sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-29 11:21:54 +03:00
Code
b3115f5cdc
samba-mirror/source4/setup/provision_users.ldif

517 lines
15 KiB
Plaintext
Raw Normal View History

s4:provision_users.ldif - Put potential primary groups in front of the file (So they can be always found by the SAMLDB module)
2009-10-02 17:21:17 +04:00
# Add default primary groups (domain users, domain guests, domain computers &
# domain controllers) - needed for the users to find valid primary groups
# (samldb module)
s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-08-26 05:51:45 +04:00
dn: CN=Domain Users,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: All domain users
objectSid: ${DOMAINSID}-513
sAMAccountName: Domain Users
isCriticalSystemObject: TRUE
dn: CN=Domain Guests,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: All domain guests
objectSid: ${DOMAINSID}-514
sAMAccountName: Domain Guests
isCriticalSystemObject: TRUE
s4:provision_users.ldif - Put potential primary groups in front of the file (So they can be always found by the SAMLDB module)
2009-10-02 17:21:17 +04:00
dn: CN=Domain Computers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: All workstations and servers joined to the domain
objectSid: ${DOMAINSID}-515
sAMAccountName: Domain Computers
isCriticalSystemObject: TRUE
dn: CN=Domain Controllers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: All domain controllers in the domain
objectSid: ${DOMAINSID}-516
adminCount: 1
sAMAccountName: Domain Controllers
isCriticalSystemObject: TRUE
s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-08-26 05:51:45 +04:00
# Add users
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Administrator,CN=Users,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: user
description: Built-in account for administering the computer/domain
r16166: Remove hexidecimal constants from the Samba4 provision files. This change is required for compatibility with the OSX client, in particular, but returning 0x80000002 rather than -2147483646 violates what LDAP clients expect in general. Andrew Bartlett (This used to be commit 81f3cd1c4592d2108d521acd701ed4a70a23c465)
2006-06-13 00:00:18 +04:00
userAccountControl: 66048
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectSid: ${DOMAINSID}-500
adminCount: 1
accountExpires: Windows default is 9223372036854775807, not -1. (This used to be commit be47cc7fdfa3cae0508e564f38b793aa27b6eb92)
2008-03-06 14:56:49 +03:00
accountExpires: 9223372036854775807
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
sAMAccountName: Administrator
rename sambaPassword -> userPassword. This attribute is used in a very similar way (virtual attribute updating the password) in AD on Win2003, so eliminate the difference. This should not cause a problem for on-disk passwords, as by default we do not store the plaintext at all. Andrew Bartlett (This used to be commit 1cf0d751493b709ef6b2234ec8847a7499f48ab3)
2008-07-12 09:26:42 +04:00
userPassword:: ${ADMINPASS_B64}
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 14:48:18 +04:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Guest,CN=Users,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: user
description: Built-in account for guest access to the computer/domain
r16166: Remove hexidecimal constants from the Samba4 provision files. This change is required for compatibility with the OSX client, in particular, but returning 0x80000002 rather than -2147483646 violates what LDAP clients expect in general. Andrew Bartlett (This used to be commit 81f3cd1c4592d2108d521acd701ed4a70a23c465)
2006-06-13 00:00:18 +04:00
userAccountControl: 66082
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
primaryGroupID: 514
objectSid: ${DOMAINSID}-501
sAMAccountName: Guest
isCriticalSystemObject: TRUE
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 07:35:16 +03:00
dn: CN=krbtgt,CN=Users,${DOMAINDN}
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
description: Key Distribution Center Service Account
showInAdvancedViewOnly: TRUE
userAccountControl: 514
objectSid: ${DOMAINSID}-502
adminCount: 1
accountExpires: 9223372036854775807
sAMAccountName: krbtgt
servicePrincipalName: kadmin/changepw
rename sambaPassword -> userPassword. This attribute is used in a very similar way (virtual attribute updating the password) in AD on Win2003, so eliminate the difference. This should not cause a problem for on-disk passwords, as by default we do not store the plaintext at all. Andrew Bartlett (This used to be commit 1cf0d751493b709ef6b2234ec8847a7499f48ab3)
2008-07-12 09:26:42 +04:00
userPassword:: ${KRBTGTPASS_B64}
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 14:48:18 +04:00
isCriticalSystemObject: TRUE
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 07:35:16 +03:00
s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-08-26 05:51:45 +04:00
# Add other groups
dn: CN=Enterprise Admins,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Designated administrators of the enterprise
member: CN=Administrator,CN=Users,${DOMAINDN}
objectSid: ${DOMAINSID}-519
adminCount: 1
sAMAccountName: Enterprise Admins
isCriticalSystemObject: TRUE
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 07:35:16 +03:00
dn: CN=Schema Admins,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Designated administrators of the schema
member: CN=Administrator,CN=Users,${DOMAINDN}
objectSid: ${DOMAINSID}-518
adminCount: 1
sAMAccountName: Schema Admins
isCriticalSystemObject: TRUE
dn: CN=Cert Publishers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Members of this group are permitted to publish certificates to the Active Directory
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483644
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 07:35:16 +03:00
objectSid: ${DOMAINSID}-517
sAMAccountName: Cert Publishers
isCriticalSystemObject: TRUE
dn: CN=Domain Admins,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Designated administrators of the domain
member: CN=Administrator,CN=Users,${DOMAINDN}
objectSid: ${DOMAINSID}-512
adminCount: 1
sAMAccountName: Domain Admins
isCriticalSystemObject: TRUE
dn: CN=Group Policy Creator Owners,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Members in this group can modify group policy for the domain
member: CN=Administrator,CN=Users,${DOMAINDN}
objectSid: ${DOMAINSID}-520
sAMAccountName: Group Policy Creator Owners
isCriticalSystemObject: TRUE
dn: CN=RAS and IAS Servers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Servers in this group can access remote access properties of users
objectSid: ${DOMAINSID}-553
sAMAccountName: RAS and IAS Servers
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483644
r25891: Test that we get the correct return value when we attempt to reference invalid entries with a linked attribute. Make Samba4 pass that test, by fixing a silly bug in the linked_attributes module. (By passing down the 'original' request structure, tdb would override our handle, and therefore we would never be called for the 'wait', which collects the errors). Fix up the provision templates to handle the newly required referential integrity. Andrew Bartlett (This used to be commit 0377d85bbdcb2c4f110b0519005f0d1d10bc0c0b)
2007-11-07 07:35:16 +03:00
isCriticalSystemObject: TRUE
added some more well known SIDs - thanks to the WSPP LSAT test suite
2008-09-30 03:01:07 +04:00
dn: CN=Read-Only Domain Controllers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
s4:provision_users.ldif - Descriptions generally begin with a majuscle
2009-11-17 21:46:59 +03:00
description: Read-only domain controllers
added some more well known SIDs - thanks to the WSPP LSAT test suite
2008-09-30 03:01:07 +04:00
objectSid: ${DOMAINSID}-521
sAMAccountName: Read-Only Domain Controllers
groupType: -2147483644
isCriticalSystemObject: TRUE
dn: CN=Enterprise Read-Only Domain Controllers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
s4:provision_users.ldif - Descriptions generally begin with a majuscle
2009-11-17 21:46:59 +03:00
description: Enterprise read-only domain controllers
added some more well known SIDs - thanks to the WSPP LSAT test suite
2008-09-30 03:01:07 +04:00
objectSid: ${DOMAINSID}-498
sAMAccountName: Enterprise Read-Only Domain Controllers
groupType: -2147483644
isCriticalSystemObject: TRUE
dn: CN=Certificate Service DCOM Access,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Certificate Service DCOM Access
objectSid: ${DOMAINSID}-574
sAMAccountName: Certificate Service DCOM Access
groupType: -2147483644
isCriticalSystemObject: TRUE
dn: CN=Cryptographic Operators,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Cryptographic Operators
objectSid: ${DOMAINSID}-569
sAMAccountName: Cryptographic Operators
groupType: -2147483644
isCriticalSystemObject: TRUE
dn: CN=Event Log Readers,CN=Users,${DOMAINDN}
objectClass: top
objectClass: group
description: Event Log Readers
objectSid: ${DOMAINSID}-573
sAMAccountName: Event Log Readers
groupType: -2147483644
isCriticalSystemObject: TRUE
s4:Foreign security principals - Fix them up I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-06 21:57:50 +04:00
# Add foreign security principals
dn: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-4
dn: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-9
dn: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-11
dn: CN=S-1-5-20,CN=ForeignSecurityPrincipals,${DOMAINDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-20
# Add builtin objects
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Administrators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Administrators have complete and unrestricted access to the computer/domain
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
member: CN=Domain Admins,CN=Users,${DOMAINDN}
member: CN=Enterprise Admins,CN=Users,${DOMAINDN}
member: CN=Administrator,CN=Users,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectSid: S-1-5-32-544
adminCount: 1
sAMAccountName: Administrators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 14:48:18 +04:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Users,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Users are prevented from making accidental or intentional system-wide changes. Thus, Users can run certified applications, but not most legacy applications
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
member: CN=Domain Users,CN=Users,${DOMAINDN}
s4:Foreign security principals - Fix them up I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-06 21:57:50 +04:00
member: CN=S-1-5-4,CN=ForeignSecurityPrincipals,${DOMAINDN}
member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectSid: S-1-5-32-545
sAMAccountName: Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Guests,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
member: CN=Domain Guests,CN=Users,${DOMAINDN}
member: CN=Guest,CN=Users,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectSid: S-1-5-32-546
sAMAccountName: Guests
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Print Operators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Members can administer domain printers
objectSid: S-1-5-32-550
adminCount: 1
sAMAccountName: Print Operators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 14:48:18 +04:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Backup Operators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
objectSid: S-1-5-32-551
adminCount: 1
sAMAccountName: Backup Operators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 14:48:18 +04:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Replicator,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Supports file replication in a domain
objectSid: S-1-5-32-552
adminCount: 1
sAMAccountName: Replicator
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Remote Desktop Users,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Members in this group are granted the right to logon remotely
objectSid: S-1-5-32-555
sAMAccountName: Remote Desktop Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Network Configuration Operators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Members in this group can have some administrative privileges to manage configuration of networking features
objectSid: S-1-5-32-556
sAMAccountName: Network Configuration Operators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Performance Monitor Users,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Members of this group have remote access to monitor this computer
objectSid: S-1-5-32-558
sAMAccountName: Performance Monitor Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Performance Log Users,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Members of this group have remote access to schedule logging of performance counters on this computer
s4:Foreign security principals - Fix them up I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-06 21:57:50 +04:00
member: CN=S-1-5-20,CN=ForeignSecurityPrincipals,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectSid: S-1-5-32-559
sAMAccountName: Performance Log Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
isCriticalSystemObject: TRUE
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Server Operators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Members can administer domain servers
objectSid: S-1-5-32-549
adminCount: 1
sAMAccountName: Server Operators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 14:48:18 +04:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
r20557: use ${DOMAINDN} instead of ${BASEDN} metze (This used to be commit 2a6e6a2695b256411c91768c7bee748228e40e6f)
2007-01-05 20:40:43 +03:00
dn: CN=Account Operators,CN=Builtin,${DOMAINDN}
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
objectClass: top
objectClass: group
description: Members can administer domain user and group accounts
objectSid: S-1-5-32-548
adminCount: 1
sAMAccountName: Account Operators
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 14:48:18 +04:00
isCriticalSystemObject: TRUE
r8790: Finish the migration of aliases and privilages with SamSync, by adding templating support for foreignSecurityPrincipals to the samdb module. This is an extension beyond what microsoft does, and has been very useful :-) The setup scripts have been modified to use the new template, as has the SAMR and LSA code. Other cleanups in LSA remove the assumption that the short domain name is the first component of the realm. Also add a lot of useful debug messages, to make it clear how/why the SamSync may have gone wrong. Many of these should perhaps be hooked into an error string. Andrew Bartlett (This used to be commit 1f071b0609c5c83024db1d4a7d04334a932b8253)
2005-07-27 04:23:09 +04:00
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
dn: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: A backward compatibility group which allows read access on all users and groups in the domain
s4:Foreign security principals - Fix them up I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-06 21:57:50 +04:00
member: CN=S-1-5-11,CN=ForeignSecurityPrincipals,${DOMAINDN}
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
objectSid: S-1-5-32-554
sAMAccountName: Pre-Windows 2000 Compatible Access
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
[SAMBA 4 directory] Refactoring and clean up of directory structure - Adds more system objects which make sense to have them in SAMBA 4 also to have them when we add more and more services related to the directory (volume support, DFS, replication service, COM...) - Make sure that "isCriticalSystemObject" and "showInAdvancedViewOnly" attributes are set correctly on each object
2009-07-10 14:48:18 +04:00
isCriticalSystemObject: TRUE
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
dn: CN=Incoming Forest Trust Builders,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Members of this group can create incoming, one-way trusts to this forest
objectSid: S-1-5-32-557
sAMAccountName: Incoming Forest Trust Builders
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
isCriticalSystemObject: TRUE
dn: CN=Windows Authorization Access Group,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects
s4:Foreign security principals - Fix them up I fixed them up to match with Windows Server 2003. I don't think that the creation of them in the provision script is needed so I put them in the "provision_users.ldif" file.
2009-09-06 21:57:50 +04:00
member: CN=S-1-5-9,CN=ForeignSecurityPrincipals,${DOMAINDN}
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
objectSid: S-1-5-32-560
sAMAccountName: Windows Authorization Access Group
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
isCriticalSystemObject: TRUE
dn: CN=Terminal Server License Servers,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Terminal Server License Servers
objectSid: S-1-5-32-561
sAMAccountName: Terminal Server License Servers
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
isCriticalSystemObject: TRUE
dn: CN=Distributed COM Users,CN=Builtin,${DOMAINDN}
objectClass: top
objectClass: group
description: Members are allowed to launch, activate and use Distributed COM objects on this machine.
objectSid: S-1-5-32-562
sAMAccountName: Distributed COM Users
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -1946157056
now that ldap integers are 32 bit, we need to put the right 32 bit value in for group type to avoid sign extension, otherwise we don't find the builtin groups (This used to be commit 9b558639395bd8209313bb7ed2e04821c83975a4)
2008-08-22 15:26:32 +04:00
groupType: -2147483643
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
isCriticalSystemObject: TRUE
s4:provision - Change the "provision_users.ldif" file to support the "samldb" changes The "provision_users.ldif" file needs some rework to pass against the changed and improved "samldb" module (see next commit).
2009-08-26 05:51:45 +04:00
# Add well known security principals
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
dn: CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: container
[SAMBA 4 directory] Corrects the "systemFlags" attributes Set the values like Windows Server 2003 R2.
2009-06-30 15:54:45 +04:00
systemFlags: -2147483648
r24696: Fix bug 4918 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de> with a patch from Andrew Kroeger <andrew@sprocks.gotdns.com>. The changes to samldb_fill_foreignSecurityPrincipal_object() look much larger then they are: We just skip all the objectSid generation if the SID is supplied. By providing a few more objects, standard dialogs on the clients are better behaved, for these 'well known' users. Andrew Bartlett (This used to be commit 35ee4aee719e69983d650602d1c6422a31600001)
2007-08-27 06:26:24 +04:00
dn: CN=Anonymous Logon,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-7
dn: CN=Authenticated Users,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-11
dn: CN=Batch,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-3
dn: CN=Creator Group,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-3-1
dn: CN=Creator Owner,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-3-0
dn: CN=Dialup,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-1
dn: CN=Digest Authentication,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-64-21
dn: CN=Enterprise Domain Controllers,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-9
dn: CN=Everyone,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-1-0
dn: CN=Interactive,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-4
dn: CN=Local Service,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-19
dn: CN=Network,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-2
dn: CN=Network Service,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-20
dn: CN=NTLM Authentication,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-64-10
dn: CN=Other Organization,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-1000
dn: CN=Proxy,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-8
dn: CN=Remote Interactive Logon,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-14
dn: CN=Restricted,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-12
dn: CN=SChannel Authentication,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-64-14
dn: CN=Self,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-10
dn: CN=Service,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-6
dn: CN=Terminal Server User,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-13
dn: CN=This Organization,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-15
dn: CN=Well-Known-Security-Id-System,CN=WellKnown Security Principals,${CONFIGDN}
objectClass: top
objectClass: foreignSecurityPrincipal
objectSid: S-1-5-18
Copy Permalink