summaryrefslogtreecommitdiff
path: root/source4/setup/provision.ldif
AgeCommit message (Collapse)AuthorFilesLines
2013-01-27provision: fix nTSecurityDescriptor of CN={LostAndFound,System},${DOMAINDN} ↵Stefan Metzmacher1-0/+2
(bug #9481) Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2012-12-11s4:provision: set the correct nTSecurityDescriptor on CN=Domain ↵Stefan Metzmacher1-0/+1
Controllers,... (bug #9481) Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Michael Adam <obnox@samba.org> Autobuild-Date(master): Tue Dec 11 07:05:39 CET 2012 on sn-devel-104
2012-12-11s4:provision: set the correct nTSecurityDescriptor on CN=Builtin,... (bug #9481)Stefan Metzmacher1-0/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-11s4:provision: set the correct nTSecurityDescriptor on CN=Infrastructure,... ↵Stefan Metzmacher1-0/+1
(bug #9481) Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2010-06-26s4:provision: move Samba4 specific DNS stuff to its own fileStefan Metzmacher1-5/+0
metze
2010-06-26s4:provision: don't use hardcoded values for 'nextRid' and 'rIDAvailablePool'Stefan Metzmacher1-1/+1
On Windows dcpromo imports nextRid from the local SAM, which means it's not hardcoded to 1000. The initlal rIDAvailablePool starts at nextRid + 100. I also found that the RID Set of the local dc should be created via provision and not at runtime, when the first rid is needed. (Tested with dcpromo on w2k8r2, while disabling the DNS check box). After provision we should have this (assuming nextRid=1000): rIDAllocationPool: 1100-1599 rIDPrevAllocationPool: 1100-1599 rIDUsedPool: 0 rIDNextRID: 1100 rIDAvailablePool: 1600-1073741823 Because provision sets rIDNextRid=1100, the first created account (typically DNS related accounts) will get 1101 as rid! metze
2010-06-24Revert "s4:provision.ldif - fix the number of available RIDs"Matthias Dieter Wallnöfer1-1/+1
This reverts commit 41cdcd54b7b7e3fb70fdb220e74a1daf30e1891a. As per request of metze revert this (cause written on the mailing list).
2010-06-24s4:provision.ldif - fix the number of available RIDsMatthias Dieter Wallnöfer1-1/+1
There should be 4611686014132422209 and not 4611686014132422109.
2010-06-24s4:provision.ldif - this Win2003 revision level seems always to be "9" on ↵Matthias Dieter Wallnöfer1-1/+1
Windows Server 2008 machines
2010-05-13s4:provision.ldif - add IP security objects as they exist on Windows ServerMatthias Dieter Wallnöfer1-0/+282
2010-05-13s4:provision.ldif - add more Windows 2008 domain operationsMatthias Dieter Wallnöfer1-0/+72
2010-05-13s4:provision.ldif - "passwordSettingsContainer" add "showInAdvancedViewOnly"Matthias Dieter Wallnöfer1-0/+1
2010-05-13s4:provision.ldif - fix up "NTDS Quotas" "systemFlags"Matthias Dieter Wallnöfer1-1/+1
2010-02-26Revert "s4:AD content - adequate some revision levels to match Windows ↵Andrew Tridgell1-2/+2
Server 2008" This reverts commit 973ea198677c581064fad62cdac30baac7103ef8. This change breaks DRS dcpromo.
2010-02-21s4:AD content - Implement the new password settings containerMatthias Dieter Wallnöfer1-0/+5
2010-02-21s4:AD content - adequate some revision levels to match Windows Server 2008Matthias Dieter Wallnöfer1-2/+2
2010-02-21s4:AD content - Add the DFSR objects which exist on Windows Server >= 2008Matthias Dieter Wallnöfer1-2/+20
Those replace the FRS ones.
2010-01-08s4-provision: RID 1000 is consumed by the machine accountAndrew Tridgell1-1/+1
2010-01-08s4-provision: don't hard wire the creation of the RID Set objectAndrew Tridgell1-2/+1
We now create it automatically in the samldb module when the first user is created. The creation of the dns user also had to move to the _modify.ldif as it now relies on the fSMO role being setup for the RID Manager Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-08s4-provision: added an initial RID SetAndrew Tridgell1-1/+2
We will allocate RIDs from this set Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2009-10-06s4-provision: match win2003 functional levelAndrew Tridgell1-1/+1
We are now defaulting to win2003 functional level, and see to report the right revisions of our db and schema
2009-09-30s4:provision: Show domains and forests are W2K8 DC capable.Andrew Kroeger1-0/+5
When adding a W2K8 DC to a domain running earlier DC versions, the "adprep" utility is used to perform schema updates and update other attributes as necessary. Adding these entries provides an indication that the adprep utility has been run with the /forestprep, /domainprep and /rodcprep arguments. Although these entries indicate adprep has been run, nothing has been done to verify that the changes that the adprep utility would have made have actually been done. The values used for the revision atttributes are as seen on a W2K8 DC (not W2K8 R2, which will probably have higher values).
2009-09-25s4:LDIFs - enhance the section commentsMatthias Dieter Wallnöfer1-0/+4
2009-09-17s4:provision - Some rework (continuation)Matthias Dieter Wallnöfer1-6/+9
- Fix up "servicePrincipalNames" attributes on the DC object - Add some informative comments (most in "provision_self_join.ldif") - Add also comments where objects are missing which we may add later when we support the feature (mainly for FRS) - Add "domain updates" objects also under "CN=Configuration" (they exist twice) - Add the default services under "Services" to allow interoperability with some MS client tools - Smaller changes
2009-09-17s4:provision - Some reworkMatthias Dieter Wallnöfer1-0/+225
- Add/change "wellKnownObjects" attributes - Order entries in "provision_basedn_modify.ldif" - Add/change "delete entries" object under BASEDN and CONFIGDN - Fix default version number of "Default domain policy" group policy - Add "domain updates" objects for interoperability with MS AD maintaining tools - Show version number in the "oEMInformation" attribute (suggested by ekacnet) - Smaller fixups
2009-09-11s4:group policies - add the domain controller group policyMatthias Dieter Wallnöfer1-0/+1
This patches fixes the last difference between s4 and Windows Server regarding group policy objects: we hadn't the domain controller policy. - Adds the domain controller policy as it is found in the "original" AD - Adds also the right version number in the GPT.INI file for the domain group policy (was missing)
2009-09-07s4:Foreign security principals - Fix them upMatthias Dieter Wallnöfer1-0/+2
I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-08-26s4:provision Only create references to our server DN after the self joinAndrew Bartlett1-2/+0
This will ensure that the GUID can be filled in correctly, and assist us to validate DN targets in the future. Andrew Bartlett
2009-08-11s4:AD LDIFs - More refactoringMatthias Dieter Wallnöfer1-0/+36
This commit includes: - Additional static object data in SAMBA 4's AD to start supporting of - forest updates, - lost and found, - quotas on DS, - physical locations, - licensing of sites, - subnets, - policies for WMI, - DNS entries in AD - Reordering of provision*.ldif files to be able to find entries and make future additions easier - Add comments in provision*.ldif files to point out where subentries are located when they are based in other LDIFs - Removations of autogenerated "cn" attributes
2009-07-20[SAMBA 4 directory] Refactoring and clean up of directory structureMatthias Dieter Wallnöfer1-37/+147
- Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-01[SAMBA 4 directory] Corrects the "systemFlags" attributesMatthias Dieter Wallnöfer1-6/+8
Set the values like Windows Server 2003 R2.
2009-05-26s4:provision: Added ComPartitionSets entry.Andrew Kroeger1-0/+5
Without this entry, opening the COM+ tab under the properties of an OU within ADUC results in the following error: "Unable to retrieve all user properties, 0x80072030"
2008-04-09Be consistant in using ${SEVERDN}.Andrew Bartlett1-2/+2
This ensures we don't fall out of sync with the provision scripts. Andrew Bartlett (This used to be commit 566c60b4649e2b94bf467993acd4bf72c7368e5a)
2008-02-09From a request from Peter Huang, include IPsec sechema.Andrew Bartlett1-0/+4
(We may need to include more defaults in the template, but I want to start small for now). Andrew Bartlett (This used to be commit a466dda118f785bf784548106637577a5e25a30e)
2008-01-18Remove default 'showInAdvancedViewOnly' values.Andrew Bartlett1-8/+3
This means we only show and set the values when they are not the values the schema and objectclass module would impose. Andrew Bartlett (This used to be commit c2f2e01357c1b087aa1261fb2cac8687426d5a78)
2008-01-18Don't manually specify instanceID in the template files.Andrew Bartlett1-8/+0
The instanceid module creates this automaticlly, so we don't need this any more. Andrew Bartlett (This used to be commit f6dbdf34e8a790f460b705100e45ee3928b6b1b3)
2007-10-10r24694: Remove objectCategory entries from the setup templates. These can beAndrew Bartlett1-8/+0
autogenerated by the objectclass module when the the entries are added. Andrew Bartlett (This used to be commit 79e13349f00d009fc5dd0cdddade379df906ebc8)
2007-10-10r23859: Work to have Group Policy work 'out of the box' in Samba4.Andrew Bartlett1-28/+0
This involves creating the SYSVOL and NETLOGON shares at provision time, and creating the right subdirectories. This also changes the behaviour of lp.get("foo") in ejs - we now return undefined, rather than syntax error, if the parameter doesn't exist (perhaps because the share isn't defined). Andrew Bartlett (This used to be commit 45cadf3bc0d38f6600666511a392e1ce353adee7)
2007-10-10r23815: Thanks to Matthias Wallnoefer <mwallnoefer@yahoo.de> for pointing outAndrew Bartlett1-2/+2
that we had the wrong objectClass for OU=Domain Controllers,${DOMAINDN} (was CN=Domain Controllers,${DOMAINDN}) This fixes both the SAMR server and the LDIF templates. Andrew Bartlett (This used to be commit 625a9e6c041bedc93925bdebb3a60af1dbdde317)
2007-10-10r23027: Make sure the parent object always exists.Andrew Bartlett1-0/+4
Andrew Bartlett (This used to be commit 55c7c0906ccb741ab002f460164ccbbe56b55a98)
2007-10-10r22984: not everyone uses tridgell.net (fortunately)Andrew Tridgell1-1/+1
(This used to be commit f60817d7970ab449ac327f4da312f10350b9636f)
2007-10-10r22972: added the basic ldif needed to support group policies in Samba4. WinXPAndrew Tridgell1-0/+28
clients do correctly see our group policies, but the gpmc admin tool doesn't yet work to allow you to edit the policies (This used to be commit 4c6e01a585f59caf7d2d87833f5eedc018ed8acc)
2007-10-10r20557: use ${DOMAINDN} instead of ${BASEDN}Stefan Metzmacher1-8/+8
metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-10-10r20553: add ${CONFIGDN} and ${SCHEMADN} instead of using hardcoded pathsStefan Metzmacher1-10/+10
under ${BASEDN} metze (This used to be commit 09ca6aae12d8e10b76971cf269f7c62f228a4c87)
2007-10-10r20468: Patch from Martin Kuehl <kuehl@univention.de> to make it easier to loadAndrew Bartlett1-206/+0
into an exsting LDAP server. (Allow some parts to pre-exist, and try to blow away less data). Andrew Bartlett (This used to be commit 99faff0ad8fa12d596c599064a0125a6b3365134)
2007-10-10r20152: Commit missing files from last night's commit. We no longer maintainAndrew Bartlett1-0/+1
a distinction between PDC and BDC in the configuration files, only as an entry in the ldb. Andrew Bartlett (This used to be commit dc9eee7cb37e4a6828c2cba23b0d836df9eac7b5)
2007-10-10r16264: Add, but do not yet enable, the partitions module.Andrew Bartlett1-39/+4
This required changes to the rootDSE module, to allow registration of partitions. In doing so I renamed the 'register' operation to 'register_control' and 'register_partition', which changed a few more modules. Due to the behaviour of certain LDAP servers, we create the baseDN entry in two parts: Firstly, we allow the admin to export a simple LDIF file to add to their server. Then we perform a modify to add the remaining attributes. To delete all users in partitions, we must now search and delete all objects in the partition, rather than a simple search from the root. Against LDAP, this might not delete all objects, so we allow this to fail. In testing, we found that the 'Domain Controllers' container was misnamed, and should be 'CN=', rather than 'OU='. To avoid the Templates being found in default searches, they have been moved to CN=Templates from CN=Templates,${BASEDN}. Andrew Bartlett (This used to be commit b49a4fbb57f10726bd288fdc9fc95c0cbbe9094a)
2007-10-10r16166: Remove hexidecimal constants from the Samba4 provision files.Andrew Bartlett1-19/+19
This change is required for compatibility with the OSX client, in particular, but returning 0x80000002 rather than -2147483646 violates what LDAP clients expect in general. Andrew Bartlett (This used to be commit 81f3cd1c4592d2108d521acd701ed4a70a23c465)
2007-10-10r14200: Now we have real USN support, don't force the values in the provisionAndrew Bartlett1-52/+0
scripts. This tests the real module, and avoids duplication. Andrew Bartlett (This used to be commit 0859ba59ae00029177cd63366fc59efe8b19c973)
2007-10-10r12943: Generate a SID for the domain join account using the modules, ratherAndrew Bartlett1-1/+1
than a hardcoded SID. Fix the samldb module to return the what *was* the nextrid, rather than the new nextrid (that is for next time). Andrew Bartlett (This used to be commit ffe9042e15cebbc7ff1bac90ec39835753d6caa7)
generated by cgit (git 2.34.1) at 2024-05-20 19:25:40 +0000