//#pragma title("usercopy- copies user accounts") /* ================================================================================ (c) Copyright 1995-1998, Mission Critical Software, Inc., All Rights Reserved Proprietary and confidential to Mission Critical Software, Inc. Program - usercopy Class - LAN Manager Utilities Author - Tom Bernhardt Created - 05/08/91 Description- Merges the NetUser information from the specified source server with the target system (or the current system if no target is specified). Group information is also merged if the /g option is given. Existing entries on the target system are not overwritten unless the /r option is used. Syntax - USERCOPY source [target] [/u] [/l] [/g] [/r] where: source source server target destination server /g copies global group information /l copies local group information /u copies user information /r replaces existing target entries with source entries /AddTo:x Adds all newly created users (/u) to group "x" Updates - 91/06/17 TPB General code cleanup and change so that all stdout i/o lines up nicely on-screen for reporting. 93/06/12 TPB Port to Win32 96/06/21 TPB Support for local groups 97/09/20 CAB Added subset of accounts option for GUI 98/06 TPB/CAB Support for computer accounts 99/01 COM-ization of DCT. ================================================================================ */ #include "StdAfx.h" #include #include #include #include #include #include #include #include "TxtSid.h" #define INCL_NETUSER #define INCL_NETGROUP #define INCL_NETERRORS #include #include "Common.hpp" #include "UString.hpp" #include "WorkObj.h" //#include "Usercopy.hpp" //#included by ARUtil.hpp below #include "ARUtil.hpp" #include "BkupRstr.hpp" #include "RebootU.h" #include "DCTStat.h" #include "ErrDct.hpp" #include "Win2KErr.h" #include "RegTrans.h" #include "TEvent.hpp" #include #include //#import "\bin\NetEnum.tlb" no_namespace //#import "\bin\DBManager.tlb" no_namespace, named_guids #import "NetEnum.tlb" no_namespace //#import "DBMgr.tlb" no_namespace, named_guids //already #imported via ARUtil.hpp #ifdef _DEBUG #define new DEBUG_NEW #undef THIS_FILE static char THIS_FILE[] = __FILE__; #endif extern TErrorDct err; extern TErrorDct & errC; bool abortall; extern bool g_bAddSidWorks = false; // global counts of accounts processed AccountStats warnings = { 0,0,0,0 }; AccountStats errors = { 0,0,0,0 }; AccountStats created = { 0,0,0,0 }; AccountStats replaced = { 0,0,0,0 }; AccountStats processed = { 0,0,0,0 }; BOOL machineAcctsCreated = FALSE; BOOL otherAcctsCreated = FALSE; PSID srcSid = NULL; // SID for source domain typedef HRESULT (CALLBACK * DSGETDCNAME)(LPWSTR, LPWSTR, GUID*, LPWSTR, DWORD, PDOMAIN_CONTROLLER_INFO*); typedef UINT (CALLBACK* DSBINDFUNC)(TCHAR*, TCHAR*, HANDLE*); typedef UINT (CALLBACK* DSADDSIDHISTORY)(HANDLE, DWORD, LPCTSTR, LPCTSTR, LPCTSTR, RPC_AUTH_IDENTITY_HANDLE,LPCTSTR,LPCTSTR); int TNodeCompareSourceName(TNode const * t1,TNode const * t2) { TAcctReplNode const * n1 = (TAcctReplNode *)t1; TAcctReplNode const * n2 = (TAcctReplNode *)t2; return UStrICmp(n1->GetName(),n2->GetName()); } int TNodeCompareSourceNameValue(TNode const * t1, void const * v) { TAcctReplNode const * n1 = (TAcctReplNode *)t1; WCHAR const * name = (WCHAR const *)v; return UStrICmp(n1->GetName(),name); } bool BindToDS( WCHAR * strDestDC, Options * pOpt) { // Get the handle to the Directory service. DSBINDFUNC DsBind; HINSTANCE hInst = LoadLibrary(L"NTDSAPI.DLL"); if ( hInst ) { DsBind = (DSBINDFUNC) GetProcAddress(hInst, "DsBindW"); if (DsBind) { DWORD rc = DsBind(strDestDC, NULL, &pOpt->dsBindHandle); if ( rc != 0 ) { err.SysMsgWrite( ErrE, rc, DCT_MSG_DSBIND_FAILED_S, strDestDC); Mark(L"errors", L"generic"); FreeLibrary(hInst); return false; } } else { err.SysMsgWrite(ErrE,GetLastError(),DCT_MSG_GET_PROC_ADDRESS_FAILED_SSD,L"NTDSAPI.DLL",L"DsBindW",GetLastError()); Mark(L"errors", L"generic"); FreeLibrary(hInst); return false; } } else { err.SysMsgWrite(ErrW,GetLastError(),DCT_MSG_LOAD_LIBRARY_FAILED_SD,L"NTDSAPI.DLL",GetLastError()); Mark(L"warnings", L"generic"); return false; } FreeLibrary(hInst); return true; } // The following function is used to get the actual account name from the source domain // instead of account that contains the SID in its SID history. DWORD GetName(PSID pObjectSID, WCHAR * sNameAccount, WCHAR * sDomain) { DWORD cb = 255; DWORD cbDomain = 255; DWORD tempVal; PDWORD psubAuth; PUCHAR pVal; SID_NAME_USE sid_Use; WCHAR sDC[255]; DWORD rc = 0; if ((pObjectSID == NULL) || !IsValidSid(pObjectSID)) { return ERROR_INVALID_PARAMETER; } // Copy the Sid to a temp SID DWORD sidLen = GetLengthSid(pObjectSID); PSID pObjectSID1 = new BYTE[sidLen]; if (!pObjectSID1) return ERROR_NOT_ENOUGH_MEMORY; if (!CopySid(sidLen, pObjectSID1, pObjectSID)) { return GetLastError(); } if (!IsValidSid(pObjectSID1)) { rc = GetLastError(); err.SysMsgWrite(ErrE, rc,DCT_MSG_DOMAIN_LOOKUP_FAILED_D,rc); Mark(L"errors", L"generic"); delete pObjectSID1; return rc; } // Get the RID out of the SID and get the domain SID pVal = GetSidSubAuthorityCount(pObjectSID1); (*pVal)--; psubAuth = GetSidSubAuthority(pObjectSID1, *pVal); tempVal = *psubAuth; *psubAuth = -1; //Lookup the domain from the SID if (!LookupAccountSid(NULL, pObjectSID1, sNameAccount, &cb, sDomain, &cbDomain, &sid_Use)) { rc = GetLastError(); err.SysMsgWrite(ErrE, rc,DCT_MSG_DOMAIN_LOOKUP_FAILED_D,rc); Mark(L"errors", L"generic"); delete pObjectSID1; return rc; } // Get a DC for the domain DSGETDCNAME DsGetDcName = NULL; DOMAIN_CONTROLLER_INFO * pSrcDomCtrlInfo = NULL; HMODULE hPro = LoadLibrary(L"NetApi32.dll"); if ( hPro ) DsGetDcName = (DSGETDCNAME)GetProcAddress(hPro, "DsGetDcNameW"); else { long rc = GetLastError(); err.SysMsgWrite(ErrE, rc, DCT_MSG_LOAD_LIBRARY_FAILED_SD, L"NetApi32.dll"); Mark(L"errors", L"generic"); } if (DsGetDcName) { if ( DsGetDcName( NULL ,// LPCTSTR ComputerName ? sDomain ,// LPCTSTR DomainName NULL ,// GUID *DomainGuid ? NULL ,// LPCTSTR SiteName ? 0 ,// ULONG Flags ? &pSrcDomCtrlInfo // PDOMAIN_CONTROLLER_INFO *DomainControllerInfo )) { err.SysMsgWrite(ErrE,GetLastError(),DCT_MSG_GET_DCNAME_FAILED_SD,sDomain,GetLastError()); Mark(L"errors", L"generic"); delete pObjectSID1; return GetLastError(); } else { wcscpy(sDC, pSrcDomCtrlInfo->DomainControllerName); NetApiBufferFree(pSrcDomCtrlInfo); } // Reset the sizes cb = 255; cbDomain = 255; // Lookup the account on the PDC that we found above. if ( LookupAccountSid(sDC, pObjectSID, sNameAccount, &cb, sDomain, &cbDomain, &sid_Use) == 0) { delete pObjectSID1; return GetLastError(); } } delete pObjectSID1; FreeLibrary(hPro); return 0; } /* This is a list of specific error codes that can be returned by DsAddSidHistory. This was obtained from Microsoft via email > ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED > The operation requires that destination domain auditing be enabled for > Success and Failure auditing of account management operations. > > ERROR_DS_UNWILLING_TO_PERFORM > It may be that the user account is not one of UF_NORMAL_ACCOUNT, > UF_WORKSTATION_TRUST_ACCOUNT, or UF_SERVER_TRUST_ACCOUNT. > > It may be that the source principal is a built in account. > > It may be that the source principal is a well known RID being added > to a destination principal that is a different RID. In other words, > Administrators of the source domain can only be assigned to > Administrators of the destination domain. > > ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER > The source object must be a group or user. > > ERROR_DS_SRC_SID_EXISTS_IN_FOREST > The source object's SID already exists in destination forest. > > ERROR_DS_INTERNAL_FAILURE; > The directory service encountered an internal failure. Shouldn't > happen. > > ERROR_DS_MUST_BE_RUN_ON_DST_DC > For security reasons, the operation must be run on the destination DC. > Specifically, the connection between the client and server > (destination > DC) requires 128-bit encryption when credentials for the source domain > are supplied. > > ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION > The connection between client and server requires packet privacy or > better. > > ERROR_DS_SOURCE_DOMAIN_IN_FOREST > The source domain may not be in the same forest as destination. > > ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST > The destination domain must be in the forest. > > ERROR_DS_MASTERDSA_REQUIRED > The operation must be performed at a master DSA (writable DC). > > ERROR_DS_INSUFF_ACCESS_RIGHTS > Insufficient access rights to perform the operation. Most likely > the caller is not a member of domain admins for the dst domain. > > ERROR_DS_DST_DOMAIN_NOT_NATIVE > Destination domain must be in native mode. > > ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN > The operation couldn't locate a DC for the source domain. > > ERROR_DS_OBJ_NOT_FOUND > Directory object not found. Most likely the FQDN of the > destination principal could not be found in the destination > domain. > > ERROR_DS_NAME_ERROR_NOT_UNIQUE > Name translation: Input name mapped to more than one > output name. Most likely the destination principal mapped > to more than one FQDN in the destination domain. > > ERROR_DS_SRC_AND_DST_OBJECT_CLASS_MISMATCH > The source and destination object must be of the same type. > > ERROR_DS_OBJ_CLASS_VIOLATION > The requested operation did not satisfy one or more constraints > associated with the class of the object. Most likely because the > destination principal is not a user or group. > > ERROR_DS_UNAVAILABLE > The directory service is unavailable. Most likely the > ldap_initW() to the NT5 src DC failed. > > ERROR_DS_INAPPROPRIATE_AUTH > Inappropriate authentication. Most likely the ldap_bind_sW() to > the NT5 src dc failed. > > ERROR_DS_SOURCE_AUDITING_NOT_ENABLED > The operation requires that source domain auditing be enabled for > Success and Failure auditing of account management operations. > > ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER > For security reasons, the source DC must be Service Pack 4 or greater. > */ BOOL GetDnsAndNetbiosFromName(WCHAR * name,WCHAR * netBios, WCHAR * dns) { IADs * pDomain = NULL; WCHAR strText[1000]; // try to connect to the AD, using the specified name swprintf(strText,L"LDAP://%ls",name); HRESULT hr = ADsGetObject(strText,IID_IADs,(void**)&pDomain); if ( SUCCEEDED(hr) ) { _variant_t var; // get the NETBIOS name from the LDAP provider hr = pDomain->Get(L"nETBIOSName",&var); if ( SUCCEEDED(hr) ) { UStrCpy(netBios,(WCHAR*)var.bstrVal); } else { hr = pDomain->Get(L"name",&var); if ( SUCCEEDED(hr) ) { UStrCpy(netBios,(WCHAR*)var.bstrVal); } } // get the DNS name from the LDAP provider hr = pDomain->Get(L"distinguishedName",&var); if ( SUCCEEDED(hr) ) { WCHAR * dn = (WCHAR*)var.bstrVal; WCHAR * curr = dns; if ( !UStrICmp(dn,L"DC=",3) ) { // for each ",DC=" in the name, replace it with a . for ( curr = dns, dn = dn+3 ; // skip the leading "DC=" *dn ; // until the end of the string is reached curr++ // ) { if ( (L',' == *dn) && (L'D' == *(dn+1)) && (L'C' == *(dn+2)) && (L'=' == *(dn+3)) ) { (*curr) = L'.'; dn+=4; } else { // just copy the character (*curr) = (*dn); dn++; } } *(curr) = 0; } } pDomain->Release(); } else { // default to using the specified name as both DNS and NETBIOS // this will work for NT 4 domains UStrCpy(netBios,name); UStrCpy(dns,name); } return TRUE; } HRESULT CopySidHistoryProperty( Options * pOptions, TAcctReplNode * pNode, IStatusObj * pStatus ) { HRESULT hr = S_OK; IADs * pAds = NULL; _variant_t var; // long ub = 0, lb = 0; // fetch the SIDHistory property for the source account // for each entry in the source's SIDHistory, call DsAddSidHistory // Get the IADs pointer to the object and get the SIDHistory attribute. hr = ADsGetObject(const_cast(pNode->GetSourcePath()), IID_IADs, (void**)&pAds); if ( SUCCEEDED(hr) ) { hr = pAds->Get(L"sIDHistory", &var); } if ( SUCCEEDED(hr) ) { // This is a multivalued property so we need to get all the values // for each one get the name and the domain of the object and then call the // add sid history function to add the SID to the target objects SIDHistory. _variant_t var; DWORD rc = pAds->GetEx(L"sIDHistory", &var); if ( !rc ) { if ( V_VT(&var) == (VT_ARRAY | VT_VARIANT) ) { // This is the array type that we were looking for. void HUGEP *pArray; VARIANT var2; ULONG dwSLBound = -1; ULONG dwSUBound = -1; hr = SafeArrayGetLBound( V_ARRAY(&var), 1, (long FAR *) &dwSLBound ); hr = SafeArrayGetUBound( V_ARRAY(&var), 1, (long FAR *) &dwSUBound ); if (SUCCEEDED(hr)) { // Each element in this array is a SID in form of a VARIANT hr = SafeArrayAccessData( V_ARRAY(&var), &pArray ); for ( long x = (long)dwSLBound; x <= (long)dwSUBound; x++) { hr = SafeArrayGetElement(V_ARRAY(&var), &x, &var2); // Get the SID from the Variant in a ARRAY form hr = SafeArrayAccessData( V_ARRAY(&var2), &pArray ); PSID pObjectSID = (PSID)pArray; //Convert SID to string. if (pObjectSID) { WCHAR sNameAccount[255]; WCHAR sDomain[255]; WCHAR sNetBIOS[255]; DWORD rc = 0; rc = GetName(pObjectSID, sNameAccount, sDomain); if (!rc) { WCHAR sTemp[LEN_Path]; WCHAR sSourceDNS[LEN_Path]; // We are going to temporarily change the Domain DNS to the domain of the SID we are adding wcscpy(sTemp, pOptions->srcDomainDns); if ( GetDnsAndNetbiosFromName(sDomain, sNetBIOS, sSourceDNS) ) { wcscpy(pOptions->srcDomainDns, sSourceDNS); AddSidHistory(pOptions, sNameAccount, pNode->GetTargetSam(), NULL, FALSE); // Replace the original domain dns. wcscpy(pOptions->srcDomainDns, sTemp); } else { err.SysMsgWrite(ErrE, GetLastError(),DCT_MSG_DOMAIN_DNS_LOOKUP_FAILED_SD, sDomain,GetLastError()); Mark(L"errors", pNode->GetType()); } } else { // Get name failed we need to log a message. WCHAR sSid[LEN_Path]; DWORD len = LEN_Path; GetTextualSid(pObjectSID, sSid, &len); err.SysMsgWrite(ErrE,rc,DCT_MSG_ERROR_CONVERTING_SID_SSD, pNode->GetTargetName(), sSid, rc); Mark(L"errors", pNode->GetType()); } } SafeArrayUnaccessData(V_ARRAY(&var2)); } SafeArrayUnaccessData(V_ARRAY(&var)); } } } else { // No SID History to copy. } } return hr; } bool AddSidHistory( const Options * pOptions, const WCHAR * strSrcPrincipal, const WCHAR * strDestPrincipal, IStatusObj * pStatus, BOOL isFatal) { //Add the sid to the history // Authentication Structure SEC_WINNT_AUTH_IDENTITY auth; DWORD rc = 0; //memset(&auth, 0, sizeof(SEC_WINNT_AUTH_IDENTITY)); auth.User = const_cast(pOptions->authUser); auth.UserLength = wcslen(pOptions->authUser); auth.Password = const_cast(pOptions->authPassword); auth.PasswordLength = wcslen(pOptions->authPassword); auth.Domain = const_cast(pOptions->authDomain); auth.DomainLength = wcslen(pOptions->authDomain); auth.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE; // Auth Identity handle // if source domain credentials supplied use them // otherwise credentials of caller will be used RPC_AUTH_IDENTITY_HANDLE pHandle = ((auth.DomainLength > 0) && (auth.UserLength > 0)) ? &auth : NULL; DSADDSIDHISTORY DsAddSidHistory; HINSTANCE hInst = LoadLibrary(L"NTDSAPI.DLL"); if ( hInst ) { DsAddSidHistory = (DSADDSIDHISTORY) GetProcAddress(hInst, "DsAddSidHistoryW"); if (DsAddSidHistory) { if ( !pOptions->nochange ) { int loopCount = 0; rc = RPC_S_SERVER_UNAVAILABLE; // If we get the RPC server errors we need to retry 5 times. while ( (((rc == RPC_S_SERVER_UNAVAILABLE) || (rc == RPC_S_CALL_FAILED) || (rc == RPC_S_CALL_FAILED_DNE)) && loopCount < 5) || ( (rc == ERROR_INVALID_HANDLE) && loopCount < 3 ) ) // In case of invalid handle we try it 3 times now. { // Make the API call to add Sid to the history rc = DsAddSidHistory( pOptions->dsBindHandle, //DS Handle NULL, // flags pOptions->srcDomainDns, // Source domain strSrcPrincipal, // Source Account name NULL, // Source Domain Controller pHandle, // RPC_AUTH_IDENTITY_HANDLE pOptions->tgtDomainDns, // Target domain strDestPrincipal); // Target Account name if ( loopCount > 0 ) Sleep(500); loopCount++; } } if ( rc != 0 ) { switch ( rc ) { // these are the error codes caused by permissions or configuration problems case ERROR_NONE_MAPPED: err.MsgWrite(ErrE, DCT_MSG_ADDSIDHISTORY_FAIL_BUILTIN_SSD,strSrcPrincipal, strDestPrincipal, rc); break; case ERROR_DS_UNWILLING_TO_PERFORM: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_DS_UNWILLING_TO_PERFORM_SSSSD,strDestPrincipal,pOptions->srcDomain, strSrcPrincipal, pOptions->tgtDomain,rc); break; case ERROR_DS_INSUFF_ACCESS_RIGHTS: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_INSUFF_ACCESS_SD,strDestPrincipal,rc); g_bAddSidWorks = FALSE; break; case ERROR_INVALID_HANDLE: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_INVALID_HANDLE_SSD,pOptions->srcDomainDns,strDestPrincipal,rc); g_bAddSidWorks = FALSE; break; case ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NOAUDIT_SSD,strDestPrincipal,pOptions->tgtDomainDns,rc); g_bAddSidWorks = FALSE; break; case ERROR_DS_MUST_BE_RUN_ON_DST_DC: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_DST_DC_SD,strDestPrincipal,rc); g_bAddSidWorks = FALSE; break; case ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_PKT_PRIVACY_SD,strDestPrincipal,rc); g_bAddSidWorks = FALSE; break; case ERROR_DS_SOURCE_DOMAIN_IN_FOREST: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_SOURCE_IN_FOREST_S,strDestPrincipal); g_bAddSidWorks = FALSE; break; case ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_DEST_WRONG_FOREST_S,strDestPrincipal); g_bAddSidWorks = FALSE; break; case ERROR_DS_MASTERDSA_REQUIRED: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NO_MASTERDSA_S,strDestPrincipal); g_bAddSidWorks = FALSE; break; case ERROR_ACCESS_DENIED: g_bAddSidWorks = FALSE; err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_INSUFF2_SSS,strDestPrincipal,pOptions->authDomain,pOptions->authUser); break; case ERROR_DS_DST_DOMAIN_NOT_NATIVE: g_bAddSidWorks = FALSE; err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NOT_NATIVE_S,strDestPrincipal); break; case ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN: g_bAddSidWorks = FALSE; err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NO_SOURCE_DC_S,strDestPrincipal); break; // case ERROR_DS_INAPPROPRIATE_AUTH: case ERROR_DS_UNAVAILABLE: g_bAddSidWorks = FALSE; err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_DS_UNAVAILABLE_S,strDestPrincipal); break; case ERROR_DS_SOURCE_AUDITING_NOT_ENABLED: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NOAUDIT_SSD,strDestPrincipal,pOptions->srcDomain,rc); g_bAddSidWorks = FALSE; break; case ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_SOURCE_NOT_SP4_S,strDestPrincipal); g_bAddSidWorks = FALSE; break; case ERROR_SESSION_CREDENTIAL_CONFLICT: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_CREDENTIALS_CONFLICT_SSSS,strDestPrincipal,pOptions->srcDomain,pOptions->authDomain,pOptions->authUser); g_bAddSidWorks = FALSE; break; // these are error codes that only affect this particular account case ERROR_SUCCESS: g_bAddSidWorks = TRUE; // no error message needed for success case! break; case ERROR_DS_SRC_SID_EXISTS_IN_FOREST: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_IN_FOREST_SD,strDestPrincipal,rc); g_bAddSidWorks = TRUE; break; case ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER: err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_WRONGTYPE_SD,strDestPrincipal,rc); g_bAddSidWorks = TRUE; break; default: err.MsgWrite(ErrE,DCT_MSG_ADDSID_FAILED_SSD,strSrcPrincipal, strDestPrincipal,rc); g_bAddSidWorks = TRUE; break; } Mark(L"errors", L"generic"); // This may or may not be a fatal error depending on weather we are Adding // sid history or copying sid history g_bAddSidWorks |= !(isFatal); if (! g_bAddSidWorks ) { // log a message indicating that SIDHistory will not be tried for the rest of the accounts err.MsgWrite(ErrW,DCT_MSG_SIDHISTORY_FATAL_ERROR); Mark(L"warnings", L"generic"); // we are going to set the status to abort so that we don't try to migrate anymore. if ( pStatus ) { pStatus->put_Status(DCT_STATUS_ABORTING); } } FreeLibrary(hInst); return false; } else { err.MsgWrite(0, DCT_MSG_ADD_SID_SUCCESS_SSSS, pOptions->srcDomainDns, strSrcPrincipal, pOptions->tgtDomainDns, strDestPrincipal); FreeLibrary(hInst); return true; } } else { err.SysMsgWrite(ErrE,GetLastError(),DCT_MSG_NO_ADDSIDHISTORY_FUNCTION); Mark(L"errors", L"generic"); FreeLibrary(hInst); return false; } } else { err.SysMsgWrite(ErrE,GetLastError(),DCT_MSG_NO_NTDSAPI_DLL); Mark(L"errors", L"generic"); return false; } } //-------------------------------------------------------------------------- // FillupNamingContext : This function fills in the target Naming context // for NT5 domain. //-------------------------------------------------------------------------- void FillupNamingContext( Options * options //in,out- Options to fill up ) { WCHAR sPath[LEN_Path]; IADs * pAds; _variant_t var; HRESULT hr; wsprintf(sPath, L"LDAP://%s/rootDSE", options->tgtDomain); hr = ADsGetObject(sPath, IID_IADs, (void**)&pAds); if ( FAILED(hr) ) { wcscpy(options->tgtNamingContext, L""); return; } hr = pAds->Get(L"defaultNamingContext", &var); if ( FAILED(hr) ) { wcscpy(options->tgtNamingContext, L""); return; } pAds->Release(); wcscpy(options->tgtNamingContext, (WCHAR*) V_BSTR(&var)); } //-------------------------------------------------------------------------- // MakeFullyQualifiedAdsPath : Makes a LDAP sub path into a fully qualified // LDAP path name. //-------------------------------------------------------------------------- void MakeFullyQualifiedAdsPath( WCHAR * sPath, //out- Fully qulified LDAP path to the object DWORD nPathLen, //in - MAX size, in characters, of the sPath buffer WCHAR * sSubPath, //in- LDAP subpath of the object WCHAR * tgtDomain, //in- Domain name where object exists. WCHAR * sDN //in- Default naming context for the Domain ) { if ((!sPath) || (!sSubPath) || (!tgtDomain) || (!sDN)) return; _bstr_t sTempPath; if (wcsncmp(sSubPath, L"LDAP://", 7) == 0) { //it is already a fully qualified LDAP path so lets copy it and return it wcsncpy(sPath, sSubPath, nPathLen-1); return; } //We need to build this path so lets get to work if ( wcslen(sDN) ) { sTempPath = L"LDAP://"; sTempPath += tgtDomain; sTempPath += L"/"; sTempPath += sSubPath; sTempPath += L","; sTempPath += sDN; wcsncpy(sPath, sTempPath, nPathLen-1); // wsprintf(sPath, L"LDAP://%s/%s,%s", tgtDomain, sSubPath, sDN); } else { sTempPath = L"LDAP://"; sTempPath += tgtDomain; sTempPath += L"/"; sTempPath += sSubPath; wcsncpy(sPath, sTempPath, nPathLen-1); // wsprintf(sPath, L"LDAP://%s/%s", tgtDomain, sSubPath); } } //-------------------------------------------------------------------------- // IsAccountMigrated : Function checks if the account has been migrated in // the past. If it has it returns true filling in the // name of the target object in case it was renamed. // Otherwise it returns FALSE and Empty string for the // target name. //-------------------------------------------------------------------------- bool IsAccountMigrated( TAcctReplNode * pNode, //in -Account node that contains the Account info Options * pOptions, //in -Options as specified by the user. IIManageDBPtr pDb, //in -Pointer to DB manager. We dont want to create this object for every account we process WCHAR * sTgtSam //in,out - Name of the target object that was copied if any. ) { IVarSetPtr pVs(__uuidof(VarSet)); IUnknown * pUnk; pVs->QueryInterface(IID_IUnknown, (void**) &pUnk); HRESULT hrFind = pDb->raw_GetAMigratedObject(const_cast(pNode->GetName()), pOptions->srcDomain, pOptions->tgtDomain, &pUnk); pUnk->Release(); if ( hrFind != S_OK ) { wcscpy(sTgtSam,L""); return false; } else { _bstr_t sText; sText = pVs->get(L"MigratedObjects.TargetSamName"); if (!(WCHAR*)sText) { wcscpy(sTgtSam,L""); return false; } wcscpy(sTgtSam, (WCHAR*) sText); return true; } } bool CheckifAccountExists( Options const * options, //in-Options as set by the user WCHAR * acctName //in-Name of the account to look for ) { USER_INFO_0 * buf; long rc = 0; if ( (rc = NetUserGetInfo(const_cast(options->tgtComp), acctName, 0, (LPBYTE *) &buf)) == NERR_Success ) { NetApiBufferFree(buf); return true; } if ( (rc = NetGroupGetInfo(const_cast(options->tgtComp), acctName, 0, (LPBYTE *) &buf)) == NERR_Success ) { NetApiBufferFree(buf); return true; } if ( (rc = NetLocalGroupGetInfo(const_cast(options->tgtComp), acctName, 0, (LPBYTE *) &buf)) == NERR_Success ) { NetApiBufferFree(buf); return true; } return false; } //-------------------------------------------------------------------------- // Mark : Increments appropriate counters depending on the arguments. //-------------------------------------------------------------------------- void Mark( _bstr_t sMark, //in- Represents the type of marking { processed, errors, replaced, created } _bstr_t sObj //in- Type of object being marked { user, group, computer } ) { if (!UStrICmp(sMark,L"processed")) { if ( !UStrICmp(sObj,L"user")) processed.users++; else if ( !UStrICmp(sObj,L"group")) processed.globals++; else if ( !UStrICmp(sObj,L"computer")) processed.computers++; else if ( !UStrICmp(sObj,L"generic")) processed.generic++; } else if (!UStrICmp(sMark,L"errors")) { if ( !UStrICmp(sObj,L"user")) errors.users++; else if ( !UStrICmp(sObj,L"group")) errors.globals++; else if ( !UStrICmp(sObj,L"computer")) errors.computers++; else if ( !UStrICmp(sObj,L"generic")) errors.generic++; } else if (!UStrICmp(sMark,L"warnings")) { if ( !UStrICmp(sObj,L"user")) warnings.users++; else if ( !UStrICmp(sObj,L"group")) warnings.globals++; else if ( !UStrICmp(sObj,L"computer")) warnings.computers++; else if ( !UStrICmp(sObj,L"generic")) warnings.generic++; } else if (!UStrICmp(sMark,L"replaced")) { if ( !UStrICmp(sObj,L"user")) replaced.users++; else if ( !UStrICmp(sObj,L"group")) replaced.globals++; else if ( !UStrICmp(sObj,L"computer")) replaced.computers++; else if ( !UStrICmp(sObj,L"generic")) replaced.generic++; } else if (!UStrICmp(sMark,L"created")) { if ( !UStrICmp(sObj,L"user")) created.users++; else if ( !UStrICmp(sObj,L"group")) created.globals++; else if ( !UStrICmp(sObj,L"computer")) created.computers++; else if ( !UStrICmp(sObj,L"generic")) created.generic++; } } HRESULT GetRidPoolAllocator( Options * pOptions ) { _bstr_t sRidMaster = L""; BSTR sParent = L""; _bstr_t sRidAllocator = pOptions->srcComp; _variant_t varProp; IADs * pAds = NULL; WCHAR sPath[LEN_Path]; HRESULT hr = S_OK; wsprintf(sPath, L"LDAP://%s/CN=RID Manager$,CN=System,%s", pOptions->srcComp + 2, pOptions->srcNamingContext); hr = ADsGetObject(sPath, IID_IADs, (void**)&pAds); if ( SUCCEEDED(hr) ) { hr = pAds->Get(L"fSMORoleOwner", &varProp); pAds->Release(); } if ( SUCCEEDED(hr) ) { sRidMaster = varProp.bstrVal; wsprintf(sPath, L"LDAP://%s/%s", pOptions->srcDomain, (WCHAR*) sRidMaster); hr = ADsGetObject(sPath, IID_IADs, (void**)&pAds); } if ( SUCCEEDED(hr) ) { hr = pAds->get_Parent(&sParent); pAds->Release(); } if ( SUCCEEDED(hr) ) { hr = ADsGetObject((WCHAR*)sParent, IID_IADs, (void**)&pAds); } if ( SUCCEEDED(hr) ) { hr = pAds->Get(L"name", &varProp); pAds->Release(); } if ( SUCCEEDED(hr) ) sRidAllocator = varProp.bstrVal; if ( ((WCHAR*) sRidAllocator)[0] == L'\\' ) wcscpy(pOptions->srcComp, (WCHAR*) sRidAllocator); else wsprintf(pOptions->srcComp, L"\\\\%s", (WCHAR*) sRidAllocator); return hr; }