == NERR_Success)
{
if (!_wcsicmp(szMachineName, pszName))
{
NetStatus = NERR_Success;
}
else
{
NetStatus = ERROR_DUP_NAME;
}
}
break;
case NRC_INUSE:
NetStatus = ERROR_DUP_NAME;
break;
case NRC_GOODRET:
// Delete the name
ncb.ncb_command = NCBDELNAME;
ncb.ncb_lana_num = lanaBuffer.lana[i];
// Not much we can do if this fails.
Netbios( &ncb );
// fall through
default:
NetStatus = NetpNetBiosStatusToApiStatus( nbStatus );
break;
}
}
Cleanup:
if ( NetStatus != NERR_Success )
{
NetpLog(( "NetpCheckNetBiosNameNotInUse: for '%ws' returned: 0x%lx\n",
pszName, NetStatus ));
}
if (szMachineName != szMachineNameBuf)
{
NetApiBufferFree(szMachineName);
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpIsValidDomainName(
IN LPWSTR lpName,
IN LPWSTR lpServer,
IN LPWSTR lpAccount,
IN LPWSTR lpPassword
)
/*++
Routine Description:
Determines if a name is a DC name or not. Copied from
ui\net\common\src\lmboj\lmobj\lmodom.cxx
Arguments:
lpName -- Name to check
lpServer -- Name of a server within that domain
Returns:
NERR_Success -- Success
ERROR_DUP_NAME -- The domain name is in use
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
PWKSTA_INFO_100 pWKI100 = NULL;
BOOL fIsDC;
POLICY_LSA_SERVER_ROLE Role;
NetStatus = NetpManageIPCConnect( lpServer, lpAccount,
lpPassword,
NETSETUPP_CONNECT_IPC | NETSETUPP_NULL_SESSION_IPC );
if ( NetStatus == NERR_Success ) {
//
// Now, get the info from the server
//
NetStatus = NetWkstaGetInfo( lpServer, 100, (LPBYTE *)&pWKI100 );
if ( NetStatus == NERR_Success ) {
if (_wcsicmp( lpName, pWKI100->wki100_langroup ) == 0 ) {
//
// Ok, it's a match... Determine the domain role.
//
NetStatus = NetpGetLsaDcRole( lpServer, &fIsDC );
if ( ( NetStatus == NERR_Success ) && ( fIsDC == FALSE ) )
{
NetStatus = NERR_DCNotFound;
}
}
}
NetpManageIPCConnect( lpServer, lpAccount,
lpPassword, NETSETUPP_DISCONNECT_IPC );
}
if ( NetStatus != NERR_Success ) {
NetpLog((
"NetpIsValidDomainName for %ws returned 0x%lx\n",
lpName, NetStatus ));
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpCheckDomainNameIsValid(
IN LPWSTR lpName,
IN LPWSTR lpAccount,
IN LPWSTR lpPassword,
IN BOOL fShouldExist
)
/*++
Routine Description:
Checks to see if the given name is in use by a domain
Arguments:
lpName -- Name to check
Returns:
NERR_Success -- The domain is found and valid
ERROR_NO_SUCH_DOMAIN -- Domain name not found
--*/
{
NET_API_STATUS NetStatus;
PBYTE pbDC;
DWORD cDCs, i, j;
PUNICODE_STRING pDCList;
LPWSTR pwszDomain;
#if(_WIN32_WINNT >= 0x0500)
PDOMAIN_CONTROLLER_INFO pDCInfo = NULL;
#else
PBYTE pDCInfo = NULL;
#endif
UNREFERENCED_PARAMETER( lpAccount );
UNREFERENCED_PARAMETER( lpPassword );
//
// Start with NetGetAnyDCName
//
#if(_WIN32_WINNT >= 0x0500)
NetStatus = DsGetDcName( NULL, lpName, NULL, NULL,
DS_FORCE_REDISCOVERY, &pDCInfo );
#else
NetStatus = NetGetAnyDCName( NULL,
( LPCWSTR )lpName,
&pDCInfo );
#endif
if ( NetStatus != NERR_Success ) {
if ( NetStatus == ERROR_NO_SUCH_USER ) {
NetStatus = NERR_Success;
}
} else {
NetApiBufferFree( pDCInfo );
}
//
// Map our error codes so we only return success if we validated the
// domain name
//
if ( fShouldExist ) {
if ( NetStatus == NERR_Success || NetStatus == ERROR_NO_LOGON_SERVERS ) {
NetStatus = NERR_Success;
} else {
NetStatus = ERROR_NO_SUCH_DOMAIN;
}
} else {
if ( NetStatus == NERR_Success || NetStatus == ERROR_NO_LOGON_SERVERS ) {
NetStatus = ERROR_DUP_NAME;
} else if ( NetStatus == NERR_DCNotFound || NetStatus == ERROR_NO_SUCH_DOMAIN ) {
NetStatus = NERR_Success;
}
}
if ( NetStatus != NERR_Success ) {
NetpLog(( "NetpCheckDomainNameIsValid for %ws returned 0x%lx\n",
lpName, NetStatus ));
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpManageIPCConnect(
IN LPWSTR lpServer,
IN LPWSTR lpAccount,
IN LPWSTR lpPassword,
IN ULONG fOptions
)
/*++
Routine Description:
Manages the connections to the servers IPC share
Arguments:
lpServer -- Server to connect to
lpAccount -- Account to use
lpPassword -- Password to use. The password has been NOT been encoded
fOptions -- Flags to determine operation/connect/disconnect
Returns:
NERR_Success -- The domain is found and valid
--*/
{
NET_API_STATUS NetStatus;
#if(_WIN32_WINNT >= 0x0500)
WCHAR wszPath[2 + DNS_MAX_NAME_LENGTH + 1 + NNLEN + 1];
#else
WCHAR wszPath[2 + 256 + 1 + NNLEN + 1];
#endif
PWSTR pwszPath = wszPath;
USE_INFO_2 NetUI2;
PWSTR pwszUser, pwszDomain, pwszReset;
DWORD BadParm = 0;
DWORD ForceLevel = USE_NOFORCE;
//
// Build the path...
//
if (*lpServer != L'\\') {
wcscpy(wszPath, L"\\\\");
pwszPath += 2;
}
if ( FLAG_ON( fOptions, NETSETUPP_USE_LOTS_FORCE ) )
{
ASSERT( FLAG_ON(fOptions, NETSETUPP_DISCONNECT_IPC ) );
ForceLevel = USE_LOTS_OF_FORCE;
}
swprintf( pwszPath, L"%ws\\IPC$", lpServer );
pwszPath = wszPath;
if ( FLAG_ON( fOptions, NETSETUPP_DISCONNECT_IPC ) )
{
NetStatus = NetUseDel( NULL, pwszPath, ForceLevel );
if ( NetStatus != NERR_Success )
{
NetpKdPrint(( PREFIX_NETJOIN "NetUseDel on %ws failed with %d\n", pwszPath, NetStatus ));
NetpLog(( "NetUseDel on %ws failed with %d\n", pwszPath, NetStatus ));
if ( (NetStatus != NERR_UseNotFound)
&& (ForceLevel != USE_LOTS_OF_FORCE) )
{
NetStatus = NetUseDel( NULL, pwszPath, USE_LOTS_OF_FORCE );
if ( NetStatus != NERR_Success )
{
ASSERT( NetStatus == NERR_Success );
NetpKdPrint(( PREFIX_NETJOIN "NetUseDel with force on %ws failed with %d\n",
pwszPath, NetStatus ));
NetpLog(( "NetUseDel with force on %ws failed with %d\n",
pwszPath, NetStatus ));
}
}
}
}
else
{
if ( lpAccount != NULL )
{
pwszReset = wcschr( lpAccount, L'\\' );
if (pwszReset != NULL)
{
pwszUser = pwszReset + 1;
pwszDomain = lpAccount;
*pwszReset = UNICODE_NULL;
}
else
{
pwszUser = lpAccount;
//
// First, assume it's a UPN, so we pass in an empty string
//
pwszDomain = L"";
}
}
else
{
pwszUser = NULL;
pwszDomain = NULL;
pwszReset = NULL;
}
RtlZeroMemory(&NetUI2, sizeof(USE_INFO_2) );
NetUI2.ui2_local = NULL;
NetUI2.ui2_remote = pwszPath;
NetUI2.ui2_asg_type = USE_IPC;
NetUI2.ui2_username = pwszUser;
NetUI2.ui2_domainname = pwszDomain;
NetUI2.ui2_password = lpPassword;
NetStatus = NetUseAdd( NULL, 2, (PBYTE)&NetUI2, &BadParm );
if ( NetStatus == ERROR_LOGON_FAILURE )
{
//
// If we passed in an empty domain name, try it again with a NULL one
//
if ( pwszReset == NULL && pwszUser != NULL )
{
NetUI2.ui2_domainname = NULL;
NetStatus = NetUseAdd( NULL, 2, (PBYTE)&NetUI2, &BadParm );
}
}
if ( NetStatus != NERR_Success )
{
NetpKdPrint((PREFIX_NETJOIN "NetUseAdd to %ws returned %lu\n", pwszPath, NetStatus ));
NetpLog(( "NetUseAdd to %ws returned %lu\n", pwszPath, NetStatus ));
if ( NetStatus == ERROR_INVALID_PARAMETER && BadParm != 0 )
{
NetpLog(( "NetUseAdd bad parameter is %lu\n", BadParm ));
}
}
if ( pwszReset != NULL )
{
*pwszReset = L'\\';
}
if ( ( NetStatus == ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT ||
NetStatus == ERROR_NOLOGON_SERVER_TRUST_ACCOUNT ||
NetStatus == ERROR_SESSION_CREDENTIAL_CONFLICT ||
NetStatus == ERROR_ACCESS_DENIED ||
NetStatus == ERROR_LOGON_FAILURE ) &&
FLAG_ON( fOptions, NETSETUPP_NULL_SESSION_IPC ) )
{
NetpLog(( "Trying add to %ws using NULL Session\n", pwszPath ));
//
// Try it again with the null session
//
NetUI2.ui2_username = L"";
NetUI2.ui2_domainname = L"";
NetUI2.ui2_password = L"";
NetStatus = NetUseAdd( NULL, 2, (PBYTE)&NetUI2, NULL );
if ( NetStatus != NERR_Success ) {
NetpLog(( "NullSession NetUseAdd to %ws returned %lu\n",
pwszPath, NetStatus ));
}
}
}
return( NetStatus );
}
NET_API_STATUS
NetpBrowserCheckDomain(
IN LPWSTR NewDomainName
)
/*++
Routine Description:
Tell the browser to check a domain/workgroup name
Arguments:
NewDomainName - new name of the domain.
Return Value:
Status of the operation.
--*/
{
NET_API_STATUS NetStatus;
NTSTATUS Status;
UNICODE_STRING DeviceName;
IO_STATUS_BLOCK IoStatusBlock;
OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE BrowserHandle = NULL;
LPBYTE Where;
DWORD BytesReturned;
UCHAR PacketBuffer[sizeof(LMDR_REQUEST_PACKET)+2*(DNLEN+1)*sizeof(WCHAR)];
PLMDR_REQUEST_PACKET RequestPacket = (PLMDR_REQUEST_PACKET)PacketBuffer;
//
// Open the browser driver.
//
//
// Open the browser device.
//
RtlInitUnicodeString(&DeviceName, DD_BROWSER_DEVICE_NAME_U);
InitializeObjectAttributes(
&ObjectAttributes,
&DeviceName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL
);
Status = NtOpenFile(
&BrowserHandle,
SYNCHRONIZE,
&ObjectAttributes,
&IoStatusBlock,
0,
0
);
if (NT_SUCCESS(Status)) {
Status = IoStatusBlock.Status;
}
if (!NT_SUCCESS(Status)) {
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
//
// Build the request packet.
//
RequestPacket->Version = LMDR_REQUEST_PACKET_VERSION_DOM;
RtlInitUnicodeString( &RequestPacket->TransportName, NULL );
RequestPacket->Parameters.DomainRename.ValidateOnly = TRUE;
RtlInitUnicodeString( &RequestPacket->EmulatedDomainName, NULL );
//
// Copy the new domain name into the packet.
//
Where = (LPBYTE) RequestPacket->Parameters.DomainRename.DomainName;
RequestPacket->Parameters.DomainRename.DomainNameLength = wcslen( NewDomainName ) * sizeof(WCHAR);
wcscpy( (LPWSTR)Where, NewDomainName );
Where += RequestPacket->Parameters.DomainRename.DomainNameLength + sizeof(WCHAR);
//
// Send the request to the Datagram Receiver device driver.
//
if ( !DeviceIoControl(
BrowserHandle,
IOCTL_LMDR_RENAME_DOMAIN,
RequestPacket,
(DWORD)(Where - (LPBYTE)RequestPacket),
NULL,
0,
&BytesReturned,
NULL )) {
NetStatus = GetLastError();
goto Cleanup;
}
NetStatus = NO_ERROR;
Cleanup:
if ( BrowserHandle != NULL ) {
NtClose( BrowserHandle );
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpCreateAuthIdentForCreds(
IN PWSTR Account,
IN PWSTR Password,
OUT SEC_WINNT_AUTH_IDENTITY *AuthIdent
)
/*++
Routine Description:
Internal routine to create an AuthIdent structure for the given creditentials
Arguments:
Account - Account name
Password - Password for the account
AuthIdent - AuthIdentity struct to fill in
Returns:
ERROR_SUCCESS - Success
ERROR_NOT_ENOUGH_MEMORY - A memory allocation failed.
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
PWSTR UserCredentialString = NULL;
PWSTR szUser=NULL;
PWSTR szDomain=NULL;
RtlZeroMemory( AuthIdent, sizeof( SEC_WINNT_AUTH_IDENTITY ) );
//
// If there are no creds, just return
//
if ( Account == NULL )
{
return NERR_Success;
}
NetStatus = NetpSeparateUserAndDomain(Account, &szUser, &szDomain);
if ( NetStatus == NERR_Success )
{
if ( szUser )
{
AuthIdent->User = szUser;
AuthIdent->UserLength = wcslen( szUser );
}
if ( szDomain )
{
AuthIdent->Domain = szDomain;
AuthIdent->DomainLength = wcslen( szDomain );
}
if ( Password )
{
AuthIdent->Password = Password;
AuthIdent->PasswordLength = wcslen( Password );
}
AuthIdent->Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetSeparatedSubstrings(
IN LPCWSTR szString,
IN WCHAR chSeparator,
OUT LPWSTR* pszS1,
OUT LPWSTR* pszS2
)
{
NET_API_STATUS NetStatus = ERROR_FILE_NOT_FOUND;
LPWSTR szT=NULL;
LPWSTR szS1=NULL;
LPWSTR szS2=NULL;
*pszS1 = NULL;
*pszS2 = NULL;
if (szString && wcschr( szString, chSeparator ))
{
NetStatus = NetpDuplicateString(szString, -1, &szS1);
if ( NetStatus == NERR_Success )
{
szT = wcschr( szS1, chSeparator );
*szT = UNICODE_NULL;
szT++;
NetStatus = NetpDuplicateString(szT, -1, &szS2);
if (NetStatus == NERR_Success)
{
*pszS1 = szS1;
*pszS2 = szS2;
}
}
}
if (NetStatus != NERR_Success)
{
NetApiBufferFree(szS1);
NetApiBufferFree(szS2);
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpSeparateUserAndDomain(
IN LPCWSTR szUserAndDomain,
OUT LPWSTR* pszUser,
OUT LPWSTR* pszDomain
)
{
NET_API_STATUS NetStatus = NERR_Success;
*pszUser = NULL;
*pszDomain = NULL;
//
// check for domain\user format
//
NetStatus = NetpGetSeparatedSubstrings(szUserAndDomain, L'\\',
pszDomain, pszUser);
if (NetStatus == ERROR_FILE_NOT_FOUND)
{
//
// check for user@domain format
//
//NetStatus = NetpGetSeparatedSubstrings(szUserAndDomain, L'@',
// pszUser, pszDomain);
//if (NetStatus == ERROR_FILE_NOT_FOUND)
//{
//
// domain not specified, szUserAndDomain specifies a user
// (may be in the UPN format)
//
NetStatus = NetpDuplicateString(szUserAndDomain, -1, pszUser);
//}
}
return NetStatus;
}
VOID
NET_API_FUNCTION
NetpFreeAuthIdentForCreds(
IN PSEC_WINNT_AUTH_IDENTITY AuthIdent
)
/*++
Routine Description:
Free the authident structure allocated above
Arguments:
AuthIdent - AuthIdentity struct to free
Returns:
VOID
--*/
{
if ( AuthIdent )
{
NetApiBufferFree( AuthIdent->User );
NetApiBufferFree( AuthIdent->Domain );
}
}
NET_API_STATUS
NET_API_FUNCTION
NetpLdapUnbind(
IN PLDAP Ldap
)
/*++
Routine Description:
Unbinds a current ldap connection
Arguments:
Ldap -- Connection to be severed
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
if ( Ldap != NULL ) {
NetStatus = LdapMapErrorToWin32( ldap_unbind( Ldap ) );
}
NetpLog(( "ldap_unbind status: 0x%lx\n", NetStatus ));
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpLdapBind(
IN LPWSTR szUncDcName,
IN LPWSTR szUser,
IN LPWSTR szPassword,
OUT PLDAP *pLdap
)
/*++
Routine Description:
Binds to the named server using the given credentials
Arguments:
szUncDcName -- DC to connect to
szUser -- User name to bind with
szPassword -- Password to use for bind
pLdap -- Where the connection handle is returned
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
SEC_WINNT_AUTH_IDENTITY AuthId, *pAuthId = NULL;
LONG LdapOption;
ULONG LdapStatus = LDAP_SUCCESS;
//
// Initialization
//
*pLdap = NULL;
if ( szUser ) {
NetStatus = NetpCreateAuthIdentForCreds( szUser, szPassword, &AuthId );
pAuthId = &AuthId;
}
if ( NetStatus == NERR_Success ) {
//
// Open an LDAP connection to the DC and set useful options
//
*pLdap = ldap_initW( szUncDcName + 2, LDAP_PORT );
if ( *pLdap ) {
//
// Tell LDAP we are passing an explicit DC name
// to avoid the DC discovery
//
LdapOption = PtrToLong( LDAP_OPT_ON );
LdapStatus = ldap_set_optionW( *pLdap,
LDAP_OPT_AREC_EXCLUSIVE,
&LdapOption );
if ( LdapStatus != LDAP_SUCCESS ) {
NetpLog(( "NetpLdapBind: ldap_set_option LDAP_OPT_AREC_EXCLUSIVE failed on %ws: %ld: %s\n",
szUncDcName,
LdapStatus,
ldap_err2stringA(LdapStatus) ));
NetStatus = LdapMapErrorToWin32( LdapStatus );
//
// Do the bind
//
} else {
LdapStatus = ldap_bind_sW( *pLdap,
NULL,
(PWSTR) pAuthId,
LDAP_AUTH_NEGOTIATE );
if ( LdapStatus != LDAP_SUCCESS ) {
NetpLog(( "NetpLdapBind: ldap_bind failed on %ws: %ld: %s\n",
szUncDcName,
LdapStatus,
ldap_err2stringA(LdapStatus) ));
NetStatus = LdapMapErrorToWin32( LdapStatus );
}
}
if ( NetStatus != NERR_Success ) {
NetpLdapUnbind( *pLdap );
*pLdap = NULL;
}
} else {
LdapStatus = LdapGetLastError();
NetpLog(( "NetpLdapBind: ldap_init to %ws failed: %lu\n",
szUncDcName,
LdapStatus ));
NetStatus = LdapMapErrorToWin32( LdapStatus );
}
NetpFreeAuthIdentForCreds( pAuthId );
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetNCRoot(
IN PLDAP Ldap,
OUT LPWSTR *NCRoot,
OUT PBOOLEAN SupportsPageable
)
/*++
Routine Description:
This routine determines the DS root for the given domain and determines whether this
server supports pageable searches
Arguments:
Ldap -- Connection to the server
NCRoot -- Where the root is returned. Must be freed via NetApiBufferFree
SupportsPageable -- if TRUE, this server supports pageable searches
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
PWSTR Attribs[3] = {
L"defaultNamingContext",
L"supportedControl",
NULL
};
PWSTR *Values = NULL;
LDAPMessage *Message=NULL, *Entry;
ULONG Items, i;
NetStatus = LdapMapErrorToWin32( ldap_search_s( Ldap, NULL, LDAP_SCOPE_BASE,
NETSETUPP_ALL_FILTER, Attribs, 0, &Message ) );
if ( NetStatus == NERR_Success ) {
Entry = ldap_first_entry( Ldap, Message );
if ( Entry ) {
//
// Now, we'll have to get the values
//
Values = ldap_get_values( Ldap, Entry, Attribs[ 0 ] );
if ( Values ) {
NetStatus = NetpDuplicateString(Values[ 0 ], -1, NCRoot);
ldap_value_free( Values );
} else {
NetStatus = LdapMapErrorToWin32( Ldap->ld_errno );
}
//
// Now, see if we have the right control bits to do pageable stuff
//
if ( NetStatus == NERR_Success ) {
Values = ldap_get_values( Ldap, Entry, Attribs[ 1 ] );
if ( Values ) {
Items = ldap_count_values( Values );
for ( i = 0; i < Items ; i++ ) {
if ( _wcsicmp( Values[ i ], LDAP_PAGED_RESULT_OID_STRING_W ) == 0 ) {
*SupportsPageable = TRUE;
break;
}
}
ldap_value_free( Values );
} else {
NetStatus = LdapMapErrorToWin32( Ldap->ld_errno );
}
}
} else {
NetStatus = LdapMapErrorToWin32( Ldap->ld_errno );
}
}
if ( NetStatus != NERR_Success ) {
NetpLog(( "Failed to find the root NC: %lu\n", NetStatus ));
}
//Cleanup:
if (Message)
{
ldap_msgfree( Message );
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetDefaultJoinableOu(
IN LPWSTR Root,
IN PLDAP Ldap,
OUT PWSTR *DefaultOu
)
/*++
Routine Description:
This routine searches for all the OUs under the given domain root under which the bound
user has the rights to create a computer object
This routine does pageable searches
Arguments:
Root -- Root NC path
Ldap -- Connection to the server
DefaultOu - Where the default joinable ou is returned. NULL if no default joinable ou was
found
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
PWSTR Attribs[] = {
NETSETUPP_WELL_KNOWN,
NULL
};
ULONG Count, Status, i, StringLength;
PWSTR *WKOs = NULL, *Classes = NULL;
LDAPMessage *Message = NULL, *Entry, *Message2 = NULL, *Entry2;
PWSTR ParseString, End, DN;
BOOLEAN MatchFound = FALSE;
*DefaultOu = NULL;
NetpLog(( "Default OU search\n" ));
//
// Ok, first, read the list of WellKnownObjects off of the root
//
Status = ldap_search_s( Ldap,
Root,
LDAP_SCOPE_BASE,
NETSETUPP_ALL_FILTER,
Attribs,
0,
&Message );
if ( Message ) {
Entry = ldap_first_entry( Ldap, Message );
while ( Status == LDAP_SUCCESS && Entry ) {
//
// Read the list of objects that the current user is allowed to
// create under this OU and make sure that we can create a computer
// object
//
WKOs = ldap_get_values( Ldap, Entry, Attribs[ 0 ] );
if ( WKOs ) {
i = 0;
while ( WKOs[ i ] ) {
if ( !toupper( WKOs[ i ][ 0 ] ) == L'B' ) {
NetpLog(( "Unexpected object string %ws\n",
WKOs[ i ] ));
i++;
continue;
}
ParseString = WKOs[ i ] + 2;
StringLength = wcstoul( ParseString, &End, 10 );
ParseString = End + 1; // Skip over the ':'
if ( _wcsnicmp( ParseString,
L"AA312825768811D1ADED00C04FD8D5CD",
StringLength ) == 0 ) {
MatchFound = TRUE;
ParseString += StringLength + 1;
//
// Now, see if it is accessible or not
//
Attribs[ 0 ] = NETSETUPP_RETURNED_ATTR;
Status = ldap_search_s( Ldap,
Root,
LDAP_SCOPE_BASE,
NETSETUPP_ALL_FILTER,
Attribs,
0,
&Message2 );
if ( Message2 ) {
Entry2 = ldap_first_entry( Ldap, Message2 );
while ( Status == LDAP_SUCCESS && Entry2 ) {
//
// Read the list of objects that the current user is allowed to
// create under this OU and make sure that we can create a computer
// object
//
Classes = ldap_get_values( Ldap, Entry2, Attribs[ 0 ] );
if ( Classes ) {
i = 0;
while ( Classes[ i ] ) {
if ( _wcsicmp( Classes[ i ],
NETSETUPP_COMPUTER_OBJECT ) == 0 ) {
DN = ldap_get_dn( Ldap, Entry2 );
NetStatus = NetpDuplicateString(DN, -1,
DefaultOu);
break;
}
i++;
}
ldap_value_free( Classes );
}
Entry2 = ldap_next_entry( Ldap, Entry2 );
}
Status = Ldap->ld_errno;
ldap_msgfree( Message2 );
}
if ( NetStatus != NERR_Success || MatchFound ) {
break;
}
}
i++;
}
ldap_value_free( WKOs );
}
Entry = ldap_next_entry( Ldap, Entry );
}
Status = Ldap->ld_errno;
ldap_msgfree( Message );
}
if ( NetStatus == NERR_Success ) {
NetStatus = LdapMapErrorToWin32( Status );
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetListOfJoinableOUsPaged(
IN LPWSTR Root,
IN PLDAP Ldap,
OUT PULONG OUCount,
OUT PWSTR **OUs
)
/*++
Routine Description:
This routine searches for all the OUs under the given domain root under which the bound
user has the rights to create a computer object
This routine does pageable searches
Arguments:
Root -- Root NC path
Ldap -- Connection to the server
OUCount -- Where the count of strings is returned
OUs -- Where the list of OUs is returned
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
PLDAPSearch SearchHandle = NULL;
PWSTR Attribs[] = {
NETSETUPP_RETURNED_ATTR,
NULL
};
ULONG Count, i;
ULONG Status = LDAP_SUCCESS;
PWSTR *Classes = NULL;
LDAPMessage *Message = NULL, *Entry;
PWSTR DN;
PWSTR *DnList = NULL, *NewList = NULL;
ULONG CurrentIndex = 0, ListCount = 0;
PWSTR DefaultOu = NULL;
NetpLog(( "PAGED OU search\n" ));
//
// Initialize the pageable search
//
SearchHandle = ldap_search_init_pageW( Ldap,
Root,
LDAP_SCOPE_SUBTREE,
NETSETUPP_OU_FILTER,
Attribs,
FALSE,
NULL,
NULL,
0,
2000,
NULL );
if ( SearchHandle == NULL ) {
NetStatus = LdapMapErrorToWin32( LdapGetLastError( ) );
} else {
while ( NetStatus == NERR_Success ) {
Count = 0;
//
// Get the next page
//
Status = ldap_get_next_page_s( Ldap,
SearchHandle,
NULL,
100,
&Count,
&Message );
if ( Message ) {
//
// Process all of the entries
//
Entry = ldap_first_entry( Ldap, Message );
while ( Status == LDAP_SUCCESS && Entry ) {
//
// Read the list of classes that the current user is allowed to
// create under this OU and make sure that we can create a computer
// object
//
Classes = ldap_get_values( Ldap, Entry, Attribs[ 0 ] );
if ( Classes ) {
i = 0;
while ( Classes[ i ] ) {
if ( _wcsicmp( Classes[ i ], NETSETUPP_COMPUTER_OBJECT ) == 0 ) {
DN = ldap_get_dn( Ldap, Entry );
NetpKdPrint(( PREFIX_NETJOIN "DN = %ws\n", DN ));
//
// We'll allocate the return list in blocks of 10 to cut
// down on the number of allocations
//
if ( CurrentIndex >= ListCount ) {
if ( NetApiBufferAllocate( ( ListCount + 10 ) * sizeof( PWSTR ),
( PVOID * )&NewList ) != NERR_Success ) {
Status = LDAP_NO_MEMORY;
} else {
RtlCopyMemory( NewList,
DnList,
ListCount * sizeof( PWSTR ) );
ListCount += 10;
DnList = NewList;
}
}
//
// Copy the string
//
if ( Status == LDAP_SUCCESS ) {
if (NERR_Success ==
NetpDuplicateString(DN, -1,
&NewList[CurrentIndex]))
{
CurrentIndex++;
}
else
{
Status = LDAP_NO_MEMORY;
}
}
ldap_memfree( DN );
break;
}
i++;
}
ldap_value_free( Classes );
}
Entry = ldap_next_entry( Ldap, Entry );
}
Status = Ldap->ld_errno;
ldap_msgfree( Message );
Message = NULL;
}
if ( Status == LDAP_NO_RESULTS_RETURNED ) {
Status = LDAP_SUCCESS;
break;
}
}
ldap_search_abandon_page( Ldap,
SearchHandle );
NetStatus = LdapMapErrorToWin32( Status );
}
//
// Check the computers container
//
if ( NetStatus == NERR_Success ) {
NetStatus = NetpGetDefaultJoinableOu( Root,
Ldap,
&DefaultOu );
if ( NetStatus == NERR_Success && DefaultOu ) {
//
// We'll allocate the return list in blocks of 10 to cut
// down on the number of allocations
//
if ( CurrentIndex >= ListCount ) {
if ( NetApiBufferAllocate( ( ListCount + 10 ) * sizeof( PWSTR ),
( PVOID * )&NewList ) != NERR_Success ) {
Status = LDAP_NO_MEMORY;
} else {
RtlCopyMemory( NewList,
DnList,
ListCount * sizeof( PWSTR ) );
ListCount += 10;
DnList = NewList;
}
}
//
// Copy the string
//
if ( Status == LDAP_SUCCESS ) {
if (NERR_Success ==
NetpDuplicateString(DefaultOu, -1, &NewList[CurrentIndex]))
{
CurrentIndex++;
}
else
{
Status = LDAP_NO_MEMORY;
}
}
NetApiBufferFree( DefaultOu );
}
}
//
// If there was an error, free everyting
//
if ( NetStatus != NERR_Success ) {
for ( i = 0; i < ListCount; i++ ) {
NetApiBufferFree( DnList[ i ] );
}
NetApiBufferFree( DnList );
} else {
*OUs = DnList;
*OUCount = CurrentIndex;
}
if ( NetStatus == NERR_Success ) {
NetpLog(( "Found %lu OUs\n", *OUs ));
} else {
NetpLog(( "Failed to obtain the list of joinable OUs: %lu\n",
NetStatus ));
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetListOfJoinableOUsNonPaged(
IN LPWSTR Root,
IN PLDAP Ldap,
OUT PULONG OUCount,
OUT PWSTR **OUs
)
/*++
Routine Description:
This routine searches for all the OUs under the given domain root under which the bound
user has the rights to create a computer object
This routine does not use pageable searchs and will return only the max_search count
of entries
Arguments:
Root -- Root NC path
Ldap -- Connection to the server
OUCount -- Where the count of strings is returned
OUs -- Where the list of OUs is returned
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
PWSTR Attribs[] = {
NETSETUPP_RETURNED_ATTR,
NULL
};
ULONG Count, Status, i;
PWSTR *Classes = NULL;
LDAPMessage *Message = NULL, *Entry;
PWSTR DN;
PWSTR *DnList = NULL, *NewList = NULL;
ULONG CurrentIndex = 0, ListCount = 0;
PWSTR DefaultOu = NULL;
NetpLog(( "Normal OU search\n" ));
Status = ldap_search_s( Ldap,
Root,
LDAP_SCOPE_SUBTREE,
NETSETUPP_OU_FILTER,
Attribs,
0,
&Message );
if ( Message ) {
Entry = ldap_first_entry( Ldap, Message );
while ( Status == LDAP_SUCCESS && Entry ) {
//
// Read the list of classes that the current user is allowed to
// create under this OU and make sure that we can create a computer
// object
//
Classes = ldap_get_values( Ldap, Entry, Attribs[ 0 ] );
if ( Classes ) {
i = 0;
while ( Classes[ i ] ) {
if ( _wcsicmp( Classes[ i ], NETSETUPP_COMPUTER_OBJECT ) == 0 ) {
DN = ldap_get_dn( Ldap, Entry );
//
// We'll allocate the return list in blocks of 10 to cut
// down on the number of allocations
//
if ( CurrentIndex >= ListCount ) {
if ( NetApiBufferAllocate( ( ListCount + 10 ) * sizeof( PWSTR ),
( PVOID * )&NewList ) != NERR_Success ) {
Status = LDAP_NO_MEMORY;
} else {
RtlCopyMemory( NewList,
DnList,
ListCount * sizeof( PWSTR ) );
ListCount += 10;
DnList = NewList;
}
}
//
// Copy the string
//
if ( Status == LDAP_SUCCESS ) {
if (NERR_Success ==
NetpDuplicateString(DN, -1, &NewList[CurrentIndex]))
{
CurrentIndex++;
}
else
{
Status = LDAP_NO_MEMORY;
}
}
ldap_memfree( DN );
break;
}
i++;
}
ldap_value_free( Classes );
}
Entry = ldap_next_entry( Ldap, Entry );
}
Status = Ldap->ld_errno;
ldap_msgfree( Message );
}
NetStatus = LdapMapErrorToWin32( Status );
//
// Check the computers container
//
if ( NetStatus == NERR_Success ) {
NetStatus = NetpGetDefaultJoinableOu( Root,
Ldap,
&DefaultOu );
if ( NetStatus == NERR_Success && DefaultOu ) {
//
// We'll allocate the return list in blocks of 10 to cut
// down on the number of allocations
//
if ( CurrentIndex >= ListCount ) {
if ( NetApiBufferAllocate( ( ListCount + 10 ) * sizeof( PWSTR ),
( PVOID * )&NewList ) != NERR_Success ) {
Status = LDAP_NO_MEMORY;
} else {
RtlCopyMemory( NewList,
DnList,
ListCount * sizeof( PWSTR ) );
ListCount += 10;
DnList = NewList;
}
}
//
// Copy the string
//
if ( Status == LDAP_SUCCESS ) {
if (NERR_Success ==
NetpDuplicateString(DefaultOu, -1, &NewList[CurrentIndex]))
{
CurrentIndex++;
}
else
{
Status = LDAP_NO_MEMORY;
}
}
NetApiBufferFree( DefaultOu );
}
}
//
// If there was an error, free everyting
//
if ( NetStatus != NERR_Success ) {
for ( i = 0; i < ListCount; i++ ) {
NetApiBufferFree( DnList[ i ] );
}
NetApiBufferFree( DnList );
} else {
*OUs = DnList;
*OUCount = CurrentIndex;
}
if ( NetStatus == NERR_Success ) {
NetpLog(( "Found %lu OUs\n", *OUs ));
} else {
NetpLog(( "Failed to obtain the list of joinable OUs: %lu\n",
NetStatus ));
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetListOfJoinableOUs(
IN LPWSTR Domain,
IN LPWSTR Account,
IN LPWSTR Password,
OUT PULONG Count,
OUT PWSTR **OUs
)
/*++
Routine Description:
This routine searches for all the OUs under the given domain root under which the bound
user has the rights to create a computer object
Arguments:
Domain -- Domain under which to find all of the OUs under which a computer object can be
created
Account -- Account to use for the LDAP bind
Password -- Password to used for the bind. The password is encoded. The first WCHAR of the
password is the seed.
OUCount -- Where the count of strings is returned
OUs -- Where the list of OUs is returned
Returns:
NERR_Success -- Success
NERR_DefaultJoinRequired -- The servers for this domain do not support the DS so the computer
account can only be created under the default container (for NT4, this is the SAM account
database)
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
PWSTR DomainControllerName = NULL;
ULONG DcFlags = 0;
PLDAP Ldap = NULL;
PWSTR NCRoot;
BOOLEAN Pageable = FALSE;
UCHAR Seed;
UNICODE_STRING EncodedPassword;
NetSetuppOpenLog();
if ( Password ) {
if ( wcslen( Password ) < 1 ) {
return( ERROR_INVALID_PARAMETER );
}
Seed = ( UCHAR )*Password;
RtlInitUnicodeString( &EncodedPassword, Password + 1 );
} else {
RtlZeroMemory( &EncodedPassword, sizeof( UNICODE_STRING ) );
Seed = 0;
}
//
// First, find a DC in the destination domain
//
NetStatus = NetpDsGetDcName( NULL,
Domain,
NULL,
NETSETUPP_DSGETDC_FLAGS,
&DcFlags,
&DomainControllerName
,NULL
);
if ( NetStatus == NERR_Success ) {
//
// Try and bind to the server
//
RtlRunDecodeUnicodeString( Seed, &EncodedPassword );
NetStatus = NetpLdapBind( DomainControllerName,
Account,
EncodedPassword.Buffer,
&Ldap );
RtlRunEncodeUnicodeString( &Seed, &EncodedPassword );
if ( NetStatus == NERR_Success ) {
//
// Get the X500 domain name
//
NetStatus = NetpGetNCRoot( Ldap,
&NCRoot,
&Pageable );
if ( NetStatus == NERR_Success ) {
//
// Get the list of OUs
//
if ( Pageable ) {
NetStatus = NetpGetListOfJoinableOUsPaged( NCRoot,
Ldap,
Count,
OUs );
} else {
NetStatus = NetpGetListOfJoinableOUsNonPaged( NCRoot,
Ldap,
Count,
OUs );
}
NetApiBufferFree( NCRoot );
}
NetpLdapUnbind( Ldap );
} else if ( NetStatus == ERROR_BAD_NET_RESP ) {
NetStatus = NERR_DefaultJoinRequired;
}
NetApiBufferFree( DomainControllerName );
}
if ( NetStatus != NERR_Success ) {
NetpLog(( "NetpGetListOfJoinableOUs failed with %lu\n",
NetStatus ));
}
NetSetuppCloseLog( );
return( NetStatus );
}
NET_API_STATUS
NetpGetDnsHostName(
IN LPWSTR PassedHostName OPTIONAL,
IN PUNICODE_STRING DnsDomainName,
OUT LPWSTR *DnsHostName
)
/*++
Routine Description:
This routine determines the value of DnsHostName attribute to be set on the
computer object in the DS. DnsHostName is <HostName.PrimaryDnsSuffix>.
Here HostName is a computer name which may be different from the Netbios name;
Netbios name is at most 15 characters of HostName. PrimaryDnsSuffix can be
set through Policy or through the UI or can be defaulted to the DNS name of the
domain being joined; policy setting takes preference.
This routine determines *new* values for HostName and PrimaryDnsSuffix which
will be applied after the reboot. Thus DnsHostName will have the correct value
after the machine reboots.
Arguments:
PassedHostName - The host name of this machine (can be longer than 15 chars).
If NULL, the host name is read from the registry.
DnsDomainName - DNS name of the domain being joined
DnsHostname - Returns the value of DnsHostName. Must be freed by calling
NetApiBufferFree.
Returns:
NO_ERROR - Success
ERROR_NOT_ENOUGH_MEMORY - There was not enough memory to read the data from
registry
ERROR_INVALID_COMPUTERNAME - It was not possible to determine DnsHostName from
the registry
--*/
{
LONG RegStatus;
HKEY Key = NULL;
DWORD Type;
NET_API_STATUS NetStatus;
PWSTR HostName = NULL;
PWSTR PrimaryDnsSuffix = NULL;
LPWSTR LocalDnsHostName;
DWORD Size = 0;
//
// First detemine HostName.
//
// If it's passed, use it
//
if ( PassedHostName != NULL ) {
HostName = PassedHostName;
//
// Otherwise, read it from teh registry
//
} else {
RegStatus = RegOpenKeyExW( HKEY_LOCAL_MACHINE,
L"System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
0,
KEY_QUERY_VALUE,
&Key );
//
// Not having host name is critical -- error out in such case
//
if ( RegStatus != ERROR_SUCCESS ) {
NetpLog(( "NetpGetDnsHostName: Cannot open TCPIP parameters: 0x%lx\n", RegStatus ));
} else {
//
// First try to read the new value
//
RegStatus = RegQueryValueExW( Key,
L"NV Hostname",
0,
&Type,
NULL,
&Size );
if ( RegStatus == ERROR_SUCCESS && Size != 0 ) {
HostName = LocalAlloc( 0, Size );
if ( HostName == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
RegStatus = RegQueryValueExW( Key,
L"NV Hostname",
0,
&Type,
(PUCHAR) HostName,
&Size );
if ( RegStatus != ERROR_SUCCESS ) {
NetpLog(( "NetpGetDnsHostName: Cannot read NV Hostname: 0x%lx\n", RegStatus ));
NetStatus = ERROR_INVALID_COMPUTERNAME;
goto Cleanup;
} else {
NetpLog(( "NetpGetDnsHostName: Read NV Hostname: %ws\n", HostName ));
}
}
//
// If the new value does not exist for some reason,
// try to read the currently active one
//
if ( HostName == NULL ) {
RegStatus = RegQueryValueExW( Key,
L"Hostname",
0,
&Type,
NULL,
&Size );
if ( RegStatus == ERROR_SUCCESS && Size != 0 ) {
HostName = LocalAlloc( 0, Size );
if ( HostName == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
RegStatus = RegQueryValueExW( Key,
L"Hostname",
0,
&Type,
(PUCHAR) HostName,
&Size );
if ( RegStatus != ERROR_SUCCESS ) {
NetpLog(( "NetpGetDnsHostName: Cannot read Hostname: 0x%lx\n", RegStatus ));
NetStatus = ERROR_INVALID_COMPUTERNAME;
goto Cleanup;
} else {
NetpLog(( "NetpGetDnsHostName: Read Hostname: %ws\n", HostName ));
}
}
}
}
}
//
// If we couldn't get HostName, something's really bad
//
if ( HostName == NULL ) {
NetpLog(( "NetpGetDnsHostName: Could not get Hostname\n" ));
NetStatus = ERROR_INVALID_COMPUTERNAME;
goto Cleanup;
}
if ( Key != NULL ) {
RegCloseKey( Key );
Key = NULL;
}
//
// Second read primary DNS suffix of this machine.
//
// Try the suffix that comes down through policy first
//
RegStatus = RegOpenKeyExW( HKEY_LOCAL_MACHINE,
L"Software\\Policies\\Microsoft\\System\\DNSclient",
0,
KEY_QUERY_VALUE,
&Key );
if ( RegStatus == 0 ) {
//
// Read only the new value; if it doesn't exist the
// current value will be deleted after the reboot
//
RegStatus = RegQueryValueExW( Key,
L"NV PrimaryDnsSuffix",
0,
&Type,
NULL,
&Size );
if ( RegStatus == ERROR_SUCCESS && Size != 0 ) {
PrimaryDnsSuffix = LocalAlloc( 0, Size );
if ( PrimaryDnsSuffix == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
RegStatus = RegQueryValueExW( Key,
L"NV PrimaryDnsSuffix",
0,
&Type,
(PUCHAR) PrimaryDnsSuffix,
&Size );
if ( RegStatus != ERROR_SUCCESS ) {
NetpLog(( "NetpGetDnsHostName: Cannot read NV PrimaryDnsSuffix: 0x%lx\n", RegStatus ));
NetStatus = ERROR_INVALID_COMPUTERNAME;
goto Cleanup;
} else {
NetpLog(( "NetpGetDnsHostName: Read NV PrimaryDnsSuffix: %ws\n", PrimaryDnsSuffix ));
}
}
}
//
// If there is no policy setting for PrimaryDnsSuffix,
// get it from the TCPIP setting
//
if ( Key != NULL ) {
RegCloseKey( Key );
Key = NULL;
}
if ( PrimaryDnsSuffix == NULL ) {
RegStatus = RegOpenKeyExW( HKEY_LOCAL_MACHINE,
L"System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
0,
KEY_QUERY_VALUE,
&Key );
if ( RegStatus == ERROR_SUCCESS ) {
ULONG SyncValue;
Size = sizeof( ULONG );
RegStatus = RegQueryValueEx( Key,
L"SyncDomainWithMembership",
0,
&Type,
(PUCHAR)&SyncValue,
&Size );
//
// If we are not to sync DNS suffix with the name of the
// domain that we join, get the configured suffix
//
if ( RegStatus == ERROR_SUCCESS && SyncValue == 0 ) {
//
// Read the new value
//
RegStatus = RegQueryValueExW( Key,
L"NV Domain",
0,
&Type,
NULL,
&Size );
if ( RegStatus == ERROR_SUCCESS && Size != 0 ) {
PrimaryDnsSuffix = LocalAlloc( 0, Size );
if ( PrimaryDnsSuffix == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
RegStatus = RegQueryValueExW( Key,
L"NV Domain",
0,
&Type,
(PUCHAR) PrimaryDnsSuffix,
&Size );
if ( RegStatus != ERROR_SUCCESS ) {
NetpLog(( "NetpGetDnsHostName: Cannot read NV Domain: 0x%lx\n", RegStatus ));
NetStatus = ERROR_INVALID_COMPUTERNAME;
goto Cleanup;
} else {
NetpLog(( "NetpGetDnsHostName: Read NV Domain: %ws\n", PrimaryDnsSuffix ));
}
}
//
// If the new value does not exist for some reason,
// read the currently active one
//
if ( PrimaryDnsSuffix == NULL ) {
RegStatus = RegQueryValueExW( Key,
L"Domain",
0,
&Type,
NULL,
&Size );
if ( RegStatus == ERROR_SUCCESS && Size != 0 ) {
PrimaryDnsSuffix = LocalAlloc( 0, Size );
if ( PrimaryDnsSuffix == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
RegStatus = RegQueryValueExW( Key,
L"Domain",
0,
&Type,
(PUCHAR) PrimaryDnsSuffix,
&Size );
if ( RegStatus != ERROR_SUCCESS ) {
NetpLog(( "NetpGetDnsHostName: Cannot read Domain: 0x%lx\n", RegStatus ));
NetStatus = ERROR_INVALID_COMPUTERNAME;
goto Cleanup;
} else {
NetpLog(( "NetpGetDnsHostName: Read Domain: %ws\n", PrimaryDnsSuffix ));
}
}
}
}
}
}
//
// If we still have no PrimaryDnsSuffix, use DNS name of the domain we join
//
if ( PrimaryDnsSuffix == NULL ) {
NetpLog(( "NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain name: %wZ\n", DnsDomainName ));
PrimaryDnsSuffix = LocalAlloc( 0, DnsDomainName->Length + sizeof(WCHAR) );
if ( PrimaryDnsSuffix == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
RtlCopyMemory( PrimaryDnsSuffix,
DnsDomainName->Buffer,
DnsDomainName->Length );
PrimaryDnsSuffix[ (DnsDomainName->Length)/sizeof(WCHAR) ] = UNICODE_NULL;
}
//
// Now we have Hostname and Primary DNS suffix.
// Connect them with . to form DnsHostName.
//
NetStatus = NetApiBufferAllocate(
(wcslen(HostName) + 1 + wcslen(PrimaryDnsSuffix) + 1) * sizeof(WCHAR),
&LocalDnsHostName );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
wcscpy( LocalDnsHostName, HostName );
wcscat( LocalDnsHostName, L"." );
wcscat( LocalDnsHostName, PrimaryDnsSuffix );
//
// If we are here, it's a success
//
*DnsHostName = LocalDnsHostName;
NetStatus = NO_ERROR;
Cleanup:
if ( Key != NULL ) {
RegCloseKey( Key );
}
if ( HostName != NULL && HostName != PassedHostName ) {
LocalFree( HostName );
}
if ( PrimaryDnsSuffix != NULL ) {
LocalFree( PrimaryDnsSuffix );
}
return NetStatus;
}
VOID
NetpRemoveDuplicateStrings(
IN PWCHAR *Source,
IN OUT PWCHAR *Target
)
/*++
Routine Description:
This routine accepts two pointer arrays and removes those entries
from the target array which point to strings that are identical to
one of the strings pointed to by the entries in the source array.
On return, the target array entries which precede the NULL terminator
will point to strings which are different from any of the strings
pointed to by the source array elements.
Arguments:
Source -- The NULL terminated array of pointes to source strings.
For example:
Source[0] = L"abc";
Source[1] = L"def";
Source[2] = NULL;
Target -- The NULL terminated array of pointes to target strings.
For example:
Target[0] = L"abc";
Target[1] = L"ghi";
Target[2] = L"def";
Target[3] = NULL;
On return, the Target array will be, for our example:
Target[0] = L"ghi";
Target[1] = NULL;
Target[2] = L"def";
Target[3] = NULL;
Note that, on return, the target array has size of 1 and
contains only one valid pointer.
Returns:
VOID
--*/
{
PWCHAR *TargetPtr, *TargetNextPtr, *SourcePtr;
BOOL KeepEntry;
//
// Sanity check
//
if ( Source == NULL || *Source == NULL ||
Target == NULL || *Target == NULL ) {
return;
}
//
// Loop through the target and compare with the source
//
for ( TargetPtr = TargetNextPtr = Target;
*TargetNextPtr != NULL;
TargetNextPtr++ ) {
KeepEntry = TRUE;
for ( SourcePtr = Source; *SourcePtr != NULL; SourcePtr++ ) {
if ( _wcsicmp( *SourcePtr, *TargetNextPtr ) == 0 ) {
KeepEntry = FALSE;
break;
}
}
if ( KeepEntry ) {
*TargetPtr = *TargetNextPtr;
TargetPtr ++;
}
}
//
// Terminate the target array
//
*TargetPtr = NULL;
return;
}
DWORD
NetpCrackNamesStatus2Win32Error(
DWORD dwStatus
)
{
switch (dwStatus) {
case DS_NAME_ERROR_RESOLVING:
return ERROR_DS_NAME_ERROR_RESOLVING;
case DS_NAME_ERROR_NOT_FOUND:
return ERROR_DS_NAME_ERROR_NOT_FOUND;
case DS_NAME_ERROR_NOT_UNIQUE:
return ERROR_DS_NAME_ERROR_NOT_UNIQUE;
case DS_NAME_ERROR_NO_MAPPING:
return ERROR_DS_NAME_ERROR_NO_MAPPING;
case DS_NAME_ERROR_DOMAIN_ONLY:
return ERROR_DS_NAME_ERROR_DOMAIN_ONLY;
case DS_NAME_ERROR_NO_SYNTACTICAL_MAPPING:
return ERROR_DS_NAME_ERROR_NO_SYNTACTICAL_MAPPING;
}
return ERROR_FILE_NOT_FOUND;
}
//
// Machine account attributes in the DS
//
#define NETSETUPP_OBJECTCLASS L"objectClass"
#define NETSETUPP_SAMACCOUNTNAME L"SamAccountName"
#define NETSETUPP_DNSHOSTNAME L"DnsHostName"
#define NETSETUPP_SERVICEPRINCIPALNAME L"ServicePrincipalName"
#define NETSETUPP_USERACCOUNTCONTROL L"userAccountControl"
#define NETSETUPP_UNICODEPWD L"unicodePwd"
#define NETSETUPP_ORGANIZATIONALUNIT L"OrganizationalUnit"
#define NETSETUPP_HOST_SPN_PREFIX L"HOST/"
#define NETSETUPP_COMP_OBJ_ATTR_COUNT 6
#define NETSETUPP_MULTIVAL_ATTRIB 0x01
#define NETSETUPP_COMPUTER_CONTAINER_GUID_IN_B32_FORM L"B:32:" GUID_COMPUTRS_CONTAINER_W L":"
typedef struct _NETSETUPP_MACH_ACC_ATTRIBUTE {
PWSTR AttribType; // Type of the attribute
ULONG AttribFlags; // Attribute flags
PWSTR *AttribValues; // Values of the attribute
} NETSETUPP_MACH_ACC_ATTRIBUTE, *PNETSETUPP_MACH_ACC_ATTRIBUTE;
NET_API_STATUS
NET_API_FUNCTION
NetpGetComputerObjectDn(
IN PDOMAIN_CONTROLLER_INFO DcInfo,
IN LPWSTR Account,
IN LPWSTR Password,
IN PLDAP Ldap,
IN LPWSTR ComputerName,
IN LPWSTR OU OPTIONAL,
OUT LPWSTR *ComputerObjectDn
)
/*++
Routine Description:
Get the DN for the computer account in the specified OU.
The algorithm is as follows.
First try to get the DN of the pre-existing account (if any)
by cracking the account name into a DN. If that succeeds, verify
that the passed OU (if any) matches the cracked DN. If the OU
matches, return success, otherwise return error (ERROR_FILE_EXISTS).
If no OU is not passed, simply return the cracked DN.
If the account does not exist, verify that the passed OU
(if any) exists. If so, build the DN from the computer name and
the OU and return it. If no OU is passed, get the default computer
container name (by reading the WellKnownObjects attribute) and build
the DN using the computer name and the default computer container DN.
Arguments:
DcInfo - Domain controller on which to create the object
Account - Account to use for the LDAP bind
Password - Password to used for the bind
Ldap - Ldap binding to the DC
ComputerName - Name of the computer being joined
OU - OU under which to create the object.
The name must be a fully qualified name
e.g.: "ou=test,dc=ntdev,dc=microsoft,dc=com"
NULL indicates to use the default computer container
ComputerObjectDn - Returns the DN of the computer object.
The retuned buffer must be freed using NetApiBufferFree
Returns:
NO_ERROR -- Success
ERROR_DS_NAME_ERROR_NOT_UNIQUE -- One of names being cracked
(the Netbios domain name or the pre-existing account name
or the root DN) is not unique.
ERROR_FILE_EXISTS -- The OU passed does not match the cracked DN
of the pre-existing account.
ERROR_FILE_NOT_FOUND -- The specified OU does not exist or
Could not get/read the WellKnownObjects attribute or
Could not get the default computer container name from the
WellKnownObjects attribute.
ERROR_NOT_ENOUGH_MEMORY -- Could not allocated memory required.
One of the errors returned by DsCrackNames.
(see NetpCrackNamesStatus2Win32Error())
--*/
{
NET_API_STATUS NetStatus = NO_ERROR;
ULONG LdapStatus;
HANDLE hDs = NULL;
PWCHAR AccountUserName = NULL;
PWCHAR AccountDomainName = NULL;
LPWSTR NetbiosDomainNameWithBackslash = NULL;
PWCHAR ComputerContainerDn = NULL;
PWCHAR NameToCrack = NULL;
RPC_AUTH_IDENTITY_HANDLE AuthId = 0;
PDS_NAME_RESULTW CrackedName = NULL;
PWCHAR WellKnownObjectsAttr[2];
PWSTR *WellKnownObjectValues = NULL;
LDAPMessage *LdapMessage = NULL, *LdapEntry = NULL;
LPWSTR LocalComputerObjectDn = NULL;
ULONG Index;
//
// First check whether the account already exists for the computer
//
// If account is passed, prepare the corresponding credentials.
// Otherwise, use the default creds of the user running this routine.
//
if ( Account != NULL ) {
NetStatus = NetpSeparateUserAndDomain( Account, &AccountUserName, &AccountDomainName );
if ( NetStatus != NERR_Success ) {
NetpLog(( "NetpGetComputerObjectDn: Cannot NetpSeparateUserAndDomain 0x%lx\n", NetStatus ));
goto Cleanup;
}
NetStatus = DsMakePasswordCredentials( AccountUserName,
AccountDomainName,
Password,
&AuthId);
if ( NetStatus != NERR_Success ) {
NetpLog(( "NetpGetComputerObjectDn: Cannot DsMakePasswordCredentials 0x%lx\n", NetStatus ));
goto Cleanup;
}
}
//
// Bind to the DS on the DC.
//
NetStatus = DsBindWithCredW( DcInfo->DomainControllerName, NULL, AuthId, &hDs);
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpGetComputerObjectDn: Unable to bind to DS on '%ws': 0x%lx\n",
DcInfo->DomainControllerName, NetStatus ));
goto Cleanup ;
}
//
// Attempt to crack the account name into a DN.
//
// We need to have the Netbios domain name to
// form an NT4 style account name since DsCrackNames
// doesn't accept DNS domain names for cracking accounts.
// So, if we have a DNS domain name, we need to crack it
// into a Netbios domain name first.
//
if ( (DcInfo->Flags & DS_DNS_DOMAIN_FLAG) == 0 ) {
NetbiosDomainNameWithBackslash = LocalAlloc( 0, (wcslen(DcInfo->DomainName) + 2) * sizeof(WCHAR) );
if ( NetbiosDomainNameWithBackslash == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
swprintf( NetbiosDomainNameWithBackslash, L"%ws\\", DcInfo->DomainName );
} else {
NameToCrack = LocalAlloc( 0, (wcslen(DcInfo->DomainName) + 1 + 1) * sizeof(WCHAR) );
if ( NameToCrack == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
swprintf( NameToCrack, L"%ws/", DcInfo->DomainName );
//
// Be verbose
//
NetpLog(( "NetpGetComputerObjectDn: Cracking DNS domain name %ws into Netbios on %ws\n",
NameToCrack,
DcInfo->DomainControllerName ));
if ( CrackedName != NULL ) {
DsFreeNameResultW( CrackedName );
CrackedName = NULL;
}
//
// Crack the DNS domain name into a Netbios domain name
//
NetStatus = DsCrackNamesW( hDs,
0,
DS_CANONICAL_NAME,
DS_NT4_ACCOUNT_NAME,
1,
&NameToCrack,
&CrackedName );
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpGetComputerObjectDn: CrackNames failed for %ws: 0x%lx\n",
NameToCrack,
NetStatus ));
goto Cleanup ;
}
//
// Check for consistency
//
if ( CrackedName->cItems != 1 ) {
NetStatus = ERROR_DS_NAME_ERROR_NOT_UNIQUE;
NetpLog(( "NetpGetComputerObjectDn: Cracked Name %ws is not unique: %lu\n",
NameToCrack,
CrackedName->cItems ));
goto Cleanup ;
}
if ( CrackedName->rItems[0].status != DS_NAME_NO_ERROR ) {
NetpLog(( "NetpGetComputerObjectDn: CrackNames failed for %ws: substatus 0x%lx\n",
NameToCrack,
CrackedName->rItems[0].status ));
NetStatus = NetpCrackNamesStatus2Win32Error( CrackedName->rItems[0].status );
goto Cleanup ;
}
//
// Be verbose
//
NetpLog(( "NetpGetComputerObjectDn: Crack results: \tname = %ws\n",
CrackedName->rItems[0].pName ));
//
// We've got the Netbios domain name
// (the cracked name already includes the trailing backslash)
//
NetbiosDomainNameWithBackslash = LocalAlloc( 0, (wcslen(CrackedName->rItems[0].pName) + 1) * sizeof(WCHAR) );
if ( NetbiosDomainNameWithBackslash == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
wcscpy( NetbiosDomainNameWithBackslash, CrackedName->rItems[0].pName );
}
//
// Form the NT4 account name given the Netbios domain name
//
if ( NameToCrack != NULL ) {
LocalFree( NameToCrack );
NameToCrack = NULL;
}
NameToCrack = LocalAlloc( 0,
(wcslen(NetbiosDomainNameWithBackslash) + wcslen(ComputerName) + 1 + 1) * sizeof(WCHAR) );
if ( NameToCrack == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
swprintf( NameToCrack, L"%ws%ws$", NetbiosDomainNameWithBackslash, ComputerName );
//
// Crack the account name into a DN
//
if ( CrackedName != NULL ) {
DsFreeNameResultW( CrackedName );
CrackedName = NULL;
}
//
// Be verbose
//
NetpLog(( "NetpGetComputerObjectDn: Cracking account name %ws on %ws\n",
NameToCrack,
DcInfo->DomainControllerName ));
NetStatus = DsCrackNamesW( hDs,
0,
DS_NT4_ACCOUNT_NAME,
DS_FQDN_1779_NAME,
1,
&NameToCrack,
&CrackedName );
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpGetComputerObjectDn: CrackNames failed for %ws: 0x%lx\n",
NameToCrack,
NetStatus ));
goto Cleanup ;
}
//
// Check for consistency
//
if ( CrackedName->cItems > 1 ) {
NetStatus = ERROR_DS_NAME_ERROR_NOT_UNIQUE;
NetpLog(( "NetpGetComputerObjectDn: Cracked Name %ws is not unique: %lu\n",
NameToCrack,
CrackedName->cItems ));
goto Cleanup ;
}
//
// If the account alredy exists, verify that the passed OU (if any)
// matches that of the account DN
//
if ( CrackedName->rItems[0].status == DS_NAME_NO_ERROR ) {
ULONG DnSize;
NetpLog(( "NetpGetComputerObjectDn: Crack results: \t(Account already exists) DN = %ws\n",
CrackedName->rItems[0].pName ));
DnSize = ( wcslen(CrackedName->rItems[0].pName) + 1 ) * sizeof(WCHAR);
//
// Allocate storage for the computer object DN
//
NetStatus = NetApiBufferAllocate( DnSize, &LocalComputerObjectDn );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
//
// If the OU is passed, verify that it matches the cracked name
//
if ( OU != NULL ) {
ULONG DnSizeFromOu;
DnSizeFromOu = ( wcslen(NETSETUPP_OBJ_PREFIX) +
wcslen(ComputerName) + 1 + wcslen(OU) + 1 ) * sizeof(WCHAR);
if ( DnSizeFromOu != DnSize ) {
NetpLog(( "NetpGetComputerObjectDn: Passed OU doesn't match in size cracked DN: %lu %lu\n",
DnSizeFromOu,
DnSize ));
NetStatus = ERROR_FILE_EXISTS;
goto Cleanup;
}
swprintf( LocalComputerObjectDn, L"%ws%ws,%ws", NETSETUPP_OBJ_PREFIX, ComputerName, OU );
if ( _wcsicmp(LocalComputerObjectDn, CrackedName->rItems[0].pName) != 0 ) {
NetpLog(( "NetpGetComputerObjectDn: Passed OU doesn't match cracked DN: %ws %ws\n",
LocalComputerObjectDn,
CrackedName->rItems[0].pName ));
NetStatus = ERROR_FILE_EXISTS;
goto Cleanup;
}
//
// Otherwise, just use the cracked name
//
} else {
wcscpy( LocalComputerObjectDn, CrackedName->rItems[0].pName );
}
//
// We've got the computer object DN from the existing account
//
NetStatus = NO_ERROR;
goto Cleanup;
}
//
// Be verbose
//
NetpLog(( "NetpGetComputerObjectDn: Crack results: \tAccount does not exist\n" ));
//
// At this point, we know that the account does not exist
// If OU is passed, simply verify it
//
if ( OU != NULL ) {
LdapStatus = ldap_compare_s( Ldap,
OU,
NETSETUPP_OBJECTCLASS,
NETSETUPP_ORGANIZATIONALUNIT );
if ( LdapStatus == LDAP_COMPARE_FALSE ) {
NetStatus = ERROR_FILE_NOT_FOUND;
NetpLog(( "NetpGetComputerObjectDn: Specified path '%ws' is not an OU\n", OU ));
goto Cleanup;
} else if ( LdapStatus != LDAP_COMPARE_TRUE ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpGetComputerObjectDn: ldap_compare_s failed: 0x%lx 0x%lx\n",
LdapStatus, NetStatus ));
goto Cleanup;
}
//
// OU has been verified.
// Allocate the computer object DN.
//
NetStatus = NetApiBufferAllocate(
( wcslen(NETSETUPP_OBJ_PREFIX) +
wcslen(ComputerName) + 1 + wcslen(OU) + 1 ) * sizeof(WCHAR),
&LocalComputerObjectDn );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
//
// We've got the computer object DN from the OU passed
//
swprintf( LocalComputerObjectDn, L"%ws%ws,%ws", NETSETUPP_OBJ_PREFIX, ComputerName, OU );
NetpLog(( "NetpGetComputerObjectDn: Got DN %ws from the passed OU\n", LocalComputerObjectDn ));
NetStatus = NO_ERROR;
goto Cleanup;
}
//
// At this point, the account does not exist
// and no OU was specified. So get the default
// computer container DN.
//
if ( CrackedName != NULL ) {
DsFreeNameResultW( CrackedName );
CrackedName = NULL;
}
//
// Be verbose
//
NetpLog(( "NetpGetComputerObjectDn: Cracking Netbios domain name %ws into root DN on %ws\n",
NetbiosDomainNameWithBackslash,
DcInfo->DomainControllerName ));
NetStatus = DsCrackNamesW( hDs,
0,
DS_NT4_ACCOUNT_NAME,
DS_FQDN_1779_NAME,
1,
&NetbiosDomainNameWithBackslash,
&CrackedName );
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpGetComputerObjectDn: CrackNames failed for %ws: 0x%lx\n",
NetbiosDomainNameWithBackslash,
NetStatus ));
goto Cleanup ;
}
//
// Check for consistency
//
if ( CrackedName->cItems != 1 ) {
NetStatus = ERROR_DS_NAME_ERROR_NOT_UNIQUE;
NetpLog(( "NetpGetComputerObjectDn: Cracked Name %ws is not unique: %lu\n",
NetbiosDomainNameWithBackslash,
CrackedName->cItems ));
goto Cleanup ;
}
if ( CrackedName->rItems[0].status != DS_NAME_NO_ERROR ) {
NetpLog(( "NetpGetComputerObjectDn: CrackNames failed for %ws: substatus 0x%lx\n",
NetbiosDomainNameWithBackslash,
CrackedName->rItems[0].status ));
NetStatus = NetpCrackNamesStatus2Win32Error( CrackedName->rItems[0].status );
goto Cleanup ;
}
//
// Be verbose
//
NetpLog(( "NetpGetComputerObjectDn: Crack results: \tname = %ws\n",
CrackedName->rItems[0].pName ));
//
// Now get the computer container DN given the root DN.
// The DN of the computer container is part of the wellKnownObjects
// attribute in the root of the domain. So, look it up.
//
WellKnownObjectsAttr[0] = L"wellKnownObjects";
WellKnownObjectsAttr[1] = NULL;
LdapStatus = ldap_search_s( Ldap,
CrackedName->rItems[0].pName, // Root DN
LDAP_SCOPE_BASE,
L"objectclass=*",
WellKnownObjectsAttr,
0,
&LdapMessage);
if ( LdapStatus != LDAP_SUCCESS ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpGetComputerObjectDn: ldap_search_s failed 0x%lx 0x%lx\n",
LdapStatus,
NetStatus ));
goto Cleanup;
}
if ( ldap_count_entries(Ldap, LdapMessage) == 0 ) {
NetStatus = ERROR_FILE_NOT_FOUND;
NetpLog(( "NetpGetComputerObjectDn: ldap_search_s returned no entries\n" ));
goto Cleanup;
}
LdapEntry = ldap_first_entry( Ldap, LdapMessage );
if ( LdapEntry == NULL ) {
NetStatus = ERROR_FILE_NOT_FOUND;
NetpLog(( "NetpGetComputerObjectDn: ldap_first_entry returned NULL\n" ));
goto Cleanup;
}
WellKnownObjectValues = ldap_get_valuesW( Ldap,
LdapEntry,
L"wellKnownObjects" );
if ( WellKnownObjectValues == NULL ) {
NetStatus = ERROR_FILE_NOT_FOUND;
NetpLog(( "NetpGetComputerObjectDn: ldap_get_valuesW returned NULL\n" ));
goto Cleanup;
}
//
// Lookup the default computer container
//
for ( Index = 0; WellKnownObjectValues[Index] != NULL; Index++ ) {
//
// The structure of this particular field is:
// L"B:32:GUID:DN" where GUID is AA312825768811D1ADED00C04FD8D5CD
//
if ( _wcsnicmp( WellKnownObjectValues[Index],
NETSETUPP_COMPUTER_CONTAINER_GUID_IN_B32_FORM,
wcslen(NETSETUPP_COMPUTER_CONTAINER_GUID_IN_B32_FORM) ) == 0 ) {
ComputerContainerDn = WellKnownObjectValues[Index] +
wcslen(NETSETUPP_COMPUTER_CONTAINER_GUID_IN_B32_FORM);
break;
}
}
//
// If we couldn't get the computer container DN, error out
//
if ( ComputerContainerDn == NULL || *ComputerContainerDn == L'\0' ) {
NetpLog(( "NetpGetComputerObjectDn: Couldn't get computer container DN\n" ));
NetStatus = ERROR_FILE_NOT_FOUND;
goto Cleanup;
}
//
// Allocate the computer object DN
//
NetStatus = NetApiBufferAllocate(
( wcslen(NETSETUPP_OBJ_PREFIX) +
wcslen(ComputerName) + 1 + wcslen(ComputerContainerDn) + 1 ) * sizeof(WCHAR),
&LocalComputerObjectDn );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
//
// We've got the computer object DN from the default computer container
//
swprintf( LocalComputerObjectDn, L"%ws%ws,%ws", NETSETUPP_OBJ_PREFIX, ComputerName, ComputerContainerDn );
NetpLog(( "NetpGetComputerObjectDn: Got DN %ws from the default computer container\n", LocalComputerObjectDn ));
NetStatus = NO_ERROR;
//
// Free locally used resources
//
Cleanup:
if ( hDs ) {
DsUnBind( &hDs );
}
if ( CrackedName ) {
DsFreeNameResultW( CrackedName );
}
if ( AuthId ) {
DsFreePasswordCredentials( AuthId );
}
if ( WellKnownObjectValues != NULL ) {
ldap_value_free( WellKnownObjectValues );
}
if ( NameToCrack != NULL ) {
LocalFree( NameToCrack );
}
if ( AccountUserName != NULL ) {
NetApiBufferFree( AccountUserName );
}
if ( AccountDomainName != NULL ) {
NetApiBufferFree( AccountDomainName );
}
if ( NetbiosDomainNameWithBackslash != NULL ) {
LocalFree( NetbiosDomainNameWithBackslash );
}
if ( LdapMessage != NULL ) {
ldap_msgfree( LdapMessage );
}
if ( NetStatus == NO_ERROR ) {
*ComputerObjectDn = LocalComputerObjectDn;
} else if ( LocalComputerObjectDn != NULL ) {
NetApiBufferFree( LocalComputerObjectDn );
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpModifyComputerObjectInDs(
IN LPWSTR DC,
IN PLDAP Ldap,
IN LPWSTR ComputerName,
IN LPWSTR ComputerObjectDn,
IN ULONG NumberOfAttributes,
IN OUT PNETSETUPP_MACH_ACC_ATTRIBUTE Attrib
)
/*++
Routine Description:
Create a computer account in the specified OU.
Arguments:
DC -- Domain controller on which to create the object
Ldap -- Ldap binding to the DC
ComputerName -- Name of the computer being joined
ComputerObjectDn -- DN of computer object being modified
NumberOfAttributes -- Number of attributes passed
Attrib -- List of attribute structures. The list may
be modified on return so that only those entries
that were not already set in the DS will be preserved.
NOTE: If the machine password (unicodePwd) is passed as one of the attributes,
it must be the last entry in the attribute list because this order is assumed
by the fail-over code below.
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
ULONG LdapStatus;
PWSTR *AttribTypesList = NULL;
LDAPMod *ModList = NULL;
PLDAPMod *Mods = NULL;
LDAPMessage *Message = NULL, *Entry;
ULONG Index;
ULONG ModIndex = 0;
BOOL NewAccount = FALSE;
PWSTR SamAccountName = NULL;
USER_INFO_1 *CurrentUI1 = NULL;
//
// Allocate storage for the attribute list and the modifications block
//
NetStatus = NetApiBufferAllocate( (NumberOfAttributes+1)*sizeof(PWSTR),
(PVOID *) &AttribTypesList );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
NetStatus = NetApiBufferAllocate( NumberOfAttributes * sizeof(LDAPMod),
(PVOID *) &ModList );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
NetStatus = NetApiBufferAllocate( (NumberOfAttributes+1)*sizeof(PLDAPMod),
(PVOID *) &Mods );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
//
// Build modification list given the list of attributes
//
NetpLog(( "NetpModifyComputerObjectInDs: Initial attribute values:\n" ));
for ( Index = 0; Index < NumberOfAttributes; Index++ ) {
ModList[Index].mod_op = LDAP_MOD_ADD; // Set to add. We may adjust this below.
ModList[Index].mod_type = Attrib[Index].AttribType;
ModList[Index].mod_values = Attrib[Index].AttribValues;
//
// Be verbose - output all values of each attribute
//
NetpLog(( "\t\t%ws =", Attrib[Index].AttribType ));
//
// Don't leak sensitive info!
//
if ( _wcsicmp( Attrib[Index].AttribType, NETSETUPP_UNICODEPWD ) == 0 ) {
NetpLog(( " <SomePassword>" ));
} else {
PWSTR *CurrentValues;
for ( CurrentValues = Attrib[Index].AttribValues; *CurrentValues != NULL; CurrentValues++ ) {
NetpLog(( " %ws", *CurrentValues ));
}
}
NetpLog(( "\n" ));
}
//
// Now check which attribute values are already set in the DS
//
for ( Index = 0; Index < NumberOfAttributes; Index++ ) {
AttribTypesList[Index] = Attrib[Index].AttribType;
}
AttribTypesList[Index] = NULL; // Terminate the list
LdapStatus = ldap_search_s( Ldap,
ComputerObjectDn,
LDAP_SCOPE_BASE,
NULL,
AttribTypesList,
0,
&Message );
//
// If the computer object does not exist,
// we need to add all attributes
//
if ( LdapStatus == LDAP_NO_SUCH_OBJECT ) {
NetpLog(( "NetpModifyComputerObjectInDs: Computer Object does not exist in OU\n" ));
NewAccount = TRUE;
for ( ModIndex = 0; ModIndex < NumberOfAttributes; ModIndex++ ) {
Mods[ModIndex] = &ModList[ModIndex];
}
//
// Terminate the modification list
//
Mods[ModIndex] = NULL;
//
// Otherwise see which attribute values need modification
//
} else if ( LdapStatus == LDAP_SUCCESS ) {
NetpLog(( "NetpModifyComputerObjectInDs: Computer Object already exists in OU:\n" ));
//
// Get the first entry (there should be only one)
//
Entry = ldap_first_entry( Ldap, Message );
//
// Loop through the attributes and weed out those values
// which are already set.
//
for ( Index = 0; Index < NumberOfAttributes; Index++ ) {
PWSTR *AttribValueRet = NULL;
//
// Be verbose - output the values returned for each type
//
NetpLog(( "\t\t%ws =", Attrib[Index].AttribType ));
AttribValueRet = ldap_get_values( Ldap, Entry, Attrib[Index].AttribType );
if ( AttribValueRet != NULL ) {
//
// Don't leak sensitive info!
//
if ( _wcsicmp( Attrib[Index].AttribType, NETSETUPP_UNICODEPWD ) == 0 ) {
NetpLog(( " <SomePassword>" ));
} else {
PWSTR *CurrentValueRet;
for ( CurrentValueRet = AttribValueRet; *CurrentValueRet != NULL; CurrentValueRet++ ) {
NetpLog(( " %ws", *CurrentValueRet ));
}
}
//
// Remove those values from the modification which are alredy set
//
NetpRemoveDuplicateStrings( AttribValueRet, Attrib[Index].AttribValues );
ldap_value_free( AttribValueRet );
//
// If this is a single valued attribute, we need to
// replace (not add) its value since it already exists in the DS
//
if ( (Attrib[Index].AttribFlags & NETSETUPP_MULTIVAL_ATTRIB) == 0 ) {
ModList[Index].mod_op = LDAP_MOD_REPLACE;
}
}
NetpLog(( "\n" ));
//
// If there are any attribute values which are
// not already set, add them to the modification.
//
if ( *(Attrib[Index].AttribValues) != NULL ) {
Mods[ModIndex] = &ModList[Index];
ModIndex ++;
}
}
//
// Terminate the modification list
//
Mods[ModIndex] = NULL;
//
// Otherwise, error out
//
} else {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpModifyComputerObjectInDs: ldap_search_s failed: 0x%lx 0x%lx\n",
LdapStatus, NetStatus ));
goto Cleanup;
}
//
// If there are no modifications to do
// we are done.
//
if ( ModIndex == 0 ) {
NetpLog(( "NetpModifyComputerObjectInDs: There are _NO_ modifications to do\n" ));
NetStatus = NERR_Success;
goto Cleanup;
}
//
// Be verbose - output the attribute values to be set
//
NetpLog(( "NetpModifyComputerObjectInDs: Attribute values to set:\n" ));
for ( Index = 0; Mods[Index] != NULL; Index++ ) {
NetpLog(( "\t\t%ws =", (*(Mods[Index])).mod_type ));
//
// Don't leak sensitive info!
//
if ( _wcsicmp( (*(Mods[Index])).mod_type, NETSETUPP_UNICODEPWD ) == 0 ) {
NetpLog(( " <SomePassword>" ));
} else {
ULONG ValIndex;
for ( ValIndex = 0; ((*(Mods[Index])).mod_values)[ValIndex] != NULL; ValIndex++ ) {
NetpLog(( " %ws", ((*(Mods[Index])).mod_values)[ValIndex] ));
}
}
NetpLog(( "\n" ));
}
//
// Now, add the missing attributes
//
if ( NewAccount ) {
LdapStatus = ldap_add_s( Ldap, ComputerObjectDn, Mods );
} else {
LdapStatus = ldap_modify_s( Ldap, ComputerObjectDn, Mods );
}
//
// If we tried to create against a server that doesn't support 128 bit encryption,
// we get LDAP_UNWILLING_TO_PERFORM back from the server. So, we'll create the
// account again without the password, and then reset it using NetApi.
//
if ( LdapStatus == LDAP_UNWILLING_TO_PERFORM ) {
LPWSTR MachinePassword;
NetpLog(( "NetpModifyComputerObjectInDs: ldap_modify_s (1) returned"
" LDAP_UNWILLING_TO_PERFORM. Trying to recover.\n" ));
//
// If we didn't try to set a password, there is no legitimate reason
// for the add to fail.
//
if ( _wcsicmp( (*(Mods[ModIndex-1])).mod_type, NETSETUPP_UNICODEPWD ) != 0 ) {
NetpLog(( "NetpModifyComputerObjectInDs: ldap_modify_s retuned LDAP_UNWILLING_TO_PERFORM"
" but password was not being set\n" ));
NetStatus = LdapMapErrorToWin32( LdapStatus );
goto Cleanup;
}
MachinePassword = *((*(Mods[ModIndex-1])).mod_values);
//
// If there are other entries besides the password, retry to add them
//
if ( ModIndex > 1 ) {
Mods[ModIndex-1] = NULL;
if ( NewAccount ) {
LdapStatus = ldap_add_s( Ldap, ComputerObjectDn, Mods );
} else{
LdapStatus = ldap_modify_s( Ldap, ComputerObjectDn, Mods );
}
if ( LdapStatus != LDAP_SUCCESS ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpModifyComputerObjectInDs: ldap_modify_s (2) failed: 0x%lx 0x%lx\n",
LdapStatus, NetStatus ));
goto Cleanup;
}
}
//
// Reset the password
//
NetStatus = NetpGetMachineAccountName( ComputerName, &SamAccountName );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
NetStatus = NetUserGetInfo( DC, SamAccountName, 1, ( PBYTE * )&CurrentUI1 );
if ( NetStatus == NERR_Success ) {
CurrentUI1->usri1_password = MachinePassword;
if ( !FLAG_ON( CurrentUI1->usri1_flags, UF_WORKSTATION_TRUST_ACCOUNT ) ) {
CurrentUI1->usri1_flags = UF_WORKSTATION_TRUST_ACCOUNT | UF_SCRIPT;
}
NetStatus = NetUserSetInfo( DC, SamAccountName, 1, ( PBYTE )CurrentUI1, NULL );
if ( NetStatus != NERR_Success ) {
NetpLog(( "NetpModifyComputerObjectInDs: NetUserSetInfo failed on '%ws' for '%ws': 0x%lx."
" Deleting the account.\n",
DC, SamAccountName, NetStatus ));
}
} else {
NetpLog(( "NetpModifyComputerObjectInDs: NetUserGetInfo failed on '%ws' for '%ws': 0x%lx."
" Deleting the account.\n",
DC, SamAccountName, NetStatus ));
}
//
// Delete the user if it fails
//
if ( NetStatus != NERR_Success ) {
LdapStatus = ldap_delete_s( Ldap, ComputerObjectDn );
if ( LdapStatus != LDAP_SUCCESS ) {
NetpLog(( "NetpModifyComputerObjectInDs: Failed to delete '%ws': 0x%lx 0x%lx\n",
ComputerObjectDn, LdapStatus, LdapMapErrorToWin32( LdapStatus ) ));
}
goto Cleanup;
}
} else if ( LdapStatus != LDAP_SUCCESS ) {
//
// Return the error code the user understands
//
if ( LdapStatus == LDAP_ALREADY_EXISTS ) {
NetStatus = NERR_UserExists;
} else {
NetStatus = LdapMapErrorToWin32( LdapStatus );
}
NetpLog(( "NetpModifyComputerObjectInDs: ldap_modify_s (1) failed: 0x%lx 0x%lx\n",
LdapStatus, NetStatus ));
goto Cleanup;
}
//
// Toggle the account type property. See comment in
// NetpSetMachineAccountPasswordAndTypeEx() for an
// explanation of why this is needed. (Search for USN).
//
Mods[0] = NULL;
for ( Index = 0; Index < NumberOfAttributes; Index++ ) {
if ( _wcsicmp( ModList[Index].mod_type, NETSETUPP_USERACCOUNTCONTROL ) == 0 ) {
Mods[0] = &ModList[Index];
//
// If this is a single valued attribute, we need to
// replace (not add) its value since it already exists in the DS
//
if ( (Attrib[Index].AttribFlags & NETSETUPP_MULTIVAL_ATTRIB) == 0 ) {
ModList[Index].mod_op = LDAP_MOD_REPLACE;
}
break;
}
}
Mods[1] = NULL;
if ( Mods[0] != NULL ) {
//
// Disable the account
//
*(Mods[0]->mod_values) = NETSETUPP_ACCNT_TYPE_DISABLED;
LdapStatus = ldap_modify_s( Ldap, ComputerObjectDn, Mods );
if ( LdapStatus != LDAP_SUCCESS ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpModifyComputerObjectInDs: set UserAccountControl (1) on '%ws' failed: 0x%lx 0x%lx\n",
ComputerObjectDn, LdapStatus, NetStatus ));
goto Cleanup;
}
//
// Re-enable the account
//
*(Mods[0]->mod_values) = NETSETUPP_ACCNT_TYPE_ENABLED;
LdapStatus = ldap_modify_s( Ldap, ComputerObjectDn, Mods );
if ( LdapStatus != LDAP_SUCCESS ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpModifyComputerObjectInDs: set UserAccountControl (2) on '%ws' failed: 0x%lx 0x%lx\n",
ComputerObjectDn, LdapStatus, NetStatus ));
goto Cleanup;
}
NetpLog(( "NetpModifyComputerObjectInDs: Toggled UserAccountControl successfully\n" ));
}
//
// If we've made up to this point, it's success!
//
NetStatus = NERR_Success;
//
// REVIEW: On error, consider using ldap_get_option to retrieve
// a human readable string describing the error that happend.
// Use LDAP_OPT_SERVER_ERROR as the option value. Return the
// string to the caller who may want to expose it to the user.
//
Cleanup:
if ( AttribTypesList != NULL ) {
NetApiBufferFree( AttribTypesList );
}
if ( ModList != NULL ) {
NetApiBufferFree( ModList );
}
if ( Mods != NULL ) {
NetApiBufferFree( Mods );
}
if ( Message != NULL ) {
ldap_msgfree( Message );
}
if ( SamAccountName != NULL ) {
NetApiBufferFree( SamAccountName );
}
if ( CurrentUI1 != NULL ) {
NetApiBufferFree( CurrentUI1 );
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpCreateComputerObjectInDs(
IN PDOMAIN_CONTROLLER_INFO DcInfo,
IN LPWSTR Account OPTIONAL,
IN LPWSTR Password OPTIONAL,
IN LPWSTR ComputerName,
IN LPWSTR MachinePassword OPTIONAL,
IN LPWSTR DnsHostName OPTIONAL,
IN LPWSTR OU OPTIONAL
)
/*++
Routine Description:
Create a computer account in the specified OU.
Arguments:
DcInfo -- Domain controller on which to create the object
Account -- Account to use for the LDAP and DS binds.
If NULL, the default creds of the current user
context are used.
Password -- Password to used for the binds. Ignored if
Account is NULL.
ComputerName -- (Netbios) Name of the computer being joined
MachinePassword -- Password to set on the machine object
DnsHostName -- DNS host name of the computer being joined
OU -- OU under which to create the object.
The name must be a fully qualified name
e.g.: "ou=test,dc=ntdev,dc=microsoft,dc=com"
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus;
PLDAP Ldap = NULL;
PWSTR ComputerObjectDn = NULL;
PWSTR SamAccountName = NULL;
PWSTR DnsSpn = NULL;
PWSTR NetbiosSpn = NULL;
ULONG AttribCount;
PWSTR ClassValues[ 2 ];
PWSTR AccntNameValues[ 2 ];
PWSTR DnsHostNameValues[ 2 ];
PWSTR SpnValues[ 3 ];
PWSTR PasswordValues[ 2 ];
PWSTR AccntTypeValues[ 2 ];
NETSETUPP_MACH_ACC_ATTRIBUTE Attributes[NETSETUPP_COMP_OBJ_ATTR_COUNT];
USER_INFO_1 *CurrentUI1 = NULL;
//
// Validate parameters
//
if ( DcInfo == NULL ) {
NetpLog(( "NetpCreateComputerObjectInDs: No DcInfo passed\n" ));
NetStatus = ERROR_INVALID_PARAMETER;
goto Cleanup;
}
if ( ComputerName == NULL ) {
NetpLog(( "NetpCreateComputerObjectInDs: No ComputerName passed\n" ));
NetStatus = ERROR_INVALID_PARAMETER;
goto Cleanup;
}
//
// Verify that the DC runs DS
//
if ( (DcInfo->Flags & DS_DS_FLAG) == 0 ||
(DcInfo->Flags & DS_WRITABLE_FLAG) == 0 ) {
NetpLog(( "NetpCreateComputerObjectInDs: DC passed '%ws' doesn't have writable DS 0x%lx\n",
DcInfo->DomainControllerName,
DcInfo->Flags ));
NetStatus = ERROR_NOT_SUPPORTED;
goto Cleanup;
}
//
// First, try to bind to the server
//
NetStatus = NetpLdapBind( DcInfo->DomainControllerName, Account, Password, &Ldap );
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpCreateComputerObjectInDs: NetpLdapBind failed: 0x%lx\n", NetStatus ));
goto Cleanup;
}
//
// Next get the computer object DN
//
NetStatus = NetpGetComputerObjectDn( DcInfo,
Account,
Password,
Ldap,
ComputerName,
OU,
&ComputerObjectDn );
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpCreateComputerObjectInDs: NetpGetComputerObjectDn failed: 0x%lx\n", NetStatus ));
//
// Return meaningful error
//
if ( NetStatus == ERROR_FILE_EXISTS ) {
NetStatus = NERR_UserExists;
}
goto Cleanup;
}
//
// Get SAM account name
//
NetStatus = NetpGetMachineAccountName( ComputerName, &SamAccountName );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
//
// Build SPN values
//
if ( DnsHostName != NULL ) {
DnsSpn = LocalAlloc( 0, (wcslen(NETSETUPP_HOST_SPN_PREFIX) + wcslen(DnsHostName) + 1) * sizeof(WCHAR) );
if ( DnsSpn == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
swprintf( DnsSpn, L"%ws%ws", NETSETUPP_HOST_SPN_PREFIX, DnsHostName );
NetbiosSpn = LocalAlloc( 0, (wcslen(NETSETUPP_HOST_SPN_PREFIX) + wcslen(ComputerName) + 1) * sizeof(WCHAR) );
if ( Netbios == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
swprintf( NetbiosSpn, L"%ws%ws", NETSETUPP_HOST_SPN_PREFIX, ComputerName );
}
//
// Prepare the list of attributes that need to be set in the DS
//
// Always keep unicodePwd as the last entry because this order is
// assumed by the API called below.
//
AttribCount = 0;
Attributes[AttribCount].AttribType = NETSETUPP_OBJECTCLASS; //
Attributes[AttribCount].AttribFlags = NETSETUPP_MULTIVAL_ATTRIB; //
Attributes[AttribCount].AttribValues = ClassValues; // ObjectClass
ClassValues[ 0 ] = NETSETUPP_COMPUTER_OBJECT; //
ClassValues[ 1 ] = NULL; //
AttribCount ++;
Attributes[AttribCount].AttribType = NETSETUPP_SAMACCOUNTNAME; //
Attributes[AttribCount].AttribFlags = 0; //
Attributes[AttribCount].AttribValues = AccntNameValues; // SamAccountName
AccntNameValues[ 0 ] = SamAccountName; //
AccntNameValues[ 1 ] = NULL; //
AttribCount ++;
Attributes[AttribCount].AttribType = NETSETUPP_USERACCOUNTCONTROL; //
Attributes[AttribCount].AttribFlags = 0; //
Attributes[AttribCount].AttribValues = AccntTypeValues; // userAccountControl
AccntTypeValues[ 0 ] = NETSETUPP_ACCNT_TYPE_ENABLED; //
AccntTypeValues[ 1 ] = NULL; //
AttribCount ++;
if ( DnsHostName != NULL ) {
Attributes[AttribCount].AttribType = NETSETUPP_DNSHOSTNAME; //
Attributes[AttribCount].AttribFlags = 0; //
Attributes[AttribCount].AttribValues = DnsHostNameValues; // DnsHostName
DnsHostNameValues[ 0 ] = DnsHostName; //
DnsHostNameValues[ 1 ] = NULL; //
AttribCount ++;
Attributes[AttribCount].AttribType = NETSETUPP_SERVICEPRINCIPALNAME; //
Attributes[AttribCount].AttribFlags = NETSETUPP_MULTIVAL_ATTRIB; //
Attributes[AttribCount].AttribValues = SpnValues; // ServicePrincipalName
SpnValues[ 0 ] = DnsSpn; //
SpnValues[ 1 ] = NetbiosSpn; //
SpnValues[ 2 ] = NULL; //
AttribCount ++;
}
//
// The following attribute is the machine password. We avoid
// updating it though ldap because it is hard to ensure that
// the ldap session uses the 128-bit encryption required by
// SAM on the DC for password updates.
//
// To enforce the encryption, we would need to set an option
// LDAP_OPT_ENCRYPT via a ldap_set_option call following ldap_open
// before calling ldap_bind_s. However, there is no guarantee that
// the established connection will use 128 bit encryption; it may
// use 56 bit encryption if either side does not support strong
// encryption. We could, in principle, find out the resulting encryption
// strength using some QueryContextAttribute call, but it's just too much
// trouble. So, we will just create the account without the password and
// we will then update the password using good old Net/SAM API.
//
#if 0
Attributes[AttribCount].AttribType = NETSETUPP_UNICODEPWD; //
Attributes[AttribCount].AttribFlags = 0; //
Attributes[AttribCount].AttribValues = PasswordValues; // unicodePwd
PasswordValues[ 0 ] = MachinePassword; //
PasswordValues[ 1 ] = NULL; //
AttribCount ++;
#endif
//
// Modify the computer object given the list of attributes
//
NetStatus = NetpModifyComputerObjectInDs( DcInfo->DomainControllerName,
Ldap,
ComputerName,
ComputerObjectDn,
AttribCount,
Attributes );
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpCreateComputerObjectInDs: NetpModifyComputerObjectInDs failed: 0x%lx\n", NetStatus ));
goto Cleanup;
}
//
// Now set the password using good old Net/SAM API.
// First get the current account info.
//
NetStatus = NetUserGetInfo( DcInfo->DomainControllerName,
SamAccountName,
1,
( PBYTE * )&CurrentUI1 );
//
// Update the password and reset it
//
if ( NetStatus == NO_ERROR ) {
CurrentUI1->usri1_password = MachinePassword;
if ( !FLAG_ON( CurrentUI1->usri1_flags, UF_WORKSTATION_TRUST_ACCOUNT ) ) {
CurrentUI1->usri1_flags = UF_WORKSTATION_TRUST_ACCOUNT | UF_SCRIPT;
}
NetStatus = NetUserSetInfo( DcInfo->DomainControllerName,
SamAccountName,
1,
( PBYTE )CurrentUI1,
NULL );
if ( NetStatus != NERR_Success ) {
NetpLog(( "NetpCreateComputerObjectInDs: NetUserSetInfo failed on '%ws' for '%ws': 0x%lx."
" Deleting the account.\n",
DcInfo->DomainControllerName,
SamAccountName,
NetStatus ));
}
} else {
NetpLog(( "NetpCreateComputerObjectInDs: NetUserGetInfo failed on '%ws' for '%ws': 0x%lx."
" Deleting the account.\n",
DcInfo->DomainControllerName,
SamAccountName,
NetStatus ));
}
//
// Delete the account if we couldn't set the password.
// Ignore the failure if we cannot delete the account for some reason.
//
if ( NetStatus != NO_ERROR ) {
ULONG LdapStatus;
LdapStatus = ldap_delete_s( Ldap, ComputerObjectDn );
if ( LdapStatus != LDAP_SUCCESS ) {
NetpLog(( "NetpCreateComputerObjectInDs: Failed to delete '%ws': 0x%lx 0x%lx\n",
ComputerObjectDn, LdapStatus, LdapMapErrorToWin32( LdapStatus ) ));
}
}
//
// Tell Netlogon that it should avoid setting
// DnsHostName and SPN until the reboot
//
if ( NetStatus == NO_ERROR && DnsHostName != NULL ) {
NetpAvoidNetlogonSpnSet( TRUE );
}
Cleanup:
if ( Ldap != NULL ) {
NetpLdapUnbind( Ldap );
}
if ( ComputerObjectDn != NULL ) {
NetApiBufferFree( ComputerObjectDn );
}
if ( SamAccountName != NULL ) {
NetApiBufferFree( SamAccountName );
}
if ( DnsSpn != NULL ) {
LocalFree( DnsSpn );
}
if ( NetbiosSpn != NULL ) {
LocalFree( NetbiosSpn );
}
if ( CurrentUI1 != NULL ) {
NetApiBufferFree( CurrentUI1 );
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpSetDnsHostNameAndSpn(
IN PDOMAIN_CONTROLLER_INFO DcInfo,
IN LPWSTR Account,
IN LPWSTR Password,
IN LPWSTR ComputerName,
IN LPWSTR DnsHostName
)
/*++
Routine Description:
Set DnsHostName and HOST SPN (ServicePrincipalName) attributes on the
computer object in the DS.
Arguments:
DcInfo -- Domain controller on which to create the object
Account -- Account to use for the LDAP bind
Password -- Password to used for the bind
ComputerName -- Name of the computer being joined
DnsHostName -- DNS host name of the machine
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus;
HANDLE hToken = NULL;
PLDAP Ldap = NULL;
PWSTR ComputerObjectDn = NULL;
PWSTR DnsHostNameValues[ 2 ];
PWSTR SpnValues[ 3 ] = {NULL};
NETSETUPP_MACH_ACC_ATTRIBUTE Attributes[ 2 ];
//
// REVIEW: Kerberos has a bug such that if this server is joined remotely
// and the impersonated client connected to this server using NTLM (as is
// the case if this server is not a member of a domain before the join),
// explicit credentials supplied to ldap_bind or DsBindWithCredW will not
// work (AcquireCredentialsHandle call will fail). To get around this, we
// temporarily un-impersonates, bind to the DC, and then impersonate again
// at the end of this routine.
//
if ( OpenThreadToken( GetCurrentThread(),
TOKEN_IMPERSONATE,
TRUE,
&hToken ) ) {
if ( RevertToSelf() == 0 ) {
NetpLog(( "NetpSetDnsHostNameAndSpn: RevertToSelf failed: 0x%lx\n",
GetLastError() ));
}
} else {
NetpLog(( "NetpSetDnsHostNameAndSpn: OpenThreadToken failed: 0x%lx\n",
GetLastError() ));
}
//
// Bind to the DC
//
NetStatus = NetpLdapBind( DcInfo->DomainControllerName, Account, Password, &Ldap );
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpSetDnsHostNameAndSpn: NetpLdapBind failed: 0x%lx\n", NetStatus ));
goto Cleanup;
}
//
// Next get the computer object DN
//
NetStatus = NetpGetComputerObjectDn( DcInfo,
Account,
Password,
Ldap,
ComputerName,
NULL, // Default computer container
&ComputerObjectDn );
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpSetDnsHostNameAndSpn: NetpGetComputerObjectDn failed: 0x%lx\n", NetStatus ));
//
// Return meaningful error
//
if ( NetStatus == ERROR_FILE_EXISTS ) {
NetStatus = NERR_UserExists;
}
goto Cleanup;
}
//
// Build DnsHostName values
//
DnsHostNameValues[ 0 ] = DnsHostName;
DnsHostNameValues[ 1 ] = NULL;
//
// Build SPN values
//
SpnValues[0] = LocalAlloc( 0,
(wcslen(NETSETUPP_HOST_SPN_PREFIX) + wcslen(DnsHostName) + 1) * sizeof(WCHAR) );
if ( SpnValues[0] == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
swprintf( SpnValues[0], L"%ws%ws", NETSETUPP_HOST_SPN_PREFIX, DnsHostName );
SpnValues[1] = LocalAlloc( 0,
(wcslen(NETSETUPP_HOST_SPN_PREFIX) + wcslen(ComputerName) + 1) * sizeof(WCHAR) );
if ( SpnValues[1] == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
swprintf( SpnValues[1], L"%ws%ws", NETSETUPP_HOST_SPN_PREFIX, ComputerName );
SpnValues[2] = NULL;
//
// Prepare the list of attributes that need to be set in the DS
//
Attributes[0].AttribType = NETSETUPP_DNSHOSTNAME; //
Attributes[0].AttribFlags = 0; // DnsHostName
Attributes[0].AttribValues = DnsHostNameValues; //
Attributes[1].AttribType = NETSETUPP_SERVICEPRINCIPALNAME; //
Attributes[1].AttribFlags = NETSETUPP_MULTIVAL_ATTRIB; // ServicePrincipalName
Attributes[1].AttribValues = SpnValues; //
//
// Modify the computer object given the list of attributes
//
NetStatus = NetpModifyComputerObjectInDs( DcInfo->DomainControllerName,
Ldap,
ComputerName,
ComputerObjectDn,
2,
Attributes );
//
// Tell Netlogon that it should avoid setting
// DnsHostName and SPN until the reboot
//
if ( NetStatus == NO_ERROR ) {
NetpAvoidNetlogonSpnSet( TRUE );
}
Cleanup:
if ( Ldap != NULL ) {
NetpLdapUnbind( Ldap );
}
//
// REVIEW: Revert the impersonation
//
if ( hToken != NULL ) {
if ( SetThreadToken( NULL, hToken ) == 0 ) {
NetpLog(( "NetpSetDnsHostNameAndSpn: SetThreadToken failed: 0x%lx\n",
GetLastError() ));
}
CloseHandle( hToken );
}
//
// Free locally allocated memory
//
if ( ComputerObjectDn != NULL ) {
NetApiBufferFree( ComputerObjectDn );
}
if ( SpnValues[0] != NULL ) {
LocalFree( SpnValues[0] );
}
if ( SpnValues[1] != NULL ) {
LocalFree( SpnValues[1] );
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpCreateComputerObjectInOU(
IN LPWSTR DC,
IN LPWSTR OU,
IN LPWSTR ComputerName,
IN LPWSTR Account,
IN LPWSTR Password,
IN LPWSTR MachinePassword
)
/*++
Routine Description:
Create a computer account in the specified OU.
Arguments:
DC -- Domain controller on which to create the object
OU -- OU under which to create the object.
The name must be a fully qualified name
e.g.: "ou=test,dc=ntdev,dc=microsoft,dc=com"
ComputerName -- Name of the computer being joined
Account -- Account to use for the LDAP bind
Password -- Password to used for the bind
MachinePassword -- Password to set on the machine object
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
ULONG LdapStatus;
PWSTR ObjectName = NULL, SamAccountName = NULL;
PLDAP Ldap = NULL;
PWSTR ClassValues[ 2 ];
PWSTR AccntNameValues[ 2 ];
PWSTR PasswordValues[ 2 ];
PWSTR AccntTypeValues[ 2 ];
PWSTR AttribTypes[NETSETUPP_COMP_OBJ_ATTR_COUNT];
ULONG AttribFlags[NETSETUPP_COMP_OBJ_ATTR_COUNT];
PWSTR *AttribValues[NETSETUPP_COMP_OBJ_ATTR_COUNT];
LDAPMod ModList[NETSETUPP_COMP_OBJ_ATTR_COUNT];
PLDAPMod Mods[NETSETUPP_COMP_OBJ_ATTR_COUNT + 1];
LDAPMessage *Message = NULL, *Entry;
USER_INFO_1 *CurrentUI1;
ULONG Index;
ULONG ModIndex = 0;
BOOL NewAccount = FALSE;
//
// First, try to bind to the server
//
NetStatus = NetpLdapBind( DC, Account, Password, &Ldap );
if ( NetStatus != NO_ERROR ) {
NetpLog(( "NetpCreateComputerObjectInOU: NetpLdapBind failed: 0x%lx\n", NetStatus ));
goto Cleanup;
}
//
// Next verify that the OU exists
//
LdapStatus = ldap_compare_s( Ldap,
OU,
NETSETUPP_OBJECTCLASS,
NETSETUPP_ORGANIZATIONALUNIT );
if ( LdapStatus == LDAP_COMPARE_FALSE ) {
NetStatus = ERROR_FILE_NOT_FOUND;
NetpLog(( "NetpCreateComputerObjectInOU: Specified path '%ws' is not an OU\n", OU ));
goto Cleanup;
} else if ( LdapStatus != LDAP_COMPARE_TRUE ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpCreateComputerObjectInOU: ldap_compare_s failed: 0x%lx 0x%lx\n",
LdapStatus, NetStatus ));
goto Cleanup;
}
//
// Allocate the object name
//
NetStatus = NetApiBufferAllocate(
sizeof( NETSETUPP_OBJ_PREFIX ) + ( wcslen( OU ) + wcslen( ComputerName ) + 1 ) * sizeof( WCHAR ),
( PVOID * ) &ObjectName );
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
swprintf( ObjectName, L"%ws%ws,%ws", NETSETUPP_OBJ_PREFIX, ComputerName, OU );
NetStatus = NetpGetMachineAccountName(ComputerName, &SamAccountName);
if ( NetStatus != NO_ERROR ) {
goto Cleanup;
}
//
// Build attribute values. Always keep unicodePwd as the last entry
// because this order is assumed by the fail-over code below.
//
AttribTypes[ 0 ] = NETSETUPP_OBJECTCLASS; //
AttribFlags[ 0 ] = NETSETUPP_MULTIVAL_ATTRIB; //
AttribValues[ 0 ] = ClassValues; // ObjectClass
ClassValues[ 0 ] = NETSETUPP_COMPUTER_OBJECT; //
ClassValues[ 1 ] = NULL; //
AttribTypes[ 1 ] = NETSETUPP_SAMACCOUNTNAME; //
AttribFlags[ 1 ] = 0; //
AttribValues[ 1 ] = AccntNameValues; // SamAccountName
AccntNameValues[ 0 ] = SamAccountName; //
AccntNameValues[ 1 ] = NULL; //
AttribTypes[ 2 ] = NETSETUPP_USERACCOUNTCONTROL; //
AttribFlags[ 2 ] = 0; //
AttribValues[ 2 ] = AccntTypeValues; // userAccountControl
AccntTypeValues[ 0 ] = NETSETUPP_ACCNT_TYPE_ENABLED; //
AccntTypeValues[ 1 ] = NULL; //
AttribTypes[ 3 ] = NETSETUPP_UNICODEPWD; //
AttribFlags[ 3 ] = 0; //
AttribValues[ 3 ] = PasswordValues; // unicodePwd
PasswordValues[ 0 ] = MachinePassword; //
PasswordValues[ 1 ] = NULL; //
//
// Build modification list given the list of attributes
//
NetpLog(( "NetpCreateComputerObjectInOU: Initial attribute values:\n" ));
for ( Index = 0; Index < NETSETUPP_COMP_OBJ_ATTR_COUNT; Index++ ) {
ModList[Index].mod_op = LDAP_MOD_ADD; // Set to add. We may adjust this below.
ModList[Index].mod_type = AttribTypes[Index];
ModList[Index].mod_values = AttribValues[Index];
//
// Be verbose - output all values of each attribute
//
NetpLog(( "\t\t%ws =", AttribTypes[Index] ));
//
// Don't leak sensitive info!
//
if ( _wcsicmp( AttribTypes[Index], NETSETUPP_UNICODEPWD ) == 0 ) {
NetpLog(( " <SomePassword>" ));
} else {
ULONG ValIndex;
for ( ValIndex = 0; AttribValues[Index][ValIndex] != NULL; ValIndex++ ) {
NetpLog(( " %ws", AttribValues[Index][ValIndex] ));
}
}
NetpLog(( "\n" ));
}
//
// Now check which attribute values are already set in the DS
//
LdapStatus = ldap_search_s( Ldap,
ObjectName,
LDAP_SCOPE_BASE,
NULL,
AttribTypes,
0,
&Message );
//
// If the computer object does not exist,
// we need to add all attributes
//
if ( LdapStatus == LDAP_NO_SUCH_OBJECT ) {
NetpLog(( "NetpCreateComputerObjectInOU: Computer Object does not exist in OU\n" ));
NewAccount = TRUE;
for ( ModIndex = 0; ModIndex < NETSETUPP_COMP_OBJ_ATTR_COUNT; ModIndex++ ) {
Mods[ModIndex] = &ModList[ModIndex];
}
//
// Terminate the modification list
//
Mods[ModIndex] = NULL;
//
// Otherwise see which attribute values need modification
//
} else if ( LdapStatus == LDAP_SUCCESS ) {
NetpLog(( "NetpCreateComputerObjectInOU: Computer Object already exists in OU:\n" ));
//
// Get the first entry (there should be only one)
//
Entry = ldap_first_entry( Ldap, Message );
//
// Loop through the attributes and weed out those values
// which are already set.
//
for ( Index = 0; Index < NETSETUPP_COMP_OBJ_ATTR_COUNT; Index++ ) {
PWSTR *AttribValueRet = NULL;
//
// Be verbose - output the values returned for each type
//
NetpLog(( "\t\t%ws =", AttribTypes[Index] ));
AttribValueRet = ldap_get_values( Ldap, Entry, AttribTypes[Index] );
if ( AttribValueRet != NULL ) {
//
// Don't leak sensitive info!
//
if ( _wcsicmp( AttribTypes[Index], NETSETUPP_UNICODEPWD ) == 0 ) {
NetpLog(( " <SomePassword>" ));
} else {
ULONG ValIndex;
for ( ValIndex = 0; AttribValueRet[ValIndex] != NULL; ValIndex++ ) {
NetpLog(( " %ws", AttribValueRet[ValIndex] ));
}
}
//
// Remove those values from the modification which are alredy set
//
NetpRemoveDuplicateStrings( AttribValueRet, AttribValues[Index] );
ldap_value_free( AttribValueRet );
//
// If this is a single valued attribute, we need to
// replace (not add) its value since it already exists in the DS
//
if ( (AttribFlags[Index] & NETSETUPP_MULTIVAL_ATTRIB) == 0 ) {
ModList[Index].mod_op = LDAP_MOD_REPLACE;
}
}
NetpLog(( "\n" ));
//
// If there are any attribute values which are
// not already set, add them to the modification.
//
if ( *AttribValues[Index] != NULL ) {
Mods[ModIndex] = &ModList[Index];
ModIndex ++;
}
}
//
// Terminate the modification list
//
Mods[ModIndex] = NULL;
//
// Otherwise, error out
//
} else {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpCreateComputerObjectInOU: ldap_search_s failed: 0x%lx 0x%lx\n",
LdapStatus, NetStatus ));
goto Cleanup;
}
//
// If there are no modifications to do
// we are done.
//
if ( ModIndex == 0 ) {
NetpLog(( "NetpCreateComputerObjectInOU: There are _NO_ modifications to do\n" ));
NetStatus = NERR_Success;
goto Cleanup;
}
//
// Be verbose - output the attribute values to be set
//
NetpLog(( "NetpCreateComputerObjectInOU: Attribute values to set:\n" ));
for ( Index = 0; Mods[Index] != NULL; Index++ ) {
NetpLog(( "\t\t%ws =", (*(Mods[Index])).mod_type ));
//
// Don't leak sensitive info!
//
if ( _wcsicmp( (*(Mods[Index])).mod_type, NETSETUPP_UNICODEPWD ) == 0 ) {
NetpLog(( " <SomePassword>" ));
} else {
ULONG ValIndex;
for ( ValIndex = 0; ((*(Mods[Index])).mod_values)[ValIndex] != NULL; ValIndex++ ) {
NetpLog(( " %ws", ((*(Mods[Index])).mod_values)[ValIndex] ));
}
}
NetpLog(( "\n" ));
}
//
// Now, add the missing attributes
//
if ( NewAccount ) {
LdapStatus = ldap_add_s( Ldap, ObjectName, Mods );
} else {
LdapStatus = ldap_modify_s( Ldap, ObjectName, Mods );
}
//
// If we tried to create against a server that doesn't support 128 bit encryption,
// we get LDAP_UNWILLING_TO_PERFORM back from the server. So, we'll create the
// account again without the password, and then reset it using NetApi.
//
if ( LdapStatus == LDAP_UNWILLING_TO_PERFORM ) {
NetpLog(( "NetpCreateComputerObjectInOU: ldap_modify_s (1) returned"
" LDAP_UNWILLING_TO_PERFORM. Trying to recover.\n" ));
//
// If we didn't try to set a password, there is no legitimate reason
// for the add to fail.
//
if ( _wcsicmp( (*(Mods[ModIndex-1])).mod_type, NETSETUPP_UNICODEPWD ) != 0 ) {
NetpLog(( "NetpCreateComputerObjectInOU: ldap_modify_s retuned LDAP_UNWILLING_TO_PERFORM"
" but password was not being set\n" ));
NetStatus = LdapMapErrorToWin32( LdapStatus );
goto Cleanup;
}
//
// If there are other entries besides the password, retry to add them
//
if ( ModIndex > 1 ) {
Mods[ModIndex-1] = NULL;
if ( NewAccount ) {
LdapStatus = ldap_add_s( Ldap, ObjectName, Mods );
} else{
LdapStatus = ldap_modify_s( Ldap, ObjectName, Mods );
}
if ( LdapStatus != LDAP_SUCCESS ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpCreateComputerObjectInOU: ldap_modify_s (2) failed: 0x%lx 0x%lx\n",
LdapStatus, NetStatus ));
goto Cleanup;
}
}
//
// Reset the password
//
NetStatus = NetUserGetInfo( DC, SamAccountName, 1, ( PBYTE * )&CurrentUI1 );
if ( NetStatus == NERR_Success ) {
CurrentUI1->usri1_password = MachinePassword;
if ( !FLAG_ON( CurrentUI1->usri1_flags, UF_WORKSTATION_TRUST_ACCOUNT ) ) {
CurrentUI1->usri1_flags = UF_WORKSTATION_TRUST_ACCOUNT | UF_SCRIPT;
}
NetStatus = NetUserSetInfo( DC, SamAccountName, 1, ( PBYTE )CurrentUI1, NULL );
if ( NetStatus != NERR_Success ) {
NetpLog(( "NetpCreateComputerObjectInOU: NetUserSetInfo failed on '%ws' for '%ws': 0x%lx."
" Deleting the account.\n",
DC, SamAccountName, NetStatus ));
}
NetApiBufferFree( CurrentUI1 );
} else {
NetpLog(( "NetpCreateComputerObjectInOU: NetUserGetInfo failed on '%ws' for '%ws': 0x%lx.",
" Deleting the account.\n",
DC, SamAccountName, NetStatus ));
}
//
// Delete the user if it fails
//
if ( NetStatus != NERR_Success ) {
LdapStatus = ldap_delete_s( Ldap, ObjectName );
if ( LdapStatus != LDAP_SUCCESS ) {
NetpLog(( "NetpCreateComputerObjectInOU: Failed to delete '%ws': 0x%lx 0x%lx\n",
ObjectName, LdapStatus, LdapMapErrorToWin32( LdapStatus ) ));
}
goto Cleanup;
}
} else if ( LdapStatus != LDAP_SUCCESS ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpCreateComputerObjectInOU: ldap_modify_s (1) failed: 0x%lx 0x%lx\n",
LdapStatus, NetStatus ));
goto Cleanup;
}
//
// Toggle the account type property. See comment in
// NetpSetMachineAccountPasswordAndTypeEx() for an
// explanation of why this is needed. (Search for USN).
//
Mods[0] = NULL;
for ( Index = 0; Index < NETSETUPP_COMP_OBJ_ATTR_COUNT; Index++ ) {
if ( _wcsicmp( ModList[Index].mod_type, NETSETUPP_USERACCOUNTCONTROL ) == 0 ) {
Mods[0] = &ModList[Index];
break;
}
}
Mods[1] = NULL;
if ( Mods[0] != NULL ) {
//
// Disable the account
//
AccntTypeValues[0] = NETSETUPP_ACCNT_TYPE_DISABLED;
LdapStatus = ldap_modify_s( Ldap, ObjectName, Mods );
if ( LdapStatus != LDAP_SUCCESS ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpCreateComputerObjectInOU: set UserAccountControl (1) on '%ws' failed: 0x%lx 0x%lx\n",
ObjectName, LdapStatus, NetStatus ));
goto Cleanup;
}
//
// Re-enable the account
//
AccntTypeValues[0] = NETSETUPP_ACCNT_TYPE_ENABLED;
LdapStatus = ldap_modify_s( Ldap, ObjectName, Mods );
if ( LdapStatus != LDAP_SUCCESS ) {
NetStatus = LdapMapErrorToWin32( LdapStatus );
NetpLog(( "NetpCreateComputerObjectInOU: set UserAccountControl (2) on '%ws' failed: 0x%lx 0x%lx\n",
ObjectName, LdapStatus, NetStatus ));
goto Cleanup;
}
} else {
NetpLog(( "NetpCreateComputerObjectInOU: UserAccountControl was not in the list\n" ));
}
//
// If we've made up to this point, it's success!
//
NetStatus = NERR_Success;
Cleanup:
if ( Ldap != NULL ) {
NetpLdapUnbind( Ldap );
}
if ( ObjectName != NULL ) {
NetApiBufferFree( ObjectName );
}
if ( SamAccountName != NULL ) {
NetApiBufferFree( SamAccountName );
}
if ( Message != NULL ) {
ldap_msgfree( Message );
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpDeleteComputerObjectInOU(
IN LPWSTR DC,
IN LPWSTR OU,
IN LPWSTR ComputerName,
IN LPWSTR Account,
IN LPWSTR Password
)
/*++
Routine Description:
This routine will actually create a computer account in the specified OU.
Arguments:
DC -- Domain controller on which to create the object
OU -- OU under which to create the object
ComputerName -- Name of the computer being joined
Account -- Account to use for the LDAP bind
Password -- Password to used for the bind
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
PWSTR ObjectName = NULL, SamAccountName = NULL;
PLDAP Ldap = NULL;
ULONG Len;
Len = wcslen( ComputerName );
NetStatus = NetApiBufferAllocate( sizeof( NETSETUPP_OBJ_PREFIX ) + ( wcslen( OU ) + Len + 1 ) * sizeof( WCHAR ),
( PVOID * ) &ObjectName );
if ( NetStatus == NERR_Success ) {
swprintf( ObjectName, L"%ws%ws,%ws", NETSETUPP_OBJ_PREFIX, ComputerName, OU );
NetStatus = NetApiBufferAllocate( ( Len + 2 ) * sizeof( WCHAR ),
( PVOID * )&SamAccountName );
if ( NetStatus == NERR_Success ) {
swprintf( SamAccountName, L"%ws$", ComputerName );
}
}
if ( NetStatus == NERR_Success ) {
//
// Try and bind to the server
//
NetStatus = NetpLdapBind( DC,
Account,
Password,
&Ldap );
if ( NetStatus == NERR_Success ) {
//
// Now, do the delete..
//
NetStatus = LdapMapErrorToWin32( ldap_delete_s( Ldap, ObjectName ) );
NetpLdapUnbind( Ldap );
}
}
if ( NetStatus != NERR_Success ) {
NetpLog(( "NetpCreateComputerObjectInOU failed with %lu\n",
NetStatus ));
}
NetApiBufferFree( ObjectName );
NetApiBufferFree( SamAccountName );
if ( NetStatus != NERR_Success ) {
NetpLog(( "NetpDeleteComputerObjectInOU failed with %lu\n",
NetStatus ));
}
return( NetStatus );
}
#if defined(REMOTE_BOOT)
NET_API_STATUS
NetpGetRemoteBootMachinePassword(
OUT LPWSTR Password
)
/*++
Routine Description:
Determine if this is a remote boot client, and if so return
the machine account password.
This information is obtained via an IOCTL to the redirector.
Arguments:
Password - returns the password. Should be at least PWLEN WCHARs long.
Return Value:
NERR_Success if the password is found.
An error if this is not a remote boot machine.
--*/
{
NET_API_STATUS NetStatus;
NTSTATUS Status;
UNICODE_STRING DeviceName;
IO_STATUS_BLOCK IoStatusBlock;
OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE RedirHandle = NULL;
UCHAR PacketBuffer[sizeof(ULONG)+64];
PLMMR_RB_CHECK_FOR_NEW_PASSWORD RequestPacket = (PLMMR_RB_CHECK_FOR_NEW_PASSWORD)PacketBuffer;
//
// Open the redirector device.
//
RtlInitUnicodeString(&DeviceName, DD_NFS_DEVICE_NAME_U);
InitializeObjectAttributes(
&ObjectAttributes,
&DeviceName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL
);
Status = NtOpenFile(
&RedirHandle,
SYNCHRONIZE,
&ObjectAttributes,
&IoStatusBlock,
0,
0
);
if (NT_SUCCESS(Status)) {
Status = IoStatusBlock.Status;
}
if (!NT_SUCCESS(Status)) {
NetpLog(( "Could not open redirector device %lx\n",
Status ));
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
//
// Send the request to the redir.
//
Status = NtFsControlFile(
RedirHandle,
NULL,
NULL,
NULL,
&IoStatusBlock,
FSCTL_LMMR_RB_CHECK_FOR_NEW_PASSWORD,
NULL, // no input buffer
0,
PacketBuffer,
sizeof(PacketBuffer));
if (NT_SUCCESS(Status)) {
Status = IoStatusBlock.Status;
}
//
// We expect this to work on a disked machine, since we need the password
// to join.
//
if ( !NT_SUCCESS( Status ) )
{
NetpLog(( "Could not open FSCTL_LMMR_RB_CHECK_FOR_NEW_PASSWORD %lx\n",
Status ));
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
//
// Copy the result back to the caller's buffer.
//
RtlCopyMemory(Password, RequestPacket->Data, RequestPacket->Length);
Password[RequestPacket->Length / 2] = L'\0';
NetStatus = NO_ERROR;
Cleanup:
if ( RedirHandle != NULL ) {
NtClose( RedirHandle );
}
return NetStatus;
}
#endif // REMOTE_BOOT
NET_API_STATUS
NET_API_FUNCTION
NetpSetMachineAccountPasswordAndType(
IN LPWSTR lpDcName,
IN PSID DomainSid,
IN LPWSTR lpAccountName,
IN LPWSTR lpPassword
)
{
return( NetpSetMachineAccountPasswordAndTypeEx(
lpDcName,
DomainSid,
lpAccountName,
lpPassword,
0,
TRUE
) );
}
NET_API_STATUS
NET_API_FUNCTION
NetpSetMachineAccountPasswordAndTypeEx(
IN LPWSTR lpDcName,
IN PSID DomainSid,
IN LPWSTR lpAccountName,
IN OUT OPTIONAL LPWSTR lpPassword,
IN OPTIONAL UCHAR AccountState,
IN BOOL fIsNt4Dc
)
/*++
Routine Description:
Due to a few strange reasons, we cannot use the supported, documented Net apis for
managing the machine account, so we have to use the undocumented Sam apis. This routine
will set the password and account type on an account that alread exists.
Arguments:
lpDcName - Name of the DC on which the account lives
DomainSid - Sid of the domain on which the account lives
lpAccountName - Name of the account
lpPassword - Password to be set on the account.
This function gets a strong password to begin with.
If the dc refuses to accept this password, this fn
can weaken the password by making it shorter.
The caller of this function should check if the length
of the supplied password was changed.
This function should preferably return a BOOL to
indicate this.
AccountState - if specified, the account will be set to this state.
possible values:
ACCOUNT_STATE_ENABLED, ACCOUNT_STATE_DISABLED
fIsNt4Dc - TRUE if the DC is NT4 or earlier.
Return Value:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus=NERR_Success;
NTSTATUS Status = STATUS_SUCCESS;
UNICODE_STRING DcName, AccountName;
OBJECT_ATTRIBUTES ObjectAttributes;
SAM_HANDLE SamHandle = NULL, DomainHandle = NULL, AccountHandle = NULL;
ULONG UserRid;
PULONG RidList = NULL;
PSID_NAME_USE NameUseList = NULL;
PUSER_CONTROL_INFORMATION UserAccountControl = NULL;
USER_SET_PASSWORD_INFORMATION PasswordInfo;
ULONG OldUserInfo;
BOOL fAccountControlModified = FALSE;
LPWSTR lpSamAccountName=lpAccountName;
ULONG AccountNameLen=0;
AccountNameLen = wcslen( lpAccountName );
//
// if caller has not passed in sam-account name,
// generate it from machine name ==> append $ at the end
//
if (lpAccountName[AccountNameLen-1] != L'$')
{
NetStatus = NetpGetMachineAccountName(lpAccountName,
&lpSamAccountName);
if (NetStatus != NERR_Success)
{
Status = STATUS_INSUFFICIENT_RESOURCES;
goto SetPasswordError;
}
}
RtlInitUnicodeString( &DcName, lpDcName );
RtlZeroMemory( &ObjectAttributes, sizeof( OBJECT_ATTRIBUTES ) );
Status = SamConnect( &DcName,
&SamHandle,
SAM_SERVER_CONNECT | SAM_SERVER_LOOKUP_DOMAIN,
&ObjectAttributes );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamConnect to %wZ failed with 0x%lx\n", &DcName, Status ));
goto SetPasswordError;
}
//
// Open the domain
//
Status = SamOpenDomain( SamHandle,
DOMAIN_LOOKUP,
DomainSid,
&DomainHandle );
if ( !NT_SUCCESS( Status ) ) {
#ifdef NETSETUP_VERBOSE_LOGGING
UNICODE_STRING DisplaySid;
NTSTATUS Status2;
RtlZeroMemory( &DisplaySid, sizeof( UNICODE_STRING ) );
Status2 = RtlConvertSidToUnicodeString( &DisplaySid, DomainSid, TRUE );
if ( NT_SUCCESS( Status2 ) ) {
NetpLog(( "SamOpenDomain on %wZ failed with 0x%lx\n",
&DisplaySid, Status ));
RtlFreeUnicodeString(&DisplaySid);
} else {
NetpLog(( "SamOpenDomain on <undisplayable sid> failed with 0x%lx\n",
Status ));
}
#endif
goto SetPasswordError;
}
//
// Get the RID of the user account
//
RtlInitUnicodeString( &AccountName, lpSamAccountName );
Status = SamLookupNamesInDomain( DomainHandle,
1,
&AccountName,
&RidList,
&NameUseList );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamLookupNamesInDomain on %wZ failed with 0x%lx\n",
&AccountName, Status ));
goto SetPasswordError;
}
UserRid = RidList[ 0 ];
SamFreeMemory( RidList );
SamFreeMemory( NameUseList );
//
// Finally, open the user account
//
Status = SamOpenUser( DomainHandle,
USER_FORCE_PASSWORD_CHANGE | USER_READ_ACCOUNT | USER_WRITE_ACCOUNT,
UserRid,
&AccountHandle );
if ( !NT_SUCCESS( Status ) ) {
Status = SamOpenUser( DomainHandle,
USER_FORCE_PASSWORD_CHANGE | USER_READ_ACCOUNT,
UserRid,
&AccountHandle );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamOpenUser on %lu failed with 0x%lx\n",
UserRid,
Status ));
goto SetPasswordError;
}
}
//
// Now, read the current user account type and see if it needs to be modified
//
Status = SamQueryInformationUser( AccountHandle,
UserControlInformation,
( PVOID * )&UserAccountControl );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamQueryInformationUser for UserControlInformation "
"failed with 0x%lx\n", Status ));
goto SetPasswordError;
}
OldUserInfo = UserAccountControl->UserAccountControl;
if ( !FLAG_ON( UserAccountControl->UserAccountControl, USER_WORKSTATION_TRUST_ACCOUNT ) ) {
fAccountControlModified = TRUE;
UserAccountControl->UserAccountControl |= USER_WORKSTATION_TRUST_ACCOUNT;
UserAccountControl->UserAccountControl &= ~( USER_INTERDOMAIN_TRUST_ACCOUNT |
USER_SERVER_TRUST_ACCOUNT );
}
//
// Determine if the account control changes. If the account is being enabled,
// we want to perform the following sequence of operations for NT5: enable, disable,
// and enable again. This is needed to increase the USN (Universal Sequence
// Number) of this attribute so that the enabled value will win if the DS
// replication resolves colliding changes, as the following example shows.
// Suppose we have two DCs in the domain we join, A abd B. Suppose the account
// is currently disabled on A (because the user unjoined using that DC),
// but it is still enabled on B (because the replication hasn't happened yet).
// Suppose the user performs now joining to the domain. Then we have discovered
// B and so we proceed with setting up the changes to the existing account. If
// we don't toggle the account control attribute, then the USN of this attribute
// will not change on B (since attribute's value doesn't change) while it was
// incremented on A as the result of unjoin. At the replication time the data
// from A will rule and the account will be incorrectly marked as diabled.
//
// NOTE: This design may fail for the case of unjoining a domain that has
// three (or more) DCs, A, B, and C if the following sequence of operations
// happens. Suppose that the account is originally enabled on all DCs (state [1]
// in the bellow diagram). Then the user unjoins using DC A (state [2]). Then the
// user joins using B where the account is still enabled (state [3]). Then the user
// unjoins using C where the account is still enabled (state [4]). The final
// operation is unjoin, so the user expects that his account is disabled. We've
// assumed here that for some reason no replication was happening when these
// operations were performed. Then at the replication time the value from B will
// win (because of the additional toggling performed at the join time). But the
// account state on B is Enabled, so the final result will be that the account is
// enabled on all DCs which is not what the user expects.
//
// A B C
// Enabled [1] Enabled [1] Enabled [1]
// Disabled [2] Enabled (no-op)+Disabled (1 op) Disabled [4]
// Enabled [3]
//
if ( AccountState != ACCOUNT_STATE_IGNORE ) {
if ( ( AccountState == ACCOUNT_STATE_ENABLED ) &&
( (OldUserInfo & USER_ACCOUNT_DISABLED) || !fIsNt4Dc ) ) {
fAccountControlModified = TRUE;
UserAccountControl->UserAccountControl &= ~USER_ACCOUNT_DISABLED;
}
if ( ( AccountState == ACCOUNT_STATE_DISABLED ) &&
!( OldUserInfo & USER_ACCOUNT_DISABLED ) ) {
fAccountControlModified = TRUE;
UserAccountControl->UserAccountControl |= USER_ACCOUNT_DISABLED;
}
}
if ( fAccountControlModified == FALSE ) {
SamFreeMemory( UserAccountControl );
UserAccountControl = NULL;
}
//
// First, set the account type if required
//
if ( UserAccountControl ) {
Status = SamSetInformationUser( AccountHandle,
UserControlInformation,
( PVOID )UserAccountControl );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamSetInformationUser for UserControlInformation "
"failed with 0x%lx\n", Status ));
goto SetPasswordError;
//
// If we are enabling the account, disable and re-enable it to
// make the two additional account state toggles.
//
} else if ( AccountState == ACCOUNT_STATE_ENABLED ) {
UserAccountControl->UserAccountControl |= USER_ACCOUNT_DISABLED;
Status = SamSetInformationUser( AccountHandle,
UserControlInformation,
( PVOID )UserAccountControl );
if ( !NT_SUCCESS(Status) ) {
NetpLog(( "SamSetInformationUser (second) for UserControlInformation "
"failed with 0x%lx\n", Status ));
goto SetPasswordError;
}
UserAccountControl->UserAccountControl &= ~USER_ACCOUNT_DISABLED;
Status = SamSetInformationUser( AccountHandle,
UserControlInformation,
( PVOID )UserAccountControl );
if ( !NT_SUCCESS(Status) ) {
NetpLog(( "SamSetInformationUser (third) for UserControlInformation "
"failed with 0x%lx\n", Status ));
goto SetPasswordError;
}
}
}
//
// If requested, set the password on the account
//
if ( lpPassword != NULL )
{
RtlInitUnicodeString( &PasswordInfo.Password, lpPassword );
PasswordInfo.PasswordExpired = FALSE;
//
// Ok, then, set the password on the account
//
// The caller has passed in a strong password, try that first
// NT5 dcs will always accept a strong password.
//
Status = SamSetInformationUser( AccountHandle,
UserSetPasswordInformation,
( PVOID )&PasswordInfo );
if ( !NT_SUCCESS( Status ) )
{
if ( (Status == STATUS_PASSWORD_RESTRICTION) &&
!NetpIsDefaultPassword( lpAccountName, lpPassword ))
{
NetpLog(( "NetpSetMachineAccountPasswordAndTypeEx: STATUS_PASSWORD_RESTRICTION error setting password. retrying...\n" ));
//
// SAM did not accpet a long password, try LM20_PWLEN
//
// This is probably because the dc is NT4 dc.
// NT4 dcs will not accept a password longer than LM20_PWLEN
//
lpPassword[LM20_PWLEN] = UNICODE_NULL;
RtlInitUnicodeString( &PasswordInfo.Password, lpPassword );
Status = SamSetInformationUser( AccountHandle,
UserSetPasswordInformation,
( PVOID )&PasswordInfo );
if ( Status == STATUS_PASSWORD_RESTRICTION )
{
NetpLog(( "NetpSetMachineAccountPasswordAndTypeEx: STATUS_PASSWORD_RESTRICTION error setting password. retrying...\n" ));
//
// SAM did not accpet a LM20_PWLEN password, try shorter one
//
// SAM uses RtlUpcaseUnicodeStringToOemString internally.
// In this process it is possible that in the worst case,
// n unicode char password will get mapped to 2*n dbcs
// char password. This will make it exceed LM20_PWLEN.
// To guard against this worst case, try a password
// with LM20_PWLEN/2 length
//
// One might say that LM20_PWLEN/2 length password
// is not really secure. I agree, but it is definitely
// better than the default password which we will have
// to fall back to otherwise.
//
lpPassword[LM20_PWLEN/2] = UNICODE_NULL;
RtlInitUnicodeString( &PasswordInfo.Password, lpPassword );
Status = SamSetInformationUser( AccountHandle,
UserSetPasswordInformation,
( PVOID )&PasswordInfo );
if ( Status == STATUS_PASSWORD_RESTRICTION )
{
//
// SAM did not accpet a short pwd, try default pwd
//
NetpLog(( "NetpSetMachineAccountPasswordAndTypeEx: STATUS_PASSWORD_RESTRICTION error setting password. retrying...\n" ));
NetpGenerateDefaultPassword(lpAccountName, lpPassword);
RtlInitUnicodeString( &PasswordInfo.Password, lpPassword );
Status = SamSetInformationUser( AccountHandle,
UserSetPasswordInformation,
( PVOID )&PasswordInfo );
}
}
}
if ( NT_SUCCESS( Status ) )
{
NetpLog(( "NetpGenerateDefaultPassword: successfully set password\n" ));
}
else
{
NetpLog(( "NetpSetMachineAccountPasswordAndTypeEx: SamSetInformationUser for UserSetPasswordInformation failed: 0x%lx\n", Status ));
//
// Make sure we try to restore the account control
//
if ( UserAccountControl )
{
NTSTATUS Status2;
UserAccountControl->UserAccountControl = OldUserInfo;
Status2 = SamSetInformationUser( AccountHandle,
UserControlInformation,
( PVOID )UserAccountControl );
if ( !NT_SUCCESS( Status2 ) )
{
NetpLog(( "SamSetInformationUser for UserControlInformation (RESTORE) failed with 0x%lx\n", Status2 ));
}
}
goto SetPasswordError;
}
}
}
SetPasswordError:
if ( lpSamAccountName != lpAccountName )
{
NetApiBufferFree( lpSamAccountName );
}
if ( AccountHandle ) {
SamCloseHandle( AccountHandle );
}
if ( DomainHandle ) {
SamCloseHandle( DomainHandle );
}
if ( SamHandle ) {
SamCloseHandle( SamHandle );
}
NetStatus = RtlNtStatusToDosError( Status );
SamFreeMemory( UserAccountControl );
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpRemoveDnsRegistrations (
VOID
)
/*++
Routine Description:
This function removes DNS registration entries via an entrypoint defined
in DHCPCSVC.DLL called DhcpRemoveDNSRegistrations
Return Value:
NERR_Success -- Success
--*/
{
HMODULE hModule = NULL;
DNS_REGISTRATION_REMOVAL_FN pfn = NULL;
hModule = LoadLibraryW( L"dhcpcsvc.dll" );
if ( hModule != NULL )
{
pfn = (DNS_REGISTRATION_REMOVAL_FN)GetProcAddress(
hModule,
"DhcpRemoveDNSRegistrations"
);
if ( pfn != NULL )
{
( *pfn )();
}
FreeLibrary( hModule );
}
return( NERR_Success );
}
//
// Helper functions
//
LPWSTR
GetStrPtr(IN LPWSTR szString OPTIONAL)
{
return szString ? szString : L"(NULL)";
}
NET_API_STATUS
NET_API_FUNCTION
NetpDuplicateString(IN LPCWSTR szSrc,
IN LONG cchSrc,
OUT LPWSTR* pszDst)
{
NET_API_STATUS NetStatus;
if (cchSrc < 0)
{
cchSrc = wcslen(szSrc);
}
++cchSrc;
NetStatus = NetApiBufferAllocate(cchSrc * sizeof( WCHAR ),
pszDst);
if ( NetStatus == NERR_Success )
{
wcsncpy(*pszDst, szSrc, cchSrc);
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpConcatStrings(IN LPCWSTR szSrc1,
IN LONG cchSrc1,
IN LPCWSTR szSrc2,
IN LONG cchSrc2,
OUT LPWSTR* pszDst)
{
NET_API_STATUS NetStatus;
if (cchSrc1 < 0)
{
cchSrc1 = wcslen(szSrc1);
}
if (cchSrc2 < 0)
{
cchSrc2 = wcslen(szSrc2);
}
NetStatus = NetApiBufferAllocate((cchSrc1 + cchSrc2 + 1) * sizeof( WCHAR ),
pszDst);
if ( NetStatus == NERR_Success )
{
wcsncpy(*pszDst, szSrc1, cchSrc1);
wcsncpy(*pszDst + cchSrc1, szSrc2, cchSrc2+1);
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpConcatStrings3(IN LPCWSTR szSrc1,
IN LONG cchSrc1,
IN LPCWSTR szSrc2,
IN LONG cchSrc2,
IN LPCWSTR szSrc3,
IN LONG cchSrc3,
OUT LPWSTR* pszDst)
{
NET_API_STATUS NetStatus;
if (cchSrc1 < 0)
{
cchSrc1 = wcslen(szSrc1);
}
if (cchSrc2 < 0)
{
cchSrc2 = wcslen(szSrc2);
}
if (cchSrc3 < 0)
{
cchSrc3 = wcslen(szSrc3);
}
NetStatus = NetApiBufferAllocate((cchSrc1 + cchSrc2 + cchSrc3 + 1) *
sizeof( WCHAR ), pszDst);
if ( NetStatus == NERR_Success )
{
wcsncpy(*pszDst, szSrc1, cchSrc1);
wcsncpy(*pszDst + cchSrc1, szSrc2, cchSrc2);
wcsncpy(*pszDst + cchSrc1 + cchSrc2, szSrc3, cchSrc3+1);
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetMachineAccountName(
IN LPCWSTR szMachineName,
OUT LPWSTR* pszMachineAccountName
)
/*++
Routine Description:
Get machine account name from machine name.
Arguments:
szMachineName -- name of a computer
pszMachineAccountName -- receives the name of computer account
Returns:
NERR_Success -- Success
Notes:
Caller must free the allocated memory using NetApiBufferFree.
--*/
{
NET_API_STATUS NetStatus;
ULONG ulLen;
LPWSTR szMachineAccountName;
ulLen = wcslen(szMachineName);
NetStatus = NetApiBufferAllocate( (ulLen + 2) * sizeof(WCHAR),
(PBYTE *) &szMachineAccountName );
if ( NetStatus == NERR_Success )
{
wcscpy(szMachineAccountName, szMachineName);
_wcsupr(szMachineAccountName);
szMachineAccountName[ulLen] = L'$';
szMachineAccountName[ulLen+1] = UNICODE_NULL;
*pszMachineAccountName = szMachineAccountName;
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpGeneratePassword(
IN LPCWSTR szMachine,
IN BOOL fRandomPwdPreferred,
IN LPCWSTR szDcName,
IN BOOL fIsNt4Dc,
OUT LPWSTR szPassword
)
/*++
Routine Description:
Arguments:
szMachine -- name of a computer
szPassword -- receives the generated password this buffer must be
atleast PWLEN+1 char long.
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
BOOL fUseDefaultPwd = FALSE;
// The default password is used if we are joining an NT4 DC
// that has RefusePasswordChange set. This is determined by
// remotely reading the appropriate netlogon regval.
// If the key cannot be read, it is assumed that the value is not set
//
if ( fIsNt4Dc )
{
//
// we are joining an NT4 domain, see if RefusePasswordChange is set
//
NetStatus = NetpGetNt4RefusePasswordChangeStatus( szDcName,
&fUseDefaultPwd );
}
if ( NetStatus == NERR_Success )
{
//
// if we are explicitly asked to use a default password, generate one
//
if ( fUseDefaultPwd )
{
NetpGenerateDefaultPassword(szMachine, szPassword);
}
//
// otherwise if the caller prefers a random password, generate one
//
else if ( fRandomPwdPreferred )
{
NetStatus = NetpGenerateRandomPassword(szPassword);
}
#if defined(REMOTE_BOOT)
//
// If it's a remote boot machine, then this will return the
// current machine account password, so use that.
//
else if (NERR_Success ==
NetpGetRemoteBootMachinePassword(szPassword))
{
// do nothing since the above already generated the password
}
#endif
else
{
//
// if none of the above apply,
// we end up generating a default password
//
NetpGenerateDefaultPassword(szMachine, szPassword);
NetStatus = NERR_Success;
}
}
return NetStatus;
}
void
NetpGenerateDefaultPassword(
IN LPCWSTR szMachine,
OUT LPWSTR szPassword
)
/*++
Routine Description:
Generate the default password from machine name.
This is simply the first 14 characters of the machine name lower cased.
Arguments:
szMachine -- name of a computer
szPassword -- receives the generated password
Returns:
NERR_Success -- Success
--*/
{
wcsncpy( szPassword, szMachine, LM20_PWLEN );
szPassword[LM20_PWLEN] = UNICODE_NULL;
_wcslwr( szPassword );
}
BOOL
NetpIsDefaultPassword(
IN LPCWSTR szMachine,
IN LPWSTR szPassword
)
/*++
Routine Description:
Determine if szPassword is the default password for szMachine
Arguments:
szMachine -- name of a computer
szPassword -- machine password
Returns:
TRUE if szPassword is the default password,
FALSE otherwise
--*/
{
WCHAR szPassword2[LM20_PWLEN+1];
NetpGenerateDefaultPassword(szMachine, szPassword2);
return (wcscmp(szPassword, szPassword2) == 0);
}
NET_API_STATUS
NET_API_FUNCTION
NetpGenerateRandomPassword(
OUT LPWSTR szPassword
)
{
NET_API_STATUS NetStatus=NERR_Success;
ULONG Length, i;
BYTE n;
HCRYPTPROV CryptProvider = 0;
LPWSTR szPwd=szPassword;
BOOL fStatus;
#define PWD_CHAR_MIN 32 // ' ' space
#define PWD_CHAR_MAX 122 // 'z'
//
// there is a reason behind this number
//
Length = 120;
szPassword[Length] = UNICODE_NULL;
//
// Generate a random password.
//
// the password is made of english printable chars. when w2k client
// joins NT4 dc. SAM on the dc calls RRtlUpcaseUnicodeStringToOemString
// the password length will remain unchanged. If we do not do this,
// the dc returns STATUS_PASSWORD_RESTRICTION and we have to
// fall back to default password.
//
if ( CryptAcquireContext( &CryptProvider, NULL, NULL,
PROV_RSA_FULL, CRYPT_VERIFYCONTEXT ) )
{
for ( i = 0; i < Length; i++, szPwd++ )
{
//
// the method we use here is not very efficient.
// This does not matter much in the context of NetJoin apis
// but it should not be used where perf is a criterion
//
while ( ( fStatus = CryptGenRandom( CryptProvider, sizeof(BYTE),
(LPBYTE) &n ) ) &&
( ( n < PWD_CHAR_MIN ) || ( n > PWD_CHAR_MAX ) ) )
{
// try till we get a non-zero random number
}
if ( fStatus )
{
*szPwd = (WCHAR) n;
}
else
{
NetStatus = GetLastError();
break;
}
}
CryptReleaseContext( CryptProvider, 0 );
}
else
{
NetStatus = GetLastError();
}
if ( NetStatus != NERR_Success )
{
NetpLog(( "NetpGenerateRandomPassword: failed: 0x%lx\n", NetStatus ));
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpStoreIntialDcRecord(
IN PDOMAIN_CONTROLLER_INFO DcInfo
)
/*++
Routine Description:
This function will cache the name of the domain controller on which we successfully
created/modified the machine account, so that the auth packages will know which dc to
try first
Arguments:
lpDcName - Name of the DC on which the account was created/modified
CreateNetlogonStoppedKey - If TRUE, a volatile key will be created
in the Netlogon registry section. The presence of this key
will instruct the client side of DsGetDcName( ) and the MSV1
package not to wait on netlogon to start.
Return Value:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
HKEY hNetLogon, hJoinKey = NULL;
ULONG Disp;
NetStatus = RegOpenKey( HKEY_LOCAL_MACHINE,
NETSETUPP_NETLOGON_JD_PATH,
&hNetLogon );
if ( NetStatus == NERR_Success ) {
NetStatus = RegCreateKeyEx( hNetLogon,
NETSETUPP_NETLOGON_JD,
0,
NULL,
REG_OPTION_NON_VOLATILE,
KEY_WRITE,
NULL,
&hJoinKey,
&Disp );
//
// Now, start creating all of the values. Ignore any failures, and don't write out
// NULL values
//
if ( NetStatus == NERR_Success ) {
PWSTR String = DcInfo->DomainControllerName;
//
// DomainControllerName
//
if ( String ) {
NetStatus = RegSetValueEx( hJoinKey,
NETSETUPP_NETLOGON_JD_DC,
0,
REG_SZ,
( const PBYTE )String,
( wcslen( String ) + 1 ) * sizeof( WCHAR ) );
if ( NetStatus != NERR_Success ) {
NetpLog(( "Set of value %ws to %ws failed with %lu\n",
NETSETUPP_NETLOGON_JD_DC, String, NetStatus ));
}
}
//
// DomainControllerAddress
//
String = DcInfo->DomainControllerAddress;
if ( String ) {
NetStatus = RegSetValueEx( hJoinKey,
NETSETUPP_NETLOGON_JD_DCA,
0,
REG_SZ,
( const PBYTE )String,
( wcslen( String ) + 1 ) * sizeof( WCHAR ) );
if ( NetStatus != NERR_Success ) {
NetpLog(( "Set of value %ws to %ws failed with %lu\n",
NETSETUPP_NETLOGON_JD_DCA, String, NetStatus ));
}
}
//
// DomainControllerType
//
NetStatus = RegSetValueEx( hJoinKey,
NETSETUPP_NETLOGON_JD_DCAT,
0,
REG_DWORD,
( const PBYTE )&DcInfo->DomainControllerAddressType,
sizeof( ULONG ) );
if ( NetStatus != NERR_Success ) {
NetpLog(( "Set of value %ws to %lu failed with %lu\n",
NETSETUPP_NETLOGON_JD_DCAT,
DcInfo->DomainControllerAddressType, NetStatus ));
}
//
// DomainControllerType
//
NetStatus = RegSetValueEx( hJoinKey,
NETSETUPP_NETLOGON_JD_DG,
0,
REG_BINARY,
( const PBYTE )&DcInfo->DomainGuid,
sizeof( GUID ) );
if ( NetStatus != NERR_Success ) {
NetpLog(( "Set of value %ws failed with %lu\n",
NETSETUPP_NETLOGON_JD_DG, NetStatus ));
}
//
// DomainName
//
String = DcInfo->DomainName;
if ( String ) {
NetStatus = RegSetValueEx( hJoinKey,
NETSETUPP_NETLOGON_JD_DN,
0,
REG_SZ,
( const PBYTE )String,
( wcslen( String ) + 1 ) * sizeof( WCHAR ) );
if ( NetStatus != NERR_Success ) {
NetpLog(( "Set of value %ws to %ws failed with %lu\n",
NETSETUPP_NETLOGON_JD_DN, String, NetStatus ));
}
}
//
// DnsForestName
//
String = DcInfo->DnsForestName;
if ( String ) {
NetStatus = RegSetValueEx( hJoinKey,
NETSETUPP_NETLOGON_JD_DFN,
0,
REG_SZ,
( const PBYTE )String,
( wcslen( String ) + 1 ) * sizeof( WCHAR ) );
if ( NetStatus != NERR_Success ) {
NetpLog(( "Set of value %ws to %ws failed with %lu\n",
NETSETUPP_NETLOGON_JD_DFN, String, NetStatus ));
}
}
//
// Flags
//
NetStatus = RegSetValueEx( hJoinKey,
NETSETUPP_NETLOGON_JD_F,
0,
REG_DWORD,
( const PBYTE )&DcInfo->Flags,
sizeof( ULONG ) );
if ( NetStatus != NERR_Success ) {
NetpLog(( "Set of value %ws to %lu failed with %lu\n",
NETSETUPP_NETLOGON_JD_F, DcInfo->Flags, NetStatus ));
}
//
// DcSiteName
//
String = DcInfo->DcSiteName;
if ( String ) {
NetStatus = RegSetValueEx( hJoinKey,
NETSETUPP_NETLOGON_JD_DSN,
0,
REG_SZ,
( const PBYTE )String,
( wcslen( String ) + 1 ) * sizeof( WCHAR ) );
if ( NetStatus != NERR_Success ) {
NetpLog(( "Set of value %ws to %ws failed with %lu\n",
NETSETUPP_NETLOGON_JD_DSN, String, NetStatus ));
}
}
//
// DcSiteName
//
String = DcInfo->ClientSiteName;
if ( String ) {
NetStatus = RegSetValueEx( hJoinKey,
NETSETUPP_NETLOGON_JD_CSN,
0,
REG_SZ,
( const PBYTE )String,
( wcslen( String ) + 1 ) * sizeof( WCHAR ) );
if ( NetStatus != NERR_Success ) {
NetpLog(( "Set of value %ws to %ws failed with %lu\n",
NETSETUPP_NETLOGON_JD_CSN, String, NetStatus ));
}
}
RegCloseKey( hJoinKey );
}
RegCloseKey( hNetLogon );
}
return( NetStatus );
}
VOID
NetpAvoidNetlogonSpnSet(
BOOL AvoidSet
)
/*++
Routine Description:
This function will write into Netlogon reg key to instruct Netlogon
not to register DnsHostName and SPNs. This is needed because
Netlogon could otherwise set incorrect values based on the old computer
name. The registry key that this function writes is volatile so that
Netlogon will notice it before the reboot but it will not exist after
the reboot when Netlogon will have the new computer name.
Arguments:
AvoidSet - If TRUE, this routine will inform netlogon to not write SPNs
Otherwise, it will delete the reg key which we may have set previously.
Return Value:
None
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
HKEY hNetLogon = NULL;
HKEY hNetLogonAvoidSpnSet = NULL;
ULONG Disp;
NetStatus = RegOpenKeyEx( HKEY_LOCAL_MACHINE,
NETSETUPP_NETLOGON_JD_PATH,
0,
KEY_ALL_ACCESS,
&hNetLogon );
if ( NetStatus == NERR_Success ) {
//
// If we are to avoid SPN setting by netlogon,
// write the appropriate reg key to inform Netlogon accordingly
//
if ( AvoidSet ) {
NetStatus = RegCreateKeyEx( hNetLogon,
NETSETUPP_NETLOGON_AVOID_SPN,
0,
NULL,
REG_OPTION_VOLATILE,
KEY_WRITE,
NULL,
&hNetLogonAvoidSpnSet,
&Disp );
if ( NetStatus == NERR_Success ) {
RegCloseKey( hNetLogonAvoidSpnSet );
}
//
// Otherwise, delete the reg key which we may have set previously.
//
} else {
RegDeleteKey( hNetLogon,
NETSETUPP_NETLOGON_AVOID_SPN );
}
RegCloseKey( hNetLogon );
}
}
LONG cNetsetupLogRefCount=0;
LONG LogWriterCount=0;
HANDLE hDebugLog = NULL;
BOOL LogFileInitialized = FALSE;
BOOL LogShutdownInProgress = FALSE;
DWORD NetpOpenLogThreadId = 0;
void
NetSetuppOpenLog()
{
//
// Increment the ref count atomically
//
LONG LocalLogRefCount = InterlockedIncrement( &cNetsetupLogRefCount );
//
// If we are the first thread to access the log,
// initialize the log and open it
//
if ( LocalLogRefCount == 1 ) {
//
// It's possible that the log hasn't been
// shut down yet by the last thread leaving
// the log, so wait until it is.
//
while ( LogFileInitialized || LogShutdownInProgress ) {
Sleep(100);
}
NetpInitializeLogFile();
NetpOpenLogThreadId = GetCurrentThreadId();
//
// Now open the log and mark the start of the output
//
hDebugLog = NetpOpenDebugFile( L"NetSetup", FALSE );
LogFileInitialized = TRUE;
NetpLog(("-----------------------------------------------------------------\n" ));
//
// If we are not the first one, it's possible
// that the log hasn't been initilized by the
// first thread yet, so wait until it is
//
} else {
while ( !LogFileInitialized ) {
Sleep(100);
}
}
}
void
NetSetuppCloseLog()
{
LONG LocalLogRefCount;
//
// We can walk into this routine only if
// we previously initialized the log
//
ASSERT( cNetsetupLogRefCount > 0 );
ASSERT( LogFileInitialized == TRUE );
//
// Decrement the ref count atomically
//
LocalLogRefCount = InterlockedDecrement( &cNetsetupLogRefCount );
//
// If we are the last thread to close the log,
// shut the log down
//
if ( LocalLogRefCount == 0 ) {
//
// Inform writers we are shutting the log down
//
LogShutdownInProgress = TRUE;
//
// Wait until all writers leave the log
//
while ( LogWriterCount > 0 ) {
Sleep(100);
}
//
// Close the log
//
NetpCloseDebugFile( hDebugLog );
hDebugLog = NULL;
NetpOpenLogThreadId = 0;
NetpShutdownLogFile();
LogFileInitialized = FALSE;
//
// We are done with log shutdown
//
LogShutdownInProgress = FALSE;
}
}
void
NetpLogPrintHelper(
IN LPCSTR Format,
...)
{
va_list arglist;
//
// Don't go any further if the file isn't ready
//
if ( !LogFileInitialized || LogShutdownInProgress ) {
return;
}
//
// Increment the number of log writers to prevent
// the log from shutting down behind our back
//
InterlockedIncrement( &LogWriterCount );
//
// Now that we have our writer reference,
// it's safe to write into the log if
// it is ready at this point
//
if ( LogFileInitialized && !LogShutdownInProgress ) {
va_start(arglist, Format);
NetpLogPrintRoutineVEx(hDebugLog, &NetpOpenLogThreadId, (LPSTR) Format, arglist);
va_end(arglist);
}
//
// Remove our reference
//
InterlockedDecrement( &LogWriterCount );
}
NET_API_STATUS
NET_API_FUNCTION
NetpWaitForNetlogonSc(
IN LPCWSTR szDomainName
)
{
NET_API_STATUS NetStatus = NERR_Success;
NTSTATUS NlSubStatus=STATUS_SUCCESS;
LPBYTE pNetlogonInfo=NULL;
UINT cAttempts=0;
BOOLEAN fScSetup=FALSE;
PNETLOGON_INFO_2 pNetlogonInfo2;
#define NL_SC_WAIT_INTERVAL 2000
#define NL_SC_WAIT_NUM_ATTEMPTS 60
NetpLog(( "NetpWaitForNetlogonSc: waiting for netlogon secure channel setup...\n"));
while (!fScSetup && (cAttempts < NL_SC_WAIT_NUM_ATTEMPTS))
{
cAttempts++;
NetStatus = I_NetLogonControl2( NULL, NETLOGON_CONTROL_TC_QUERY,
2, (LPBYTE) &szDomainName,
(LPBYTE *) &pNetlogonInfo );
if (NetStatus == NERR_Success)
{
pNetlogonInfo2 = (PNETLOGON_INFO_2) pNetlogonInfo;
NlSubStatus = pNetlogonInfo2->netlog2_tc_connection_status;
fScSetup = NlSubStatus == NERR_Success;
NetApiBufferFree(pNetlogonInfo);
}
if (!fScSetup)
{
Sleep(NL_SC_WAIT_INTERVAL);
}
}
NetpLog(( "NetpWaitForNetlogonSc: status: 0x%lx, sub-status: 0x%lx\n",
NetStatus, NlSubStatus));
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpDsSetSPN2(
IN LPCWSTR szComputerName,
IN LPCWSTR szDnsDomainName,
IN LPCWSTR szUncDcName,
IN LPCWSTR szUser,
IN LPCWSTR szUserPassword
)
/*++
Routine Description:
Arguments:
Return Value:
ignored - this is a thread pool worker function.
--*/
{
DWORD NetStatus=NERR_Success;
ULONG LdapStatus;
LPWSTR Spn = NULL;
LPWSTR SpnNetbios = NULL;
LPWSTR SamName = NULL;
LPWSTR SamAccountName = NULL;
HANDLE hDs = NULL;
LDAP *hLdap = NULL;
PDS_NAME_RESULTW CrackedName = NULL;
LPWSTR DnOfAccount;
LONG LdapOption;
LPWSTR DnsHostName = NULL;
LPWSTR DnsHostNameValues[2];
LDAPModW DnsHostNameAttr;
LDAPModW *Mods[2];
RPC_AUTH_IDENTITY_HANDLE AuthId = 0;
WCHAR szComputerNetbiosName[MAX_COMPUTERNAME_LENGTH+1];
LPWSTR szUserName=NULL;
LPWSTR szDomainName=NULL;
LPWSTR szNetbiosDomainName=NULL;
LPWSTR szT;
ULONG uLen;
static WCHAR c_szHostPrefix[] = L"HOST/";
NetStatus = NetpSeparateUserAndDomain(szUser, &szUserName, &szDomainName);
if (NetStatus == NERR_Success)
{
NetStatus = DsMakePasswordCredentials(szUserName, szDomainName,
szUserPassword, &AuthId);
if (NetStatus != NERR_Success)
{
goto Cleanup;
}
}
//
// first build various names
//
//
// build Netbios domain name
//
uLen = wcslen(szDnsDomainName);
NetStatus = NetpDuplicateString(szDnsDomainName, uLen, &szNetbiosDomainName);
if (NetStatus == NERR_Success)
{
if (uLen > MAX_COMPUTERNAME_LENGTH)
{
szNetbiosDomainName[MAX_COMPUTERNAME_LENGTH] = UNICODE_NULL;
}
szT = wcschr(szNetbiosDomainName, L'.');
if (szT)
{
*szT = UNICODE_NULL;
}
}
//
// build SamAccountName
//
NetStatus = NetpGetMachineAccountName(szComputerName,
&SamAccountName);
if (NetStatus == NERR_Success)
{
//
// build SamName
//
NetStatus = NetpConcatStrings3(szNetbiosDomainName, -1,
L"\\", 1,
SamAccountName, -1,
&SamName);
if (NetStatus == NERR_Success)
{
wcsncpy(szComputerNetbiosName,
szComputerName, MAX_COMPUTERNAME_LENGTH);
szComputerNetbiosName[MAX_COMPUTERNAME_LENGTH] = UNICODE_NULL;
//
// build DnsHostName
//
NetStatus = NetpConcatStrings3( szComputerNetbiosName,
-1,
L".", 1,
szDnsDomainName, -1,
&DnsHostName );
if (NetStatus == NERR_Success)
{
//
// build SPN
//
NetStatus = NetpConcatStrings(c_szHostPrefix,
(sizeof( c_szHostPrefix )/
sizeof(WCHAR) ) - 1,
DnsHostName, -1,
&Spn);
if (NetStatus == NERR_Success)
{
//
// build NebBios SPN
//
NetStatus = NetpConcatStrings(c_szHostPrefix,
(sizeof( c_szHostPrefix )/
sizeof(WCHAR) ) - 1,
szComputerNetbiosName, -1,
&SpnNetbios);
}
}
}
}
if (NetStatus != NERR_Success)
{
goto Cleanup;
}
//
// Bind to the DS on the DC.
//
NetStatus = DsBindWithCredW(szUncDcName, NULL, AuthId, &hDs);
if ( NetStatus != NO_ERROR )
{
NetpLog(("NetpDsSetSPN: Unable to bind to DS on '%ws': 0x%lx\n",
szUncDcName, NetStatus ));
goto Cleanup ;
}
//
// Crack the sam account name into a DN:
//
NetStatus = DsCrackNamesW( hDs, 0, DS_NT4_ACCOUNT_NAME, DS_FQDN_1779_NAME,
1, &SamName, &CrackedName );
if ( ( NetStatus != NO_ERROR ) ||
( CrackedName->cItems != 1 ) )
{
NetpLog(( "NetpDsSetSPN: CrackNames failed on '%ws' for '%ws': 0x%lx\n",
szUncDcName, SamName, NetStatus ));
goto Cleanup ;
}
if ( CrackedName->rItems[ 0 ].status != 0 )
{
//$ kumarp 15-July-1999
//
// we dont change NetStatus here thus treat this failure as success
// and end up not setting the DnsHostName/SPN
//
NetpLog(( "NetpDsSetSPN: CrackNames failed on %ws for %ws: substatus 0x%lx\n",
szUncDcName, SamName, CrackedName->rItems[ 0 ].status ));
goto Cleanup ;
}
DnOfAccount = CrackedName->rItems[0].pName;
NetStatus = NetpLdapBind( (LPWSTR) szUncDcName,
(LPWSTR) szUser,
(LPWSTR) szUserPassword, &hLdap );
if (NetStatus == NERR_Success)
{
//
// Write the DNS host name
//
DnsHostNameValues[0] = DnsHostName;
DnsHostNameValues[1] = NULL;
DnsHostNameAttr.mod_op = LDAP_MOD_REPLACE;
DnsHostNameAttr.mod_type = L"DnsHostName";
DnsHostNameAttr.mod_values = DnsHostNameValues;
Mods[0] = &DnsHostNameAttr;
Mods[1] = NULL;
NetpLog (("NetpDsSetSPN: Setting DnsHostName '%ws' on '%ws'\n", DnsHostName, DnOfAccount));
LdapStatus = ldap_modify_sW( hLdap, DnOfAccount, Mods );
if ( LdapStatus != LDAP_SUCCESS )
{
NetStatus = LdapMapErrorToWin32(LdapStatus);
NetpLog(( "NetpDsSetSPN: ldap_modify_s failed on '%ws' for '%ws': '%s' : 0x%lx\n",
szUncDcName, SamName, ldap_err2stringA( LdapStatus ),
NetStatus));
goto Cleanup;
}
}
if (NetStatus == NERR_Success)
{
//
// Write the SPN.
//
NetpLog (("NetpDsSetSPN: Setting SPN '%ws' on '%ws'\n", Spn, DnOfAccount));
NetStatus = DsWriteAccountSpn( hDs, DS_SPN_ADD_SPN_OP,
DnOfAccount, 1, &Spn );
if (NetStatus == NERR_Success)
{
NetpLog (("NetpDsSetSPN: Setting SPN '%ws' on '%ws'\n", SpnNetbios, DnOfAccount));
NetStatus = DsWriteAccountSpn( hDs, DS_SPN_ADD_SPN_OP,
DnOfAccount, 1, &SpnNetbios );
}
if ( NetStatus != NO_ERROR )
{
NetpLog(( "NetpDsSetSPN: DsWriteAccountSpn failed on '%ws' for '%ws': 0x%lx\n", szUncDcName, SamName, NetStatus ));
}
}
Cleanup:
if ( hDs )
{
DsUnBind( &hDs );
}
if ( CrackedName )
{
DsFreeNameResultW( CrackedName );
}
if ( hLdap != NULL )
{
ldap_unbind_s( hLdap );
}
if ( AuthId )
{
DsFreePasswordCredentials( AuthId );
}
NetApiBufferFree( Spn );
NetApiBufferFree( SpnNetbios );
NetApiBufferFree( SamAccountName );
NetApiBufferFree( SamName );
NetApiBufferFree( szNetbiosDomainName );
NetApiBufferFree( szDomainName );
NetApiBufferFree( szUserName );
return NetStatus ;
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetDefaultLcidOnMachine(
IN LPCWSTR szMachine,
OUT LCID* plcidMachine
)
{
NET_API_STATUS NetStatus = NERR_Success;
HKEY hkeyRemoteMachine, hkeyLanguage;
WCHAR szLocale[16];
DWORD dwLocaleSize=0;
DWORD dwType;
static WCHAR c_szRegKeySystemLanguage[] =
L"System\\CurrentControlSet\\Control\\Nls\\Locale";
static WCHAR c_szRegValDefault[] = L"(Default)";
//
// Connect to the remote registry
//
if ( NetStatus == NERR_Success )
{
NetStatus = RegConnectRegistry( szMachine,
HKEY_LOCAL_MACHINE,
&hkeyRemoteMachine );
//
// Now, open the system language key
//
if ( NetStatus == NERR_Success )
{
NetStatus = RegOpenKeyEx( hkeyRemoteMachine,
c_szRegKeySystemLanguage,
0, KEY_READ, &hkeyLanguage);
//
// get default locale
//
if ( NetStatus == NERR_Success )
{
dwLocaleSize = sizeof( szLocale );
NetStatus = RegQueryValueEx( hkeyLanguage,
c_szRegValDefault,
NULL, &dwType,
(LPBYTE) szLocale,
&dwLocaleSize );
if ( NetStatus == NERR_Success)
{
if ((dwType == REG_SZ) &&
(swscanf(szLocale, L"%lx", plcidMachine) != 1))
{
//$ REVIEW kumarp 29-May-1999
// better errorcode?
NetStatus = ERROR_INVALID_PARAMETER;
}
}
RegCloseKey( hkeyLanguage );
}
RegCloseKey( hkeyRemoteMachine );
}
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpVerifyStrOemCompatibleInLocale(
IN LPCWSTR szString,
IN LCID lcidRemote
)
{
NET_API_STATUS NetStatus = NERR_Success;
NTSTATUS NtStatus=STATUS_SUCCESS;
OEM_STRING osLocal = { 0 };
OEM_STRING osRemote = { 0 };
UNICODE_STRING sString;
LCID lcidLocal;
lcidLocal = GetThreadLocale();
RtlInitUnicodeString(&sString, szString);
NtStatus = RtlUnicodeStringToOemString(&osLocal, &sString, TRUE);
__try
{
if (NtStatus == STATUS_SUCCESS)
{
if (SetThreadLocale(lcidRemote))
{
NtStatus = RtlUnicodeStringToOemString(&osRemote,
&sString, TRUE);
if (NtStatus == STATUS_SUCCESS)
{
if (!RtlEqualMemory(osLocal.Buffer, osRemote.Buffer,
osLocal.Length))
{
NetStatus = NERR_NameUsesIncompatibleCodePage;
}
}
else
{
NetStatus = RtlNtStatusToDosError(NtStatus);
}
}
else
{
NetStatus = GetLastError();
}
}
else
{
NetStatus = RtlNtStatusToDosError(NtStatus);
}
}
__finally
{
if (!SetThreadLocale(lcidLocal))
{
NetStatus = GetLastError();
}
// RtlFreeOemString checks for NULL Buffer
RtlFreeOemString(&osLocal);
RtlFreeOemString(&osRemote);
}
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpVerifyStrOemCompatibleOnMachine(
IN LPCWSTR szRemoteMachine,
IN LPCWSTR szString
)
{
NET_API_STATUS NetStatus = NERR_Success;
LCID lcidRemoteMachine;
NetStatus = NetpGetDefaultLcidOnMachine(szRemoteMachine,
&lcidRemoteMachine);
if (NetStatus == NERR_Success)
{
NetStatus = NetpVerifyStrOemCompatibleInLocale(szString,
lcidRemoteMachine);
}
return NetStatus;
}
#define NETP_NETLOGON_PATH L"System\\CurrentControlSet\\services\\Netlogon\\parameters\\"
#define NETP_NETLOGON_RPC L"RefusePasswordChange"
NET_API_STATUS
NET_API_FUNCTION
NetpGetNt4RefusePasswordChangeStatus(
IN LPCWSTR Nt4Dc,
OUT BOOL* RefusePasswordChangeSet
)
/*++
Routine Description:
Read the regkey NETP_NETLOGON_PATH\NETP_NETLOGON_RPC on Nt4Dc.
Return the value read in the out parameter.
Arguments:
Nt4Dc -- name of machine to read reg. from
RefusePasswordChangeSet -- value returned
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
PWSTR FullComputerName = NULL;
HKEY NetlogonRootKey, DcKey;
ULONG Length, Type;
DWORD Value;
*RefusePasswordChangeSet = FALSE;
//
// Build the full computer name if necessary
//
if ( *Nt4Dc != L'\\' )
{
NetStatus = NetApiBufferAllocate( ( wcslen( Nt4Dc ) + 3 ) * sizeof( WCHAR ),
( LPVOID * )&FullComputerName );
if ( NetStatus == NERR_Success )
{
swprintf( FullComputerName, L"\\\\%ws", Nt4Dc );
}
}
else
{
FullComputerName = (LPWSTR) Nt4Dc;
}
NetpLog(( "NetpGetNt4RefusePasswordChangeStatus: trying to read from '%ws'\n", FullComputerName));
//
// Connect to the remote registry
//
if ( NetStatus == NERR_Success )
{
NetStatus = RegConnectRegistry( FullComputerName,
HKEY_LOCAL_MACHINE,
&DcKey );
//
// Now, open the netlogon parameters section
//
if ( NetStatus == NERR_Success )
{
NetStatus = RegOpenKeyEx( DcKey,
NETP_NETLOGON_PATH,
0,
KEY_READ,
&NetlogonRootKey);
//
// Now, see if the key actually exists...
//
if ( NetStatus == NERR_Success )
{
Length = sizeof( Value );
NetStatus = RegQueryValueEx( NetlogonRootKey,
NETP_NETLOGON_RPC,
NULL,
&Type,
( LPBYTE )&Value,
&Length );
if ( NetStatus == NERR_Success)
{
NetpLog(( "NetpGetNt4RefusePasswordChangeStatus: RefusePasswordChange == %d\n", Value));
if ( Value != 0 )
{
*RefusePasswordChangeSet = TRUE;
}
}
RegCloseKey( NetlogonRootKey );
}
RegCloseKey( DcKey );
}
}
if ( FullComputerName != Nt4Dc )
{
NetApiBufferFree( FullComputerName );
}
//
// If anything went wrong, ignore it...
//
if ( NetStatus != NERR_Success )
{
NetpLog(( "NetpGetNt4RefusePasswordChangeStatus: failed but ignored the failure: 0x%lx\n", NetStatus ));
NetStatus = NERR_Success;
}
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpGetComputerNameAllocIfReqd(
OUT LPWSTR* ppwszMachine,
IN UINT cLen
)
/*++
Routine Description:
Get name of the computer on which this runs. Alloc a buffer
if the name is longer than cLen.
Arguments:
ppwszMachine -- pointer to buffer. this receives a buffer if allocated.
cLen -- length of buffer pointed to by *ppwszMachine.
If the computer name to be returned is longer than this
a new buffer is allocated.
Returns:
NERR_Success -- Success
--*/
{
NET_API_STATUS NetStatus=NERR_Success;
if ( GetComputerName( *ppwszMachine, &cLen ) == FALSE )
{
NetStatus = GetLastError();
if ( (NetStatus == ERROR_INSUFFICIENT_BUFFER) ||
(NetStatus == ERROR_BUFFER_OVERFLOW) )
{
// allocate an extra char for the append-$ case
NetStatus = NetApiBufferAllocate( (cLen + 1 + 1) * sizeof(WCHAR),
(PBYTE *) ppwszMachine );
if ( NetStatus == NERR_Success )
{
if ( GetComputerName( *ppwszMachine, &cLen ) == FALSE )
{
NetStatus = GetLastError();
}
}
}
}
return NetStatus;
}
// ======================================================================
//
// Note: all code below this has been added as helper code for
// NetpSetComputerAccountPassword. this function is used by
// netdom.exe to fix a dc that was rendered unusable because
// of a ds restore resulting into 2+ password mismatch on
// machine account.
//
// This entire code is temporary and should be removed and
// rewritten post w2k.
//
static
NET_API_STATUS
NET_API_FUNCTION
NetpEncodePassword(
IN LPWSTR lpPassword,
IN OUT PUCHAR Seed,
OUT LPWSTR *EncodedPassword,
OUT PULONG EncodedPasswordLength
)
{
NET_API_STATUS status = NERR_Success;
UNICODE_STRING EncodedPasswordU;
PWSTR PasswordPart;
ULONG PwdLen;
*EncodedPassword = NULL;
*EncodedPasswordLength = 0;
if ( lpPassword ) {
PwdLen = wcslen( ( LPWSTR )lpPassword ) * sizeof( WCHAR );
PwdLen += sizeof( WCHAR ) + sizeof( WCHAR );
status = NetApiBufferAllocate( PwdLen,
( PVOID * )EncodedPassword );
if ( status == NERR_Success ) {
//
// We'll put the encode byte as the first character in the string
//
PasswordPart = ( *EncodedPassword ) + 1;
wcscpy( PasswordPart, ( LPWSTR )lpPassword );
RtlInitUnicodeString( &EncodedPasswordU, PasswordPart );
*Seed = 0;
RtlRunEncodeUnicodeString( Seed, &EncodedPasswordU );
*( PWCHAR )( *EncodedPassword ) = ( WCHAR )*Seed;
//
// Encode the old password as well...
//
RtlInitUnicodeString( &EncodedPasswordU, lpPassword );
RtlRunEncodeUnicodeString( Seed, &EncodedPasswordU );
*EncodedPasswordLength = PwdLen;
}
}
return( status );
}
NTSTATUS
NetpLsaOpenSecret2(
IN LSA_HANDLE hLsa,
IN PUNICODE_STRING pusSecretName,
IN ACCESS_MASK DesiredAccess,
OUT PLSA_HANDLE phSecret
)
{
NTSTATUS Status = STATUS_UNSUCCESSFUL;
HANDLE hToken=NULL;
__try
{
if (OpenThreadToken(GetCurrentThread(), TOKEN_IMPERSONATE,
TRUE, &hToken))
{
if (SetThreadToken(NULL, NULL))
{
Status = STATUS_SUCCESS;
}
}
else
{
if (GetLastError() == ERROR_NO_TOKEN)
{
Status = STATUS_SUCCESS;
}
}
if ( NT_SUCCESS(Status) )
{
Status = LsaOpenSecret(hLsa, pusSecretName,
DesiredAccess, phSecret);
}
}
__finally
{
if (hToken)
{
SetThreadToken(NULL, hToken);
}
}
NetpLog(( "NetpLsaOpenSecret: status: 0x%lx\n", Status ));
return Status;
}
NET_API_STATUS
NET_API_FUNCTION
NetpManageMachineSecret2(
IN LSA_HANDLE PolicyHandle, OPTIONAL
IN LPWSTR lpMachine,
IN LPWSTR lpPassword,
IN BOOL fDelete,
OUT PLSA_HANDLE pPolicyHandle OPTIONAL
)
{
NTSTATUS Status = STATUS_SUCCESS;
LSA_HANDLE LocalPolicy = NULL, SecretHandle = NULL;
UNICODE_STRING Key, Data, *CurrentValue = NULL;
BOOLEAN SecretCreated = FALSE;
if( fDelete == FALSE )
{
ASSERT( lpPassword );
}
UNREFERENCED_PARAMETER( lpMachine );
Status = NetpGetLsaHandle( NULL, PolicyHandle, &LocalPolicy );
//
// open/create the secret
//
if ( NT_SUCCESS( Status ) )
{
RtlInitUnicodeString( &Key, L"$MACHINE.ACC" );
RtlInitUnicodeString( &Data, lpPassword );
Status = NetpLsaOpenSecret2( LocalPolicy, &Key,
fDelete == NETSETUPP_CREATE ?
SECRET_SET_VALUE | SECRET_QUERY_VALUE : DELETE,
&SecretHandle );
if ( Status == STATUS_OBJECT_NAME_NOT_FOUND )
{
if ( fDelete )
{
Status = STATUS_SUCCESS;
}
else
{
Status = LsaCreateSecret( LocalPolicy, &Key,
SECRET_SET_VALUE, &SecretHandle );
if ( NT_SUCCESS( Status ) )
{
SecretCreated = TRUE;
}
}
}
if ( !NT_SUCCESS( Status ) )
{
NetpLog(( "NetpManageMachineSecret: Open/Create secret failed: 0x%lx\n", Status ));
}
if ( NT_SUCCESS( Status ) )
{
if ( fDelete == NETSETUPP_CREATE )
{
//
// First, read the current value, so we can save it as the old value
//
if ( SecretCreated )
{
CurrentValue = &Data;
}
else
{
Status = LsaQuerySecret( SecretHandle, &CurrentValue,
NULL, NULL, NULL );
}
if ( NT_SUCCESS( Status ) )
{
//
// Now, store both the new password and the old
//
Status = LsaSetSecret( SecretHandle, &Data, CurrentValue );
if ( !SecretCreated )
{
LsaFreeMemory( CurrentValue );
}
}
}
else
{
//
// No secret handle means we failed earlier in
// some intermediate state. That's ok, just press on.
//
if ( SecretHandle != NULL )
{
Status = LsaDelete( SecretHandle );
if ( NT_SUCCESS( Status ) )
{
SecretHandle = NULL;
}
}
}
}
if ( SecretHandle )
{
LsaClose( SecretHandle );
}
}
NetpSetLsaHandle( PolicyHandle, LocalPolicy, pPolicyHandle );
if ( !NT_SUCCESS( Status ) )
{
NetpLog(( "NetpManageMachineSecret: '%s' operation failed: 0x%lx\n",
fDelete == NETSETUPP_CREATE ? "CREATE" : "DELETE", Status ));
}
return( RtlNtStatusToDosError( Status ) );
}
NET_API_STATUS
NET_API_FUNCTION
NetpSetMachineAccountPasswordAndTypeEx2(
IN LPWSTR lpDcName,
IN PSID DomainSid,
IN LPWSTR lpAccountName,
IN OUT OPTIONAL LPWSTR lpPassword,
IN OPTIONAL UCHAR AccountState
)
{
NET_API_STATUS NetStatus=NERR_Success;
NTSTATUS Status = STATUS_SUCCESS;
UNICODE_STRING DcName, AccountName;
OBJECT_ATTRIBUTES ObjectAttributes;
SAM_HANDLE SamHandle = NULL, DomainHandle = NULL, AccountHandle = NULL;
ULONG UserRid;
PULONG RidList = NULL;
PSID_NAME_USE NameUseList = NULL;
PUSER_CONTROL_INFORMATION UserAccountControl = NULL;
USER_SET_PASSWORD_INFORMATION PasswordInfo;
ULONG OldUserInfo;
BOOL fAccountControlModified = FALSE;
LPWSTR lpSamAccountName=lpAccountName;
ULONG AccountNameLen=0;
AccountNameLen = wcslen( lpAccountName );
//
// if caller has not passed in sam-account name,
// generate it from machine name ==> append $ at the end
//
if (lpAccountName[AccountNameLen-1] != L'$')
{
NetStatus = NetpGetMachineAccountName(lpAccountName,
&lpSamAccountName);
if (NetStatus != NERR_Success)
{
Status = STATUS_INSUFFICIENT_RESOURCES;
goto SetPasswordError;
}
}
RtlInitUnicodeString( &DcName, lpDcName );
RtlZeroMemory( &ObjectAttributes, sizeof( OBJECT_ATTRIBUTES ) );
Status = SamConnect( &DcName,
&SamHandle,
SAM_SERVER_CONNECT | SAM_SERVER_LOOKUP_DOMAIN,
&ObjectAttributes );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamConnect to %wZ failed with 0x%lx\n", &DcName, Status ));
goto SetPasswordError;
}
//
// Open the domain
//
Status = SamOpenDomain( SamHandle,
DOMAIN_LOOKUP,
DomainSid,
&DomainHandle );
if ( !NT_SUCCESS( Status ) ) {
#ifdef NETSETUP_VERBOSE_LOGGING
UNICODE_STRING DisplaySid;
NTSTATUS Status2;
RtlZeroMemory( &DisplaySid, sizeof( UNICODE_STRING ) );
Status2 = RtlConvertSidToUnicodeString( &DisplaySid, DomainSid, TRUE );
if ( NT_SUCCESS( Status2 ) ) {
NetpLog(( "SamOpenDomain on %wZ failed with 0x%lx\n",
&DisplaySid, Status ));
RtlFreeUnicodeString(&DisplaySid);
} else {
NetpLog(( "SamOpenDomain on <undisplayable sid> failed with 0x%lx\n",
Status ));
}
#endif
goto SetPasswordError;
}
//
// Get the RID of the user account
//
RtlInitUnicodeString( &AccountName, lpSamAccountName );
Status = SamLookupNamesInDomain( DomainHandle,
1,
&AccountName,
&RidList,
&NameUseList );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamLookupNamesInDomain on %wZ failed with 0x%lx\n",
&AccountName, Status ));
goto SetPasswordError;
}
UserRid = RidList[ 0 ];
SamFreeMemory( RidList );
SamFreeMemory( NameUseList );
//
// Finally, open the user account
//
Status = SamOpenUser( DomainHandle,
USER_FORCE_PASSWORD_CHANGE | USER_READ_ACCOUNT | USER_WRITE_ACCOUNT,
UserRid,
&AccountHandle );
if ( !NT_SUCCESS( Status ) ) {
Status = SamOpenUser( DomainHandle,
USER_FORCE_PASSWORD_CHANGE | USER_READ_ACCOUNT,
UserRid,
&AccountHandle );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamOpenUser on %lu failed with 0x%lx\n",
UserRid,
Status ));
goto SetPasswordError;
}
}
//
// Now, read the current user account type and see if it needs to be modified
//
Status = SamQueryInformationUser( AccountHandle,
UserControlInformation,
( PVOID * )&UserAccountControl );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamQueryInformationUser for UserControlInformation "
"failed with 0x%lx\n", Status ));
goto SetPasswordError;
}
OldUserInfo = UserAccountControl->UserAccountControl;
//
// Determine if the account control changes. If the account is being enabled,
// we want to perform the following sequence of operations: enable, disable,
// and enable again. This is needed to increase the USN (Universal Sequence
// Number) of this attribute so that the enabled value will win if the DS
// replication resolves colliding changes, as the following example shows.
// Suppose we have two DCs in the domain we join, A abd B. Suppose the account
// is currently disabled on A (because the user unjoined using that DC),
// but it is still enabled on B (because the replication hasn't happened yet).
// Suppose the user performs now joining to the domain. Then we have discovered
// B and so we proceed with setting up the changes to the existing account. If
// we don't toggle the account control attribute, then the USN of this attribute
// will not change on B (since attribute's value doesn't change) while it was
// incremented on A as the result of unjoin. At the replication time the data
// from A will rule and the account will be incorrectly marked as diabled.
//
// NOTE: This design may fail for the case of unjoining a domain that has
// three (or more) DCs, A, B, and C if the following sequence of operations
// happens. Suppose that the account is originally enabled on all DCs (state [1]
// in the bellow diagram). Then the user unjoins using DC A (state [2]). Then the
// user joins using B where the account is still enabled (state [3]). Then the user
// unjoins using C where the account is still enabled (state [4]). The final
// operation is unjoin, so the user expects that his account is disabled. We've
// assumed here that for some reason no replication was happening when these
// operations were performed. Then at the replication time the value from B will
// win (because of the additional toggling performed at the join time). But the
// account state on B is Enabled, so the final result will be that the account is
// enabled on all DCs which is not what the user expects.
//
// A B C
// Enabled [1] Enabled [1] Enabled [1]
// Disabled [2] Enabled (no-op)+Disabled (1 op) Disabled [4]
// Enabled [3]
//
if ( AccountState != ACCOUNT_STATE_IGNORE ) {
if ( AccountState == ACCOUNT_STATE_ENABLED ) {
fAccountControlModified = TRUE;
UserAccountControl->UserAccountControl &= ~USER_ACCOUNT_DISABLED;
}
if ( ( AccountState == ACCOUNT_STATE_DISABLED ) &&
!( OldUserInfo & USER_ACCOUNT_DISABLED ) ) {
fAccountControlModified = TRUE;
UserAccountControl->UserAccountControl |= USER_ACCOUNT_DISABLED;
}
}
if ( fAccountControlModified == FALSE ) {
SamFreeMemory( UserAccountControl );
UserAccountControl = NULL;
}
//
// First, set the account type if required
//
if ( UserAccountControl ) {
Status = SamSetInformationUser( AccountHandle,
UserControlInformation,
( PVOID )UserAccountControl );
if ( !NT_SUCCESS( Status ) ) {
NetpLog(( "SamSetInformationUser for UserControlInformation "
"failed with 0x%lx\n", Status ));
goto SetPasswordError;
//
// If we are enabling the account, disable and re-enable it to
// make the two additional account state toggles.
//
} else if ( AccountState == ACCOUNT_STATE_ENABLED ) {
UserAccountControl->UserAccountControl |= USER_ACCOUNT_DISABLED;
Status = SamSetInformationUser( AccountHandle,
UserControlInformation,
( PVOID )UserAccountControl );
if ( !NT_SUCCESS(Status) ) {
NetpLog(( "SamSetInformationUser (second) for UserControlInformation "
"failed with 0x%lx\n", Status ));
goto SetPasswordError;
}
UserAccountControl->UserAccountControl &= ~USER_ACCOUNT_DISABLED;
Status = SamSetInformationUser( AccountHandle,
UserControlInformation,
( PVOID )UserAccountControl );
if ( !NT_SUCCESS(Status) ) {
NetpLog(( "SamSetInformationUser (third) for UserControlInformation "
"failed with 0x%lx\n", Status ));
goto SetPasswordError;
}
}
}
//
// If requested, set the password on the account
//
if ( lpPassword != NULL )
{
RtlInitUnicodeString( &PasswordInfo.Password, lpPassword );
PasswordInfo.PasswordExpired = FALSE;
//
// Ok, then, set the password on the account
//
// The caller has passed in a strong password, try that first
// NT5 dcs will always accept a strong password.
//
Status = SamSetInformationUser( AccountHandle,
UserSetPasswordInformation,
( PVOID )&PasswordInfo );
if ( !NT_SUCCESS( Status ) )
{
if ( (Status == STATUS_PASSWORD_RESTRICTION) &&
!NetpIsDefaultPassword( lpAccountName, lpPassword ))
{
NetpLog(( "NetpSetMachineAccountPasswordAndTypeEx: STATUS_PASSWORD_RESTRICTION error setting password. retrying...\n" ));
//
// SAM did not accpet a long password, try LM20_PWLEN
//
// This is probably because the dc is NT4 dc.
// NT4 dcs will not accept a password longer than LM20_PWLEN
//
lpPassword[LM20_PWLEN] = UNICODE_NULL;
RtlInitUnicodeString( &PasswordInfo.Password, lpPassword );
Status = SamSetInformationUser( AccountHandle,
UserSetPasswordInformation,
( PVOID )&PasswordInfo );
if ( Status == STATUS_PASSWORD_RESTRICTION )
{
NetpLog(( "NetpSetMachineAccountPasswordAndTypeEx: STATUS_PASSWORD_RESTRICTION error setting password. retrying...\n" ));
//
// SAM did not accpet a LM20_PWLEN password, try shorter one
//
// SAM uses RtlUpcaseUnicodeStringToOemString internally.
// In this process it is possible that in the worst case,
// n unicode char password will get mapped to 2*n dbcs
// char password. This will make it exceed LM20_PWLEN.
// To guard against this worst case, try a password
// with LM20_PWLEN/2 length
//
// One might say that LM20_PWLEN/2 length password
// is not really secure. I agree, but it is definitely
// better than the default password which we will have
// to fall back to otherwise.
//
lpPassword[LM20_PWLEN/2] = UNICODE_NULL;
RtlInitUnicodeString( &PasswordInfo.Password, lpPassword );
Status = SamSetInformationUser( AccountHandle,
UserSetPasswordInformation,
( PVOID )&PasswordInfo );
if ( Status == STATUS_PASSWORD_RESTRICTION )
{
//
// SAM did not accpet a short pwd, try default pwd
//
NetpLog(( "NetpSetMachineAccountPasswordAndTypeEx: STATUS_PASSWORD_RESTRICTION error setting password. retrying...\n" ));
NetpGenerateDefaultPassword(lpAccountName, lpPassword);
RtlInitUnicodeString( &PasswordInfo.Password, lpPassword );
Status = SamSetInformationUser( AccountHandle,
UserSetPasswordInformation,
( PVOID )&PasswordInfo );
}
}
}
if ( NT_SUCCESS( Status ) )
{
NetpLog(( "NetpGenerateDefaultPassword: successfully set password\n" ));
}
else
{
NetpLog(( "NetpSetMachineAccountPasswordAndTypeEx: SamSetInformationUser for UserSetPasswordInformation failed: 0x%lx\n", Status ));
//
// Make sure we try to restore the account control
//
if ( UserAccountControl )
{
NTSTATUS Status2;
UserAccountControl->UserAccountControl = OldUserInfo;
Status2 = SamSetInformationUser( AccountHandle,
UserControlInformation,
( PVOID )UserAccountControl );
if ( !NT_SUCCESS( Status2 ) )
{
NetpLog(( "SamSetInformationUser for UserControlInformation (RESTORE) failed with 0x%lx\n", Status2 ));
}
}
goto SetPasswordError;
}
}
}
SetPasswordError:
if ( lpSamAccountName != lpAccountName )
{
NetApiBufferFree( lpSamAccountName );
}
if ( AccountHandle ) {
SamCloseHandle( AccountHandle );
}
if ( DomainHandle ) {
SamCloseHandle( DomainHandle );
}
if ( SamHandle ) {
SamCloseHandle( SamHandle );
}
NetStatus = RtlNtStatusToDosError( Status );
SamFreeMemory( UserAccountControl );
return( NetStatus );
}
NET_API_STATUS
NET_API_FUNCTION
NetpSetComputerAccountPassword(
IN PWSTR szMachine,
IN PWSTR szDomainController,
IN PWSTR szUser,
IN PWSTR szUserPassword,
IN PVOID Reserved
)
{
NET_API_STATUS NetStatus=NERR_Success;
NET_API_STATUS NetStatus2=NERR_Success;
BOOL fIpcConnected = FALSE;
BYTE bSeed;
PPOLICY_PRIMARY_DOMAIN_INFO pPolicyPDI = NULL;
PPOLICY_DNS_DOMAIN_INFO pPolicyDns = NULL;
LSA_HANDLE hLsa = NULL, hDC = NULL;
WCHAR szMachinePassword[ PWLEN + 1];
WCHAR szMachineNameBuf[MAX_COMPUTERNAME_LENGTH + 1];
PWSTR szMachineName=szMachineNameBuf;
NetSetuppOpenLog();
NetpLog(( "NetpSetComputerAccountPassword: for '%ws' on '%ws' using '%ws' creds\n", GetStrPtr(szMachine), GetStrPtr(szDomainController), GetStrPtr(szUser) ));
if ( ( szDomainController == NULL ) ||
( szUser == NULL ) ||
( szUserPassword == NULL ) )
{
NetStatus = ERROR_INVALID_PARAMETER;
goto Cleanup;
}
if ( szMachine == NULL )
{
NetStatus = NetpGetComputerNameAllocIfReqd(&szMachineName,
MAX_COMPUTERNAME_LENGTH);
}
else
{
szMachineName = szMachine;
}
NetStatus = NetpManageIPCConnect( szDomainController,
szUser, szUserPassword,
NETSETUPP_CONNECT_IPC );
RtlZeroMemory( szUserPassword, wcslen( szUserPassword ) * sizeof(WCHAR) );
NetpLog(( "NetpSetComputerAccountPassword: status of connecting to dc '%ws': 0x%lx\n", szDomainController, NetStatus ));
//
// get the lsa domain info on the DC
//
if ( NetStatus == NERR_Success )
{
fIpcConnected = TRUE;
NetStatus = NetpGetLsaPrimaryDomain(NULL, szDomainController,
&pPolicyPDI, &pPolicyDns, &hDC);
}
if (NetStatus == NERR_Success)
{
//
// Generate the password to use on the machine account.
//
NetStatus = NetpGeneratePassword( szMachineName,
TRUE, // fRandomPwdPreferred
szDomainController,
FALSE, // fIsNt4Dc
szMachinePassword );
NetpLog(( "NetpSetComputerAccountPassword: status of generating machine password: 0x%lx\n", NetStatus ));
}
if (NetStatus == NERR_Success)
{
NetStatus = NetpSetMachineAccountPasswordAndTypeEx2(
szDomainController, pPolicyPDI->Sid,
szMachineName, szMachinePassword,
ACCOUNT_STATE_IGNORE
);
NetpLog(( "NetpSetComputerAccountPassword: status of setting machine password on %ws: 0x%lx\n", GetStrPtr(szDomainController), NetStatus ));
}
if (NetStatus == NERR_Success)
{
// if we are not creating the machine account,
// just set the password
NetStatus = NetpSetMachineAccountPasswordAndTypeEx2(
szMachineName, pPolicyPDI->Sid,
szMachineName, szMachinePassword,
ACCOUNT_STATE_IGNORE
);
NetpLog(( "NetpSetComputerAccountPassword: status of setting machine password on %ws: 0x%lx\n", GetStrPtr(szMachineName), NetStatus ));
}
//
// set the local machine secret
//
if ( NetStatus == NERR_Success )
{
NetStatus = NetpGetLsaHandle( NULL, NULL, &hLsa );
if ( NetStatus == NERR_Success )
{
NetStatus = NetpManageMachineSecret2( NULL, szMachineName,
szMachinePassword,
NETSETUPP_CREATE, &hLsa );
LsaClose( hLsa );
}
NetpLog(( "NetpSetComputerAccountPassword: status of setting local secret: 0x%lx\n", NetStatus ));
}
//
// Now, we no longer need our session to our dc
//
if ( fIpcConnected )
{
//RtlRunDecodeUnicodeString( bSeed, &usEncodedPassword );
NetStatus2 = NetpManageIPCConnect( szDomainController, szUser,
//usEncodedPassword.Buffer,
NULL,
NETSETUPP_DISCONNECT_IPC );
//RtlRunEncodeUnicodeString( &bSeed, &usEncodedPassword );
NetpLog(( "NetpJoinDomain: status of disconnecting from '%ws': 0x%lx\n", szDomainController, NetStatus2));
}
Cleanup:
if ( (szMachineName != szMachine) &&
(szMachineName != szMachineNameBuf) )
{
NetApiBufferFree( szMachineName );
}
NetpLog(( "NetpSetComputerAccountPassword: status: 0x%lx\n", NetStatus ));
NetSetuppCloseLog();
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpUpdateW32timeConfig(
IN PCSTR szW32timeJoinConfigFuncName
)
/*++
Routine Description:
Call entry point in w32time service so that it can update
its internal info after a domain join/unjoin
Arguments:
szW32timeJoinConfigFuncName - name of entry point to call
(must be W32TimeVerifyJoinConfig or W32TimeVerifyUnjoinConfig)
Return Value:
NERR_Success -- on Success
otherwise win32 error codes returned by LoadLibrary, GetProcAddress
Notes:
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
HANDLE hDll = NULL;
typedef VOID (*PW32TimeUpdateJoinConfig)( VOID );
PW32TimeUpdateJoinConfig pfnW32timeUpdateJoinConfig = NULL;
//
// Call into the time service to allow it initialize itself properly
//
hDll = LoadLibraryA( "w32Time" );
if ( hDll != NULL )
{
pfnW32timeUpdateJoinConfig =
(PW32TimeUpdateJoinConfig) GetProcAddress(hDll,
szW32timeJoinConfigFuncName);
if ( pfnW32timeUpdateJoinConfig != NULL )
{
pfnW32timeUpdateJoinConfig();
}
else
{
NetStatus = GetLastError();
NetpLog(( "NetpUpdateW32timeConfig: Failed to get proc address for %s: 0x%lx\n", szW32timeJoinConfigFuncName, NetStatus ));
}
}
else
{
NetStatus = GetLastError();
NetpLog(( "NetpUpdateW32timeConfig: Failed to load w32time: 0x%lx\n", NetStatus ));
}
if ( hDll != NULL )
{
FreeLibrary( hDll );
}
NetpLog(( "NetpUpdateW32timeConfig: 0x%lx\n", NetStatus ));
return NetStatus;
}
NET_API_STATUS
NET_API_FUNCTION
NetpUpdateAutoenrolConfig(
IN BOOL UnjoinDomain
)
/*++
Routine Description:
Call entry point in pautoenr service so that it can update
its internal info after a domain join/unjoin
Arguments:
UnjoinDomain - If TRUE, we are unjoining from a domain.
Otherwise, we are roling back from unsuccessful domain
unjoin.
Return Value:
NERR_Success -- on Success
otherwise win32 error codes returned by LoadLibrary, GetProcAddress
Notes:
--*/
{
NET_API_STATUS NetStatus = NERR_Success;
HANDLE hDll = NULL;
ULONG Flags = 0;
typedef BOOL (*PCertAutoRemove)( DWORD );
PCertAutoRemove pfnCertAutoRemove = NULL;
//
// Prepare the flags to pass to autoenrol routine
//
if ( UnjoinDomain ) {
Flags = CERT_AUTO_REMOVE_COMMIT;
} else {
Flags = CERT_AUTO_REMOVE_ROLL_BACK;
}
//
// Call into the time service to allow it initialize itself properly
//
hDll = LoadLibraryA( "pautoenr" );
if ( hDll != NULL ) {
pfnCertAutoRemove =
(PCertAutoRemove) GetProcAddress( hDll, "CertAutoRemove" );
if ( pfnCertAutoRemove != NULL ) {
if ( !pfnCertAutoRemove(Flags) ) {
NetStatus = GetLastError();
NetpLog(( "NetpUpdateAutoenrolConfig: CertAutoRemove failed 0x%lx\n",
NetStatus ));
}
} else {
NetStatus = GetLastError();
NetpLog(( "NetpUpdateAutoenrolConfig: Failed to get CertAutoRemove proc address 0x%lx\n",
NetStatus ));
}
} else {
NetStatus = GetLastError();
NetpLog(( "NetpUpdateAutoenrolConfig: Failed to load w32time: 0x%lx\n", NetStatus ));
}
if ( hDll != NULL ) {
FreeLibrary( hDll );
}
return NetStatus;
}