windows-xp/Source/XPSP1/NT/ds/security/dsrole/server/threadman.c

/*++

Copyright (c) 1997  Microsoft Corporation

Module Name:

    threadman.c

Abstract:

    Implementation of the thread and thread management routines

Author:

    Mac McLain          (MacM)       Feb 10, 1997

Environment:

    User Mode

Revision History:

--*/
#include <setpch.h>
#include <dssetp.h>
#include <dsgetdc.h>
#include <lmcons.h>
#include <lmapibuf.h>
#include <lmsname.h>
#include <loadfn.h>
#include <lsarpc.h>
#include <db.h>
#include <lsasrvmm.h>
#include <lsaisrv.h>
#include <lmaccess.h>
#include <netsetp.h>
#include <samrpc.h>   // for samisrv.h
#include <samisrv.h>  // for nlrepl.h
#include <nlrepl.h>   // for I_NetNotifyDsChange
#include <Lmshare.h>  // for NetShareDel()
#include <autoenr.h>  // for CertAutoRemove()

#include "secure.h"
#include "services.h"
#include "upgrade.h"
#include "trustdom.h"
#include "sysvol.h"
#include "lsa.h"
#include "ds.h"

#include "threadman.h"


// forward from setutl.h
DWORD
DsRolepDeregisterNetlogonDnsRecords(
    PNTDS_DNS_RR_INFO pInfo
    );

//
// Helpful macros
//
#define DSROLEP_MAKE_DNS_RELATIVE(name)                                         \
if(name) {                                                                      \
    DWORD _StripAbsoluteLength_ = wcslen( name );                               \
    if ( *(name + _StripAbsoluteLength_ - 1 ) == L'.' ) {                       \
        *(name + _StripAbsoluteLength_ - 1 ) = UNICODE_NULL;                    \
    }                                                                           \
}

#define DSROLEP_ALLOC_AND_COPY_STRING_EXIT( dest, src, label )                                  \
if ( (src) ) {                                                                                  \
    (dest) = RtlAllocateHeap( RtlProcessHeap(), 0, (wcslen( (src) ) + 1) * sizeof( WCHAR ) );   \
    if ( !(dest) ) {                                                                            \
        goto label;                                                                             \
    } else {                                                                                    \
        wcscpy((dest), (src));                                                                  \
    }                                                                                           \
} else {                                                                                        \
    (dest) = NULL;                                                                              \
}

#define DSROLEP_ALLOC_AND_COPY_UNICODE_STRING_EXIT( dest, src, label )                          \
if ( (src) && (src)->Buffer ) {                                                                                  \
    (dest)->Buffer = RtlAllocateHeap( RtlProcessHeap(), 0, (src)->MaximumLength );              \
    if ( (dest)->Buffer == NULL ) {                                                             \
        goto label;                                                                             \
    } else {                                                                                    \
        (dest)->Length = (src)->Length;                                                         \
        (dest)->MaximumLength = (src)->MaximumLength;                                           \
        RtlCopyMemory( (dest)->Buffer, (src)->Buffer, (src)->MaximumLength );                   \
    }                                                                                           \
} else {                                                                                        \
    RtlZeroMemory( (dest), sizeof( UNICODE_STRING ) );                                          \
}


//
// Function definitions
//
DWORD
DsRolepBuildPromoteArgumentBlock(
    IN LPWSTR DnsDomainName,
    IN LPWSTR FlatDomainName,
    IN LPWSTR SiteName,
    IN LPWSTR DsDatabasePath,
    IN LPWSTR DsLogPath,
    IN LPWSTR RestorePath,
    IN LPWSTR SystemVolumeRootPath,
    IN PUNICODE_STRING Bootkey,
    IN LPWSTR Parent,
    IN LPWSTR Server,
    IN LPWSTR Account,
    IN PUNICODE_STRING Password,
    IN PUNICODE_STRING DomainAdminPassword,
    IN PUNICODE_STRING SafeModePassword,
    IN ULONG Options,
    IN UCHAR PasswordSeed,
    IN OUT PDSROLEP_OPERATION_PROMOTE_ARGS *Promote
    )
/*++

Routine Description:

    Builds an argument structure to pass into one of the promote worker functions.  Since the
    rpc call will return before the thread completes, we'll have to copy all our argument strings.

    Since parameters may be changed through out the course of promotion, we assume allocations
    are made from the process heap.


    Resultant argument block should be freed via DsRolepFreeArgumentBlock

Arguments:

    DnsDomainName - Dns domain name of the domain to install

    FlatDomainName - Flat (NetBIOS) domain name of the domain to install

    SiteName - Name of the site this DC should belong to

    DsDatabasePath - Absolute path on the local machine where the Ds DIT should go

    DsLogPath - Absolute path on the local machine where the Ds log files should go
    
    RestorePath - Location of a restored database.

    SystemVolumeRootPath - Absolute path on the local machine to be the root of the system
        volume root path.
        
    Bootkey - Needed when you don't have the key in the registry or on a disk
    
    cbBootkey - size of the bootkey

    Parent - Optional.  Parent domain name

    Server -- Optional.  Replica partner or server in parent domain

    Account - User account to use when setting up as a child domain

    Password - Password to use with the above account

    DomainAdminPassword - Password to set the domain administartor account

    Options - Options to control the creation of the domain

    PasswordSeed - Seed used to hide the passwords

    Promote - Where the allocated argument block is returned


Returns:

    ERROR_SUCCESS - Success

    ERROR_NOT_ENOUGH_MEMORY - A memory allocation failed

--*/
{
    DWORD WinError = ERROR_NOT_ENOUGH_MEMORY;

    *Promote = RtlAllocateHeap( RtlProcessHeap(), 0, sizeof( DSROLEP_OPERATION_PROMOTE_ARGS ) );
    if ( *Promote == NULL ) {

        goto BuildPromoteDone;
    }

    RtlZeroMemory( *Promote, sizeof( DSROLEP_OPERATION_PROMOTE_ARGS ) );

    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->DnsDomainName, DnsDomainName, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->FlatDomainName, FlatDomainName, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->SiteName, SiteName, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->DsDatabasePath, DsDatabasePath, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->DsLogPath, DsLogPath, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->RestorePath, RestorePath, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->SysVolRootPath, SystemVolumeRootPath, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->Parent, Parent, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->Server, Server, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Promote)->Account, Account, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_UNICODE_STRING_EXIT( &((*Promote)->Password), Password,
                                                BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_UNICODE_STRING_EXIT( &((*Promote)->DomainAdminPassword),
                                                DomainAdminPassword, BuildPromoteDone );

    DSROLEP_ALLOC_AND_COPY_UNICODE_STRING_EXIT( &((*Promote)->SafeModePassword),
                                                SafeModePassword, BuildPromoteDone );
    DSROLEP_ALLOC_AND_COPY_UNICODE_STRING_EXIT( &((*Promote)->Bootkey),
                                                Bootkey, BuildPromoteDone );
    (*Promote)->Options = Options;
    (*Promote)->Decode = PasswordSeed;

    WinError = DsRolepGetImpersonationToken( &(*Promote)->ImpersonateToken );

BuildPromoteDone:

    if ( WinError != ERROR_SUCCESS ) {

        DsRolepFreeArgumentBlock( Promote, TRUE );
    }

    return( WinError );
}




DWORD
DsRolepBuildDemoteArgumentBlock(
    IN DSROLE_SERVEROP_DEMOTE_ROLE ServerRole,
    IN LPWSTR DnsDomainName,
    IN LPWSTR Account,
    IN PUNICODE_STRING Password,
    IN ULONG Options,
    IN BOOL LastDcInDomain,
    IN PUNICODE_STRING AdminPassword,
    IN UCHAR PasswordSeed,
    IN OUT PDSROLEP_OPERATION_DEMOTE_ARGS *Demote
    )
/*++

Routine Description:

    Builds an argument structure to pass into the demote worker functions.  Since the rpc call
    will return before the thread completes, we'll have to copy all our argument strings.

    Resultant argument block should be freed via DsRolepFreeArgumentBlock

Arguments:

    ServerRole - New role for the server

    DnsDomainName - Dns domain name of the domain to uninstall.  NULL means all of them

    Account - User account to use when setting up as a child domain

    Password - Password to use with the above account

    Options - Options to control the creation of the domain

    LastDcInDomain - If TRUE, the Dc being demoted is the last Dc in the domain.

    AdminPassword - Password to set on the administrator account if it is a new install

    PasswordSeed - Seed used to hide the passwords

    Demote - Where the allocated argument block is returned


Returns:

    ERROR_SUCCESS - Success

    ERROR_NOT_ENOUGH_MEMORY - A memory allocation failed

--*/
{
    DWORD WinError = ERROR_NOT_ENOUGH_MEMORY;

    *Demote = RtlAllocateHeap( RtlProcessHeap(), 0, sizeof( DSROLEP_OPERATION_DEMOTE_ARGS ) );

    if ( *Demote == NULL ) {

        goto BuildDemoteDone;
    }

    RtlZeroMemory( *Demote, sizeof( DSROLEP_OPERATION_DEMOTE_ARGS ) );

    (*Demote)->ServerRole = ServerRole;
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Demote)->DomainName, DnsDomainName, BuildDemoteDone );
    DSROLEP_ALLOC_AND_COPY_STRING_EXIT( (*Demote)->Account, Account, BuildDemoteDone );
    DSROLEP_ALLOC_AND_COPY_UNICODE_STRING_EXIT( &((*Demote)->Password), Password, BuildDemoteDone );
    (*Demote)->LastDcInDomain = ( LastDcInDomain != 0 );
    DSROLEP_ALLOC_AND_COPY_UNICODE_STRING_EXIT( &((*Demote)->AdminPassword),
                                                AdminPassword,
                                                BuildDemoteDone );
    (*Demote)->Options = Options;
    (*Demote)->Decode = PasswordSeed;

    WinError = DsRolepGetImpersonationToken( & (*Demote)->ImpersonateToken );

BuildDemoteDone:

    if ( WinError != ERROR_SUCCESS ) {

        DsRolepFreeArgumentBlock( Demote, FALSE );
    }

    return( WinError );
}



VOID
DsRolepFreeArgumentBlock(
    IN PVOID *ArgumentBlock,
    IN BOOLEAN Promote
    )
/*++

Routine Description:

    Frees an arugment block allocated via DsRolepBuildPromote/DemoteArgumentBlock
    Since parameters may be changed through out the course of promotion, we assume allocations
    are made from the process heap.

Arguments:

    ArgumentBlock - Argument block to free

    Promote - If TRUE, this is a promote argument block.  If FALSE, it's a demote arg block

Returns:

    VOID

--*/
{
    PDSROLEP_OPERATION_PROMOTE_ARGS PromoteArg;
    PDSROLEP_OPERATION_DEMOTE_ARGS Demote;
    PVOID HeapHandle = RtlProcessHeap();

    if ( !ArgumentBlock ) {

        return;
    }

    //
    // Free it all
    //
    if ( Promote ) {

        PromoteArg = ( PDSROLEP_OPERATION_PROMOTE_ARGS )*ArgumentBlock;

        RtlFreeHeap( HeapHandle, 0, PromoteArg->DnsDomainName );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->FlatDomainName );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->SiteName );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->DsDatabasePath );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->DsLogPath );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->SysVolRootPath );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->Parent );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->Server );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->Account );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->Password.Buffer );
        RtlFreeHeap( HeapHandle, 0, PromoteArg->DomainAdminPassword.Buffer );

        if ( PromoteArg->ImpersonateToken ) {

            NtClose( PromoteArg->ImpersonateToken );
        }

    } else {

        Demote = ( PDSROLEP_OPERATION_DEMOTE_ARGS )*ArgumentBlock;
        RtlFreeHeap( HeapHandle, 0, Demote->Account );
        RtlFreeHeap( HeapHandle, 0, Demote->Password.Buffer );
        RtlFreeHeap( HeapHandle, 0, Demote->DomainName );
        RtlFreeHeap( HeapHandle, 0, Demote->AdminPassword.Buffer );
        if ( Demote->ImpersonateToken ) {

            NtClose( Demote->ImpersonateToken );
        }
    }

    RtlFreeHeap( HeapHandle, 0, *ArgumentBlock );
}



DWORD
DsRolepSpinWorkerThread(
    IN DSROLEP_OPERATION_TYPE Operation,
    IN PVOID ArgumentBlock
    )
/*++

Routine Description:

    This function actually creates the worker thread that will do the promot/demote


Arguments:

    Operation - Demote, Promote as DC, or Promote as Replica

    ArgumentBlock - Block of arguments appropriate for the operation


Returns:

    ERROR_SUCCESS - Success

    INVALID_PARAMETER - An unexpected operation type encounterd

--*/
{
    DWORD WinError = ERROR_SUCCESS, IgnoreError;
    NTSTATUS NtStatus;
    DWORD ThreadId;

    //
    // The basic premise is that we'll utilize the Completion event to indicate when
    // the thread is full initialized.
    //
    NtStatus = NtResetEvent( DsRolepCurrentOperationHandle.CompletionEvent, NULL );
    WinError = RtlNtStatusToDosError( NtStatus );

    if ( ERROR_SUCCESS == WinError ) {

        switch ( Operation) {
        case DSROLEP_OPERATION_DC:

            DsRolepCurrentOperationHandle.OperationThread = CreateThread(
                        NULL,
                        0,
                        ( LPTHREAD_START_ROUTINE )DsRolepThreadPromoteDc,
                        ArgumentBlock,
                        0,
                        &ThreadId );
            break;


        case DSROLEP_OPERATION_REPLICA:

            DsRolepCurrentOperationHandle.OperationThread = CreateThread(
                        NULL,
                        0,
                        ( LPTHREAD_START_ROUTINE )DsRolepThreadPromoteReplica,
                        ArgumentBlock,
                        0,
                        &ThreadId );
            break;

        case DSROLEP_OPERATION_DEMOTE:

            DsRolepCurrentOperationHandle.OperationThread = CreateThread(
                        NULL,
                        0,
                        ( LPTHREAD_START_ROUTINE )DsRolepThreadDemote,
                        ArgumentBlock,
                        0,
                        &ThreadId );
            break;

        default:

            DsRoleDebugOut(( DEB_ERROR,
                             "Unexpected operation %lu encountered\n", Operation ));

            WinError = ERROR_INVALID_PARAMETER;
            break;


        }

        //
        // Check for failure
        //
        if ( WinError == ERROR_SUCCESS &&
             DsRolepCurrentOperationHandle.OperationThread == NULL ) {

             WinError = GetLastError();
        }


        //
        // If it worked, wait for the thread to indicate its ready
        //
        if ( WinError == ERROR_SUCCESS ) {

            if ( WaitForSingleObject( DsRolepCurrentOperationHandle.CompletionEvent,
                                      INFINITE ) == WAIT_FAILED ) {

                WinError = GetLastError();

            } else {

                NtResetEvent( DsRolepCurrentOperationHandle.CompletionEvent, NULL );
            }
        }

    }

    if ( WinError == ERROR_SUCCESS ) {

        DsRoleDebugOut(( DEB_TRACE,
                         "Thread %lu successfully started\n", ThreadId ));

    } else {

        DsRolepLogPrint(( DEB_ERROR,
                             "Thread %lu unsuccessfully started: %lu\n", ThreadId, WinError ));

    }


    return( WinError );
}




DWORD
DsRolepThreadPromoteDc(
    IN PVOID ArgumentBlock
    )
/*++

Routine Description:

    This function actually "promotes" a server to a dc of an new domain.  Additionally, this
    domain can be set up as a child of an existing domain. This is accomplished by:
        Installing the Ds as a replica
        Setting the DnsDomainTree LSA information
        Optionally configuring it as a child of an existing domain
        Configuring the KDC

Arguments:

    ArgumentBlock - Block of arguments appropriate for the operation


Returns:

    ERROR_SUCCESS - Success

--*/
{
    DWORD WinError = ERROR_SUCCESS;
    DWORD IgnoreError;
    PWSTR ParentDc = NULL;
    PDOMAIN_CONTROLLER_INFO DomainControllerInfo = NULL;
    PDSROLEP_OPERATION_PROMOTE_ARGS PromoteArgs = ( PDSROLEP_OPERATION_PROMOTE_ARGS )ArgumentBlock;
    DSROLEP_DOMAIN_POLICY_INFO BackupDomainPolicyInfo;
    ULONG FindOptions;
    GUID DomainGuid;
    PWSTR InstalledSite = NULL;
    PSID NewDomainSid = NULL;
    PPOLICY_DNS_DOMAIN_INFO ParentDnsDomainInfo = NULL;
    PWSTR DnsDomainTreeName = NULL;


    //
    // BOOLEAN's to maintain state
    //
    // N.B. The order of these booleans is the order in which they
    //      are changed -- please maintain order and make sure that
    //      the PromoteUndo section undoes them in the reverse order
    //
    BOOLEAN IPCConnection                   = FALSE;  // resource -- release on exit
    BOOLEAN RestartNetlogon                 = FALSE;
    BOOLEAN SysVolCreated                   = FALSE;
    BOOLEAN CleanupNetlogon                 = FALSE;  // nothing to undo
    BOOLEAN DsInstalled                     = FALSE;
    BOOLEAN DsRunning                       = FALSE;
    BOOLEAN DomainPolicyInfoChanged         = FALSE;
    BOOLEAN DomainServicesChanged           = FALSE; 
    BOOLEAN DomainControllerServicesChanged = FALSE; 
    BOOLEAN TrustCreated                    = FALSE;
    BOOLEAN ProductTypeChanged              = FALSE;

    //
    // Init the stack space
    //
    RtlZeroMemory(&BackupDomainPolicyInfo, sizeof(BackupDomainPolicyInfo));

    //
    // Set our event to indicate we're starting
    //
    NtSetEvent( DsRolepCurrentOperationHandle.CompletionEvent, NULL );

    //
    // If we have an existing domain in the forest to install from and we
    // weren't given a site or source server name, we need to make a dsgetdc
    // name.
    //
    if ( PromoteArgs->Server ) {

        ParentDc = PromoteArgs->Server;
        
    }

    if ( PromoteArgs->Parent != NULL  &&
         ( (PromoteArgs->Server == NULL) 
        || (PromoteArgs->SiteName == NULL) )    ) {

        DsRolepLogPrint(( DEB_TRACE,
                          "No source DC or no site name specified. Searching for dc in domain %ws: ( DS_REQUIRED | WRITABLE )\n",
                          PromoteArgs->Parent ));


        DSROLEP_CURRENT_OP1( DSROLEEVT_SEARCH_DC, PromoteArgs->Parent );

        FindOptions = DS_DIRECTORY_SERVICE_REQUIRED | DS_WRITABLE_REQUIRED | DS_FORCE_REDISCOVERY;

        WinError = DsGetDcName(NULL, 
                               PromoteArgs->Parent, 
                               NULL, 
                               NULL,
                               FindOptions,
                              &DomainControllerInfo );

        if ( ERROR_SUCCESS != WinError ) { 

            DsRolepLogPrint(( DEB_TRACE, 
                             "Couldn't find domain controller in domain %ws (error: %d)\n", 
                             ParentDc,
                             WinError ));

            if ( PromoteArgs->Server == NULL ) {

                //
                // This is a fatal error if we can't find a dc in the parent domain
                // If we have a server, then we can derive a site name later on if
                // necessary
                //
                DSROLEP_FAIL1( WinError, DSROLERES_FIND_DC, PromoteArgs->Parent );
    
                DsRolepLogPrint(( DEB_ERROR,
                                  "Failed to find a dc for %ws: %lu\n",
                                  PromoteArgs->Parent,
                                  WinError ));
    
                goto PromoteUndo;
            
            }

            //
            // This isn't fatal since we are a source server
            //
            DsRolepLogPrint(( DEB_TRACE, "Using supplied domain controller: %ws\n", ParentDc ));
            WinError = ERROR_SUCCESS;

        } else {

            //
            // The dsgetdcname succeeded
            //
            if ( PromoteArgs->Server == NULL ) {

                //
                // Use the found domain controller
                //

                DSROLEP_CURRENT_OP2( DSROLEEVT_FOUND_DC,
                                     PromoteArgs->Parent,
                                     ParentDc );
    
                DsRolepLogPrint(( DEB_TRACE_DS, "No user specified source DC\n" ));
                ParentDc = DomainControllerInfo->DomainControllerName;
    
            }

            //
            // Determine the site that we are going to be installed in
            // the results of the parent query
            //
            if ( PromoteArgs->SiteName == NULL ) {
    
                DsRolepLogPrint(( DEB_TRACE_DS, "No user specified site\n" ));
    
                PromoteArgs->SiteName = DomainControllerInfo->ClientSiteName;
    
                if ( (PromoteArgs->SiteName == NULL) 
                  && (!_wcsicmp(ParentDc, DomainControllerInfo->DomainControllerName))  ) {
    
                    DsRolepLogPrint(( DEB_TRACE_DS, "This machine is not in a configured site ... using source DC's site.\n" ));
    
                    PromoteArgs->SiteName = DomainControllerInfo->DcSiteName;
    
                } else {
    
                    //
                    // We can't find a site.  That's ok -- the ds will find one for
                    // us
                    //
                }

            }

            if ( PromoteArgs->SiteName ) {
                
                DSROLEP_CURRENT_OP2( DSROLEEVT_FOUND_SITE,
                                     PromoteArgs->SiteName,
                                     PromoteArgs->Parent );
            } else {
    
                DsRolepLogPrint(( DEB_TRACE_DS, "This machine is not in a configured site\n" ));
            }
        }

    } else {

        //
        // The caller supplied both the source server and site name
        //
        ParentDc = PromoteArgs->Server;

        DsRolepLogPrint(( DEB_TRACE, "Using supplied domain controller: %ws\n", ParentDc ));
        DsRolepLogPrint(( DEB_TRACE, "Using supplied site: %ws\n", PromoteArgs->SiteName ));
    }

    //
    // Ok, we have determined the our source domain controller and destination
    // site
    //

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Force the time synch
    //
    if (   ParentDc 
        && FLAG_ON( PromoteArgs->Options, DSROLE_DC_FORCE_TIME_SYNC ) ) {

        

        WinError = DsRolepForceTimeSync( PromoteArgs->ImpersonateToken,
                                         ParentDc );

        if ( ERROR_SUCCESS != WinError ) {

           DsRolepLogPrint(( DEB_WARN, "Time sync with %ws failed with %d\n",
                             ParentDc,
                             WinError ));

        //
           // This is not a fatal error
           //
           WinError = ERROR_SUCCESS;

        }
    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // If we are setting up a child domain, establish a session first
    //
    if ( ParentDc ) {

        RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
        WinError = ImpNetpManageIPCConnect( PromoteArgs->ImpersonateToken,
                                            ParentDc,
                                            PromoteArgs->Account,
                                            PromoteArgs->Password.Buffer,
                                            NETSETUPP_CONNECT_IPC );

        RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );
        if ( ERROR_SUCCESS != WinError ) {

            DSROLEP_FAIL1( WinError, DSROLERES_NET_USE, ParentDc );
            DsRolepLogPrint(( DEB_ERROR,
                              "Failed to establish the session with %ws: 0x%lx\n", ParentDc,
                              WinError ));
            goto PromoteUndo;

        }
        IPCConnection = TRUE;

    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // If we have a parent dc, get the LSA policy from it
    //

    //
    // Strip the trailing '.' from the Dns name if we happen to have an absolute name
    //
    DSROLEP_MAKE_DNS_RELATIVE( PromoteArgs->DnsDomainName );
    DnsDomainTreeName = PromoteArgs->DnsDomainName;
    if ( ParentDc ) {

        NTSTATUS Status;
        UNICODE_STRING ParentServer;
        HANDLE ParentPolicy = NULL;
        OBJECT_ATTRIBUTES ObjectAttributes;

        DSROLEP_CURRENT_OP1( DSROLEEVT_MACHINE_POLICY, ParentDc );

        RtlInitUnicodeString( &ParentServer, ParentDc );

        RtlZeroMemory( &ObjectAttributes, sizeof( ObjectAttributes ) );

        Status = ImpLsaOpenPolicy( PromoteArgs->ImpersonateToken,
                                       &ParentServer,
                                       &ObjectAttributes,
                                        MAXIMUM_ALLOWED,
                                       &ParentPolicy );

        if ( NT_SUCCESS( Status ) ) {

            Status = ImpLsaQueryInformationPolicy( PromoteArgs->ImpersonateToken,
                                                   ParentPolicy,
                                                   PolicyDnsDomainInformation,
                                                  &ParentDnsDomainInfo );

            ImpLsaClose( PromoteArgs->ImpersonateToken, ParentPolicy );
        }

        //
        // We'll have to build it as a NULL terminated string
        //
        if ( NT_SUCCESS( Status ) && ParentDnsDomainInfo->DnsForestName.Length  ) {

            if ( ParentDnsDomainInfo->DnsForestName.Buffer[
                    ParentDnsDomainInfo->DnsForestName.Length / sizeof( WCHAR ) ] == UNICODE_NULL ) {

                DnsDomainTreeName = ( PWSTR )ParentDnsDomainInfo->DnsForestName.Buffer;

            } else {

                DnsDomainTreeName = RtlAllocateHeap(
                                        RtlProcessHeap(), 0,
                                        ParentDnsDomainInfo->DnsForestName.Length + sizeof( WCHAR ) );

                if ( DnsDomainTreeName == NULL ) {

                    Status = STATUS_INSUFFICIENT_RESOURCES;

                } else {

                    RtlCopyMemory( DnsDomainTreeName,
                                   ParentDnsDomainInfo->DnsForestName.Buffer,
                                   ParentDnsDomainInfo->DnsForestName.Length );

                    DnsDomainTreeName[ ParentDnsDomainInfo->DnsForestName.Length /
                                                                sizeof( WCHAR ) ] = UNICODE_NULL;
                }
            }

        }


        WinError = RtlNtStatusToDosError( Status );

        DSROLEP_FAIL1( WinError, DSROLERES_POLICY_READ_REMOTE, ParentDc );

        if ( ERROR_SUCCESS != WinError ) {

            goto PromoteUndo;

        }
    }


    //
    // If we are doing a root install, make sure we were given the forest root
    // as our parent
    //
    if ( FLAG_ON( PromoteArgs->Options, DSROLE_DC_TRUST_AS_ROOT ) ) {

         DSROLEP_MAKE_DNS_RELATIVE( PromoteArgs->Parent );
         DSROLEP_MAKE_DNS_RELATIVE( DnsDomainTreeName );
         if ( _wcsicmp( PromoteArgs->Parent, DnsDomainTreeName ) ) {

            //
            // Names don't match... We can't allow this...
            //
            DsRolepLogPrint(( DEB_ERROR,
                              "Tried to specify domain %ws as a forest root but "
                              "%ws is the actual root\n",
                              PromoteArgs->Parent,
                              DnsDomainTreeName ));

            WinError = ERROR_INVALID_DOMAINNAME;
            DSROLEP_FAIL1( WinError, DSROLERES_NOT_FOREST_ROOT, PromoteArgs->Parent );

            goto PromoteUndo;
         }
    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Make a back up of the local policy...
    //
    WinError = DsRolepBackupDomainPolicyInfo( NULL, &BackupDomainPolicyInfo );

    if ( ERROR_SUCCESS != WinError ) {

        DSROLEP_FAIL0( WinError, DSROLERES_POLICY_READ_LOCAL );

        goto PromoteUndo;
    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Stop netlogon
    //
    DSROLEP_CURRENT_OP1( DSROLEEVT_STOP_SERVICE, SERVICE_NETLOGON );
    WinError = DsRolepStopNetlogon( &RestartNetlogon );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_WARN, "Failed to stop NETLOGON (%d)\n", WinError ));

        goto PromoteUndo;
        
    }

    DsRolepLogPrint(( DEB_TRACE, "Stopped NETLOGON\n" ));


    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Create the system volume information so we can seed the system volume while the Ds is
    // installing
    //
    DSROLEP_CURRENT_OP1( DSROLEEVT_CREATE_SYSVOL, PromoteArgs->SysVolRootPath );
    RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
    WinError = DsRolepCreateSysVolPath( PromoteArgs->SysVolRootPath,
                                        PromoteArgs->DnsDomainName,
                                        ParentDc,
                                        PromoteArgs->Account,
                                        PromoteArgs->Password.Buffer,
                                        PromoteArgs->SiteName,
                                        TRUE );
    RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );

    DSROLEP_CURRENT_OP1( DSROLEEVT_SVSETUP, PromoteArgs->SysVolRootPath );

    if ( WinError != ERROR_SUCCESS ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to create the system volume (%d)\n", WinError ));
        goto PromoteUndo;

    }
    SysVolCreated = TRUE;

    DsRolepLogPrint(( DEB_TRACE, "Created the system volume\n" ));
    
    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Setup the Ds
    //
    RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
    RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->DomainAdminPassword );
    RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->SafeModePassword );
    WinError = DsRolepInstallDs( PromoteArgs->DnsDomainName,
                                 PromoteArgs->FlatDomainName,
                                 DnsDomainTreeName,
                                 PromoteArgs->SiteName,
                                 PromoteArgs->DsDatabasePath,
                                 PromoteArgs->DsLogPath,
                                 PromoteArgs->RestorePath,
                                 PromoteArgs->SysVolRootPath,
                                 &(PromoteArgs->Bootkey),
                                 PromoteArgs->DomainAdminPassword.Buffer,
                                 PromoteArgs->Parent,
                                 ParentDc,
                                 PromoteArgs->Account,
                                 PromoteArgs->Password.Buffer,
                                 PromoteArgs->SafeModePassword.Buffer,
                                 PromoteArgs->Parent,
                                 PromoteArgs->Options,
                                 FALSE,
                                 PromoteArgs->ImpersonateToken,
                                 &InstalledSite,
                                 &DomainGuid,
                                 &NewDomainSid );
    RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );
    RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->DomainAdminPassword );
    RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->SafeModePassword );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to install the directory service (%d)\n", WinError ));
        goto PromoteUndo;
    }
    DsRunning = TRUE;
    DsInstalled = TRUE;

    DsRolepLogPrint(( DEB_TRACE, "Installed the directory service\n", WinError ));

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Set the LSA domain policy
    //
    WinError = DsRolepSetLsaDomainPolicyInfo( PromoteArgs->DnsDomainName,
                                              PromoteArgs->FlatDomainName,
                                              DnsDomainTreeName,
                                              &DomainGuid,
                                              NewDomainSid,
                                              NTDS_INSTALL_DOMAIN,
                                              &BackupDomainPolicyInfo );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to set the LSA policy (%d)\n", WinError ));

        DSROLEP_FAIL0( WinError, DSROLERES_POLICY_WRITE_LOCAL );

        goto PromoteUndo;
    }
    DomainPolicyInfoChanged = TRUE;

    DsRolepLogPrint(( DEB_TRACE, "Set the LSA policy\n"));

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Configure the domain relative services
    //
    WinError = DsRolepConfigureDomainServices( DSROLEP_SERVICES_ON  );

    if ( WinError != ERROR_SUCCESS ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to configure the domain services (%d)\n", WinError ));

        goto PromoteUndo;

    }
    DomainServicesChanged = TRUE;

    DsRolepLogPrint(( DEB_TRACE, "Configured the domain services\n" ));

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Configure the domain controller relative services
    //
    WinError = DsRolepConfigureDomainControllerServices( DSROLEP_SERVICES_ON );

    if ( WinError != ERROR_SUCCESS ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to configure the domain controller services (%d)\n", WinError ));
        goto PromoteUndo;

    }
    DomainControllerServicesChanged = TRUE;

    DsRolepLogPrint(( DEB_TRACE, "Configured the domain controller services\n" ));

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Finally, upgrade the Lsa to the Ds.
    //
    WinError = DsRolepUpgradeLsaToDs( TRUE );

    if ( ERROR_SUCCESS != WinError ) {

        DSROLEP_FAIL0( WinError, DSROLERES_LSA_UPGRADE );
        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_TRACE,
                                               "Upgrade of the LSA into the DS failed with %lu\n",
                                                WinError )) );

        goto PromoteUndo;
        
    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );
    

    //
    // Create the trust objects and set the DnsDomainTree information
    //
    if ( ParentDc ) {

        WinError = DsRolepCreateTrustedDomainObjects( PromoteArgs->ImpersonateToken,
                                                      ParentDc,
                                                      PromoteArgs->DnsDomainName,
                                                      ParentDnsDomainInfo,
                                                      PromoteArgs->Options );
        if ( WinError != ERROR_SUCCESS ) {

            DsRolepLogPrint(( DEB_ERROR, "Failed to create trusted domain objects (%d)\n", WinError ));

            goto PromoteUndo;

        }
        TrustCreated = TRUE;

        DsRolepLogPrint(( DEB_TRACE, "Created trusted domain objects\n" ));
    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Create the GPO for policy
    //
    WinError = ( *DsrSceDcPromoCreateGPOsInSysvolEx )( PromoteArgs->ImpersonateToken,
                                                       PromoteArgs->DnsDomainName,
                                                       PromoteArgs->SysVolRootPath,
                                                       FLAG_ON( PromoteArgs->Options,
                                                                  DSROLE_DC_DOWNLEVEL_UPGRADE ) ?
                                                                    SCE_PROMOTE_FLAG_UPGRADE :
                                                                    0,
                                                       DsRolepStringUpdateCallback );

    if ( ERROR_SUCCESS != WinError ) {
        
        DSROLEP_FAIL1( WinError, DSROLERES_GPO_CREATION, PromoteArgs->DnsDomainName );
    
        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_TRACE,
                                               "Creation of GPO failed with %lu\n",
                                               WinError )) );
        goto PromoteUndo;

    }

    DsRolepLogPrint(( DEB_TRACE,
                      "Created GPO\n" ));
    

    //
    // Stop the Ds
    //
    DsRolepStopDs( DsRunning );
    DsRunning = FALSE;


    //
    // If the install succeeded, make sure to save off the new site name
    //
    WinError = DsRolepSetOperationHandleSiteName( InstalledSite );

    if ( WinError != ERROR_SUCCESS ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to copy site name (%d)\n", WinError ));

        goto PromoteUndo;

    }
    //
    // If we update it, NULL out the local parameter so we don't attempt to delete it
    //

    InstalledSite = NULL;

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Set the computers Dns domain name
    //
    DSROLEP_CURRENT_OP1( DSROLEEVT_SET_COMPUTER_DNS, PromoteArgs->DnsDomainName );
    WinError = NetpSetDnsComputerNameAsRequired( PromoteArgs->DnsDomainName );
    if ( ERROR_SUCCESS != WinError ) {
        
        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_TRACE,
                                               "NetpSetDnsComputerNameAsRequired to %ws failed with %lu\n",
                                               PromoteArgs->DnsDomainName,
                                               WinError )) );
        DSROLEP_FAIL1( WinError, DSROLERES_SET_COMPUTER_DNS, PromoteArgs->DnsDomainName );

        goto PromoteUndo;
    }

    //
    // Restart netlogon if it was stopped and if a failure occurred
    //

    //
    // Complete the sysvol replication
    //
    WinError = DsRolepFinishSysVolPropagation( TRUE, TRUE );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to complete system volume replication (%d)\n", WinError ));
        goto PromoteUndo;
        
    }

    DsRolepLogPrint(( DEB_TRACE, "Completed system volume replication\n"));
    
    //
    // Next, set the sysvol path for netlogon
    //
    WinError = DsRolepSetNetlogonSysVolPath( PromoteArgs->SysVolRootPath,
                                             PromoteArgs->DnsDomainName,
                                             ( BOOLEAN )FLAG_ON( PromoteArgs->Options,
                                                                 DSROLE_DC_DOWNLEVEL_UPGRADE ),
                                             &CleanupNetlogon );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to set system volume path for NETLOGON (%d)\n", WinError ));
        goto PromoteUndo;
        
    }

    DsRolepLogPrint(( DEB_TRACE, "Set system volume path for NETLOGON\n" ));


    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Set the machine role
    //
    WinError = DsRolepSetProductType( DSROLEP_MT_MEMBER );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to set the product type (%d)\n", WinError ));

        goto PromoteUndo;
        
    }
    ProductTypeChanged = TRUE;

    DsRolepLogPrint(( DEB_TRACE, "Set the product type\n" ));


    //
    // Set the security on the dc files
    //
    WinError = DsRolepSetDcSecurity( PromoteArgs->ImpersonateToken,
                                     PromoteArgs->SysVolRootPath,
                                     PromoteArgs->DsDatabasePath,
                                     PromoteArgs->DsLogPath,
                                     ( BOOLEAN )FLAG_ON( PromoteArgs->Options,
                                                                 DSROLE_DC_DOWNLEVEL_UPGRADE ),
                                     FALSE );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to set security on domain controller (%d)\n", WinError ));
        goto PromoteUndo;
        
    }

    DsRolepLogPrint(( DEB_TRACE, "Set security on domain controller\n"));


    DsRolepSetCriticalOperationsDone();

    //
    // From here to do the end, perform, and only perform, non critical 
    // operations
    //

    //
    // Indicate that we are no longer doing upgrades, if applicable
    //
    if ( FLAG_ON( PromoteArgs->Options, DSROLE_DC_DOWNLEVEL_UPGRADE ) ) {

        WinError = DsRolepDeleteUpgradeInfo();

        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to cleanup upgrade info (%d)\n",
                                               WinError )) );

        if (ERROR_SUCCESS == WinError) {
            DsRolepLogPrint(( DEB_TRACE,
                              "Removed upgrade info\n" ));
        }

        // This error isn't interesting to propogate
        WinError = ERROR_SUCCESS;
    }

    //
    // Remove any old netlogon stuff if we got that far
    //
    if ( CleanupNetlogon ) {

        WinError = DsRolepCleanupOldNetlogonInformation();

        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to cleanup old netlogon information (%d)\n",
                                               WinError )) );

        if (ERROR_SUCCESS == WinError) {
            DsRolepLogPrint(( DEB_TRACE,
                              "Removed old netlogon information\n" ));
        }

        // This error isn't interesting to propogate
        WinError = ERROR_SUCCESS;
    }

    //
    // Set the default logon domain to the current domain name
    //
    WinError = DsRolepSetLogonDomain( PromoteArgs->FlatDomainName, FALSE );
    if ( ERROR_SUCCESS != WinError ) {
        
        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to set default logon domain to %ws (%d)\n",
                                                PromoteArgs->FlatDomainName,
                                                WinError )) );

        if (ERROR_SUCCESS == WinError) {
            DsRolepLogPrint(( DEB_TRACE,
                              "Set default logon domain to %ws\n",
                              PromoteArgs->FlatDomainName ));
        }

        //
        // This is no reason to fail
        //
        WinError = ERROR_SUCCESS;

    }

    //
    // Notify the time server we have completed the promotion
    //
    {
        DWORD dwTimeFlags = W32TIME_PROMOTE;

        if (  FLAG_ON( PromoteArgs->Options, DSROLE_DC_TRUST_AS_ROOT )
           || (NULL == PromoteArgs->Parent) ) {
            //
            // Any tree root, including the root of the forest
            // should have this flag.
            //
            dwTimeFlags |= W32TIME_PROMOTE_FIRST_DC_IN_TREE;
        }

        (*DsrW32TimeDcPromo)( dwTimeFlags );
    }

    //
    // By this time, we have successfully completed the promotion operation
    //
    ASSERT( ERROR_SUCCESS == WinError );

    
PromoteExit:

    // The DS should not be running at this point
    ASSERT( FALSE == DsRunning );

    //
    // Release any resources
    //

    //
    // Tear down the session to the parent, if we have one
    //
    if ( IPCConnection ) {

        RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
        IgnoreError = ImpNetpManageIPCConnect( PromoteArgs->ImpersonateToken,
                                             ParentDc,
                                             PromoteArgs->Account,
                                             PromoteArgs->Password.Buffer,
                                             (NETSETUPP_DISCONNECT_IPC | NETSETUPP_USE_LOTS_FORCE));
        RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );
        if ( IgnoreError != ERROR_SUCCESS ) {

            DsRolepLogPrint(( DEB_WARN,
                             "Failed to destroy the session with %ws: 0x%lx\n", ParentDc,
                             IgnoreError ));
        }

        IPCConnection = FALSE;
    }

    if ( ParentDnsDomainInfo ) {

        if ( DnsDomainTreeName != ParentDnsDomainInfo->DnsForestName.Buffer ) {

            RtlFreeHeap( RtlProcessHeap(), 0, DnsDomainTreeName );
        }

        LsaFreeMemory( ParentDnsDomainInfo );
    }
    
    if ( InstalledSite ) {
        RtlFreeHeap( RtlProcessHeap(), 0, InstalledSite );
    }

    if ( NewDomainSid ) {
        RtlFreeHeap( RtlProcessHeap(), 0, NewDomainSid );
    }

    DsRolepFreeDomainPolicyInfo( &BackupDomainPolicyInfo );

    if ( DomainControllerInfo != NULL ) {

        if ( PromoteArgs->SiteName == DomainControllerInfo->DcSiteName ||
             PromoteArgs->SiteName == DomainControllerInfo->ClientSiteName ) {

            PromoteArgs->SiteName = NULL;
        }

        NetApiBufferFree( DomainControllerInfo );

    }

    DsRolepFreeArgumentBlock( &ArgumentBlock, TRUE );

    //
    // Reset our operation handle and set the final operation status
    //
    DsRolepSetOperationDone( DSROLEP_OP_PROMOTION, WinError );

    ExitThread( WinError );

    return( WinError );


PromoteUndo:

    //
    // Something must have failed if we are undoing
    //
    ASSERT( WinError != ERROR_SUCCESS );

    if ( ProductTypeChanged ) {

        IgnoreError = DsRolepSetProductType( DSROLEP_MT_STANDALONE );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback product type (%d)\n",
                                                IgnoreError )) );

        ProductTypeChanged = FALSE;
    }

    if ( TrustCreated ) {

        IgnoreError = DsRolepRemoveTrustedDomainObjects( PromoteArgs->ImpersonateToken,
                                                       ParentDc,
                                                       ParentDnsDomainInfo,
                                                       FLAG_ON( PromoteArgs->Options,
                                                        DSROLE_DC_PARENT_TRUST_EXISTS ) ?
                                                            0 :
                                                            DSROLE_DC_DELETE_PARENT_TRUST );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback trusted domain object creations (%d)\n",
                                                IgnoreError )) );

        TrustCreated = FALSE;
    }

    if ( DomainControllerServicesChanged ) {

        IgnoreError = DsRolepConfigureDomainControllerServices( DSROLEP_SERVICES_REVERT );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback domain controller services configuration (%d)\n",
                                                IgnoreError )) );
        DomainControllerServicesChanged = FALSE;
    }

    if ( DomainServicesChanged ) {

        IgnoreError = DsRolepConfigureDomainServices( DSROLEP_SERVICES_REVERT );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback domain services configuration (%d)\n",
                                                IgnoreError )) );
        DomainServicesChanged = FALSE;
    }

    if ( DomainPolicyInfoChanged ) {

        IgnoreError  = DsRolepRestoreDomainPolicyInfo(&BackupDomainPolicyInfo);

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback domain policy information (%d)\n",
                                                IgnoreError )) );
        DomainPolicyInfoChanged = FALSE;
    }

    if ( DsRunning ) {

        IgnoreError = DsRolepStopDs( DsRunning );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to stop the directory service (%d)\n",
                                                IgnoreError )) );
            
        DsRunning = FALSE;
        
    }

    if ( DsInstalled ) {

        IgnoreError = DsRolepUninstallDs( );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback directory service installation (%d)\n",
                                                IgnoreError )) );
        DsInstalled = FALSE;
    }



    if ( SysVolCreated ) {

        IgnoreError =  DsRolepFinishSysVolPropagation( FALSE, TRUE );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to abort system volume installation (%d)\n",
                                                IgnoreError )) );

        IgnoreError = DsRolepRemoveSysVolPath( PromoteArgs->SysVolRootPath,
                                               PromoteArgs->DnsDomainName,
                                              &DomainGuid );

        
        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to remove system volume path (%d)\n",
                                                IgnoreError )) );
        SysVolCreated = FALSE;
    }


    if ( RestartNetlogon ) {

        IgnoreError = DsRolepStartNetlogon();

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to restart netlogon (%d)\n",
                                                IgnoreError )) );

        RestartNetlogon = FALSE;
    }


    //
    // We are finished the undo -- exit the thread
    //
    ASSERT( ERROR_SUCCESS != WinError );

    goto PromoteExit;

}





DWORD
DsRolepThreadPromoteReplica(
    IN PVOID ArgumentBlock
    )
/*++

Routine Description:

    This function actually "promotes" a server to a replica of an existing domain.  This is
    accomplished by:
        Installing the Ds as a replica
        Setting the DnsDomainTree LSA information
        Configuring the KDC

    Required are the Dns domain name and the name of a replica within the domain, and the
    Db and Log paths

Arguments:

    ArgumentBlock - Block of arguments appropriate for the operation


Returns:

    ERROR_SUCCESS - Success

--*/
{
    DWORD WinError = ERROR_SUCCESS, IgnoreError;
    PDSROLEP_OPERATION_PROMOTE_ARGS PromoteArgs = (PDSROLEP_OPERATION_PROMOTE_ARGS)ArgumentBlock;
    PDOMAIN_CONTROLLER_INFO DomainControllerInfo = NULL;
    DSROLEP_DOMAIN_POLICY_INFO BackupDomainPolicyInfo;
    ULONG FindOptions = 0;
    GUID DomainGuid;
    PWSTR InstalledSite = NULL, ReplicaServer = NULL;
    PSID NewDomainSid = NULL;
    WCHAR LocalMachineAccountName[ MAX_COMPUTERNAME_LENGTH + 2 ];
    ULONG Length = MAX_COMPUTERNAME_LENGTH + 1;

    //
    // BOOLEAN's to maintain state
    //
    // N.B. The order of these booleans is the order in which they
    //      are changed -- please maintain order and make sure that
    //      the PromoteUndo section undoes them in the reverse order
    //
    BOOLEAN IPCConnection                   = FALSE;  // resource -- release on exit
    BOOLEAN RestartNetlogon                 = FALSE;
    BOOLEAN SysVolCreated                   = FALSE;
    BOOLEAN DsInstalled                     = FALSE;
    BOOLEAN DsRunning                       = FALSE;
    BOOLEAN DomainPolicyInfoChanged         = FALSE;
    BOOLEAN DomainControllerServicesChanged = FALSE; 
    BOOLEAN ProductTypeChanged              = FALSE;


    RtlZeroMemory(&BackupDomainPolicyInfo, sizeof(BackupDomainPolicyInfo));

    //
    // Set our event to indicate we're starting
    //
    NtSetEvent( DsRolepCurrentOperationHandle.CompletionEvent, NULL );

    //
    // Get the account name
    //
    if ( GetComputerName( LocalMachineAccountName, &Length ) == FALSE ) {

        WinError = GetLastError();

        DsRolepLogPrint(( DEB_ERROR, "Failed to get computer name (%d)\n", WinError ));

        goto PromoteUndo;

    } else {

        wcscat( LocalMachineAccountName, L"$" );
    }

    //
    // Strip the trailing '.' from the Dns name if we happen to have an absolute name
    //
    DSROLEP_MAKE_DNS_RELATIVE( PromoteArgs->DnsDomainName );

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    if (PromoteArgs->Server) {

        if ( FLAG_ON( PromoteArgs->Options, DSROLE_DC_FORCE_TIME_SYNC ) ) {

        
            WinError = DsRolepForceTimeSync( PromoteArgs->ImpersonateToken,
                                             PromoteArgs->Server );
    
            if ( ERROR_SUCCESS != WinError ) {
    
                // the machine object was moved
               DsRolepLogPrint(( DEB_WARN, "Time sync with %ws failed with %d\n",
                                 PromoteArgs->Server,
                                 WinError ));
    
               WinError = ERROR_SUCCESS;
    
            }
        
        }
    
        DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );


        //
        // Start a connection to the ReplicaServer
        //
        RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
        WinError = ImpNetpManageIPCConnect( PromoteArgs->ImpersonateToken,
                                            PromoteArgs->Server,
                                            PromoteArgs->Account,
                                            PromoteArgs->Password.Buffer,
                                            NETSETUPP_CONNECT_IPC );
    
        RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );
        if ( WinError != ERROR_SUCCESS ) {
            
            DSROLEP_FAIL1( WinError, DSROLERES_NET_USE, PromoteArgs->Server );
            DsRolepLogPrint(( DEB_ERROR,
                              "Failed to establish the session with %ws: 0x%lx\n", PromoteArgs->Server,
                              WinError ));
    
            goto PromoteUndo;
    
        }

        ReplicaServer = PromoteArgs->Server;

        IPCConnection = TRUE;

    }

    //
    // Find the server that holds the machine account for this machine
    //
    FindOptions = DS_DIRECTORY_SERVICE_REQUIRED | DS_WRITABLE_REQUIRED | DS_FORCE_REDISCOVERY |
                  DS_RETURN_DNS_NAME;
    WinError = ImpDsRolepDsGetDcForAccount( PromoteArgs->ImpersonateToken,
                                            PromoteArgs->Server,
                                            PromoteArgs->DnsDomainName,
                                            LocalMachineAccountName,
                                            FindOptions,
                                            UF_WORKSTATION_TRUST_ACCOUNT |
                                               UF_SERVER_TRUST_ACCOUNT,
                                            &DomainControllerInfo );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to get domain controller for account %ws (%d)\n", LocalMachineAccountName, WinError ));

        DSROLEP_FAIL1( WinError, DSROLERES_FIND_DC, PromoteArgs->DnsDomainName );

        goto PromoteUndo;
        
    }

    //
    // Determine source server
    //
    if ( NULL == PromoteArgs->Server ) {

        //
        // No server was passed -- use the result of the dsgetdc
        //
        ReplicaServer = DomainControllerInfo->DomainControllerName;

    } else {

        ReplicaServer = PromoteArgs->Server;

        if ( !DnsNameCompare_W(*(PromoteArgs->Server)==L'\\'?(PromoteArgs->Server)+2:PromoteArgs->Server,
                               *(DomainControllerInfo->DomainControllerName)==L'\\'?(DomainControllerInfo->DomainControllerName)+2:DomainControllerInfo->DomainControllerName ) ) {

            WinError = ERROR_DS_UNWILLING_TO_PERFORM;

            DsRolepLogPrint(( DEB_ERROR, "DsGetDcForAccount Failed to get the requested domain controller %ws for account %ws (%d)\n",
                              PromoteArgs->Server,
                              LocalMachineAccountName,
                              WinError));

            DSROLEP_FAIL3( WinError, 
                           DSROLERES_FAILED_FIND_REQUESTED_DC, 
                           PromoteArgs->Server,
                           LocalMachineAccountName,
                           DomainControllerInfo->DomainControllerName );

            goto PromoteUndo;
        
        }

    }

    //
    // Determine destination site
    //
    if ( PromoteArgs->SiteName == NULL ) {

        PromoteArgs->SiteName = DomainControllerInfo->ClientSiteName;

        
        if ( PromoteArgs->SiteName == NULL ) {

            PromoteArgs->SiteName = DomainControllerInfo->DcSiteName;

        }
    }

    DSROLEP_CURRENT_OP2( DSROLEEVT_FOUND_SITE,
                         PromoteArgs->SiteName,
                         ReplicaServer );


    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    if (!IPCConnection) {

        //
        // Force the time synch
        //
        DsRolepLogPrint(( DEB_TRACE, "Forcing time sync\n"));
    
        if ( FLAG_ON( PromoteArgs->Options, DSROLE_DC_FORCE_TIME_SYNC ) ) {
    
            
            WinError = DsRolepForceTimeSync( PromoteArgs->ImpersonateToken,
                                             ReplicaServer );
    
            if ( ERROR_SUCCESS != WinError ) {
    
                // the machine object was moved
               DsRolepLogPrint(( DEB_WARN, "Time sync with %ws failed with %d\n",
                                 ReplicaServer,
                                 WinError ));
    
               WinError = ERROR_SUCCESS;
    
            }
        
        }
    
        DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    
        //
        // Attempt to start a RDR connection because we will need one later on
        //
        
        RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
        WinError = ImpNetpManageIPCConnect( PromoteArgs->ImpersonateToken,
                                            ReplicaServer,
                                            PromoteArgs->Account,
                                            PromoteArgs->Password.Buffer,
                                            NETSETUPP_CONNECT_IPC );
    
        RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );
        if ( WinError != ERROR_SUCCESS ) {
            
            DSROLEP_FAIL1( WinError, DSROLERES_NET_USE, ReplicaServer );
            DsRolepLogPrint(( DEB_ERROR,
                              "Failed to establish the session with %ws: 0x%lx\n", ReplicaServer,
                              WinError ));
    
            goto PromoteUndo;
    
        }
        IPCConnection = TRUE;
    }


    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Stop netlogon
    //
    DSROLEP_CURRENT_OP1( DSROLEEVT_STOP_SERVICE, SERVICE_NETLOGON );

    WinError = DsRolepStopNetlogon( &RestartNetlogon );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to stop NETLOGON (%d)\n", WinError ));

        goto PromoteUndo;
        
    }

    DsRolepLogPrint(( DEB_TRACE, "Stopped NETLOGON\n" ));

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Create the system volume information
    //
    RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
    WinError = DsRolepCreateSysVolPath( PromoteArgs->SysVolRootPath,
                                        PromoteArgs->DnsDomainName,
                                        ReplicaServer,
                                        PromoteArgs->Account,
                                        PromoteArgs->Password.Buffer,
                                        PromoteArgs->SiteName,
                                        FALSE );
    RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to create system volume path (%d)\n", WinError ));
        goto PromoteUndo;
        
    }

    DsRolepLogPrint(( DEB_TRACE, "Created system volume path\n" ));

    SysVolCreated = TRUE;

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Setup the Ds
    //
    RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->DomainAdminPassword );
    RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
    RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->SafeModePassword );
    WinError = DsRolepInstallDs( PromoteArgs->DnsDomainName,
                                 PromoteArgs->FlatDomainName,
                                 NULL,    // DnsTreeRoot not used for replica installs
                                 PromoteArgs->SiteName,
                                 PromoteArgs->DsDatabasePath,
                                 PromoteArgs->DsLogPath,
                                 PromoteArgs->RestorePath,
                                 PromoteArgs->SysVolRootPath,
                                 &(PromoteArgs->Bootkey),
                                 PromoteArgs->DomainAdminPassword.Buffer,
                                 PromoteArgs->Parent,
                                 ReplicaServer,
                                 PromoteArgs->Account,
                                 PromoteArgs->Password.Buffer,
                                 PromoteArgs->SafeModePassword.Buffer,
                                 PromoteArgs->DnsDomainName,
                                 PromoteArgs->Options,
                                 TRUE,
                                 PromoteArgs->ImpersonateToken,
                                 &InstalledSite,
                                 &DomainGuid,
                                 &NewDomainSid );
    RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );
    RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->DomainAdminPassword );
    RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->SafeModePassword );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to install to Directory Service (%d)\n", WinError ));
        goto PromoteUndo;
        
    }
    DsRunning = TRUE;
    DsInstalled = TRUE;

    DsRolepLogPrint(( DEB_TRACE, "Installed Directory Service\n" ));


    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Set the lsa domain information to reflect the new security database
    // that was brought in.  The Set below does not set the DnsDomainInformation,
    // since the flat name is not yet known.  The DnsDomainInformation gets
    // set by the DsRolepSetLsaInformationForReplica call following.
    //
    WinError = DsRolepBackupDomainPolicyInfo( NULL, &BackupDomainPolicyInfo );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to make backup of LSA policy (%d)\n", WinError ));

        DSROLEP_FAIL0( WinError, DSROLERES_POLICY_READ_LOCAL );
        goto PromoteUndo;
        
    }

    WinError = DsRolepSetLsaDomainPolicyInfo( PromoteArgs->DnsDomainName,
                                              PromoteArgs->FlatDomainName,
                                              NULL,
                                              &DomainGuid,
                                              NewDomainSid,
                                              NTDS_INSTALL_REPLICA,
                                              &BackupDomainPolicyInfo );
    if ( ERROR_SUCCESS != WinError  ) {
        
        DSROLEP_FAIL0( WinError, DSROLERES_POLICY_WRITE_LOCAL );
        goto PromoteUndo;

    }
    DomainPolicyInfoChanged = TRUE;

    DsRolepLogPrint(( DEB_TRACE, "Wrote the LSA policy information for the local machine\n" ));


    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // This extra call is necessary to get the dns tree information
    //
    RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
    WinError = DsRolepSetLsaInformationForReplica( PromoteArgs->ImpersonateToken,
                                                   ReplicaServer,
                                                   PromoteArgs->Account,
                                                   PromoteArgs->Password.Buffer );
    RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );
    if ( ERROR_SUCCESS != WinError ) {
        
        DSROLEP_FAIL1( WinError, DSROLERES_POLICY_READ_REMOTE, ReplicaServer );
        goto PromoteUndo;
    }

    DsRolepLogPrint(( DEB_TRACE, "Read the LSA policy information from %ws\n", 
                      ReplicaServer ));

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Configure the services for a domain controller
    //
    WinError = DsRolepConfigureDomainControllerServices( DSROLEP_SERVICES_ON );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to configure domain controller services (%d)\n", WinError ));
        
        goto PromoteUndo;
    }
    DomainControllerServicesChanged = TRUE;

    DsRolepLogPrint(( DEB_TRACE, "Configured domain controller services\n" ));

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, PromoteUndo );

    //
    // Set the computers Dns domain name
    //
    DSROLEP_CURRENT_OP1( DSROLEEVT_SET_COMPUTER_DNS, PromoteArgs->DnsDomainName );
    WinError = NetpSetDnsComputerNameAsRequired( PromoteArgs->DnsDomainName );
    if ( ERROR_SUCCESS != WinError ) {
        
        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_TRACE,
                                               "NetpSetDnsComputerNameAsRequired to %ws failed with %lu\n",
                                               PromoteArgs->DnsDomainName,
                                               WinError )) );
        DSROLEP_FAIL1( WinError, DSROLERES_SET_COMPUTER_DNS, PromoteArgs->DnsDomainName );
        goto PromoteUndo;
    }

    DsRolepLogPrint(( DEB_TRACE, "Set the computer's Dns domain name to %ws.\n",
                      PromoteArgs->DnsDomainName ));

    //
    // Complete the sysvol replication
    //
    if ( SysVolCreated ) {

        WinError = DsRolepFinishSysVolPropagation( TRUE, TRUE );
        if ( ERROR_SUCCESS != WinError ) {

            DsRolepLogPrint(( DEB_ERROR, "Failed to complete system volume replication (%d)\n", WinError ));

            goto PromoteUndo;
            
        }

        DsRolepLogPrint(( DEB_TRACE, "Completed system volume replication\n" ));
    }
    
    //
    // Set the machine role
    //
    WinError = DsRolepSetProductType( DSROLEP_MT_MEMBER );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to set the product type (%d)\n", WinError ));

        goto PromoteUndo;
    }
    DsRolepLogPrint(( DEB_TRACE, "Set the product type\n" ));

    ProductTypeChanged = TRUE;

    //
    // Save off the new site name
    //
    WinError = DsRolepSetOperationHandleSiteName( InstalledSite );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to set the operation handle(%d)\n", WinError ));
        goto PromoteUndo;
        
    }

    //
    // If we update it, NULL out the local parameter so we don't attempt to delete it
    //
    InstalledSite = NULL;


    //
    // Next, set the sysvol path for netlogon
    //
    WinError = DsRolepSetNetlogonSysVolPath( PromoteArgs->SysVolRootPath,
                                             PromoteArgs->DnsDomainName,
                                             FALSE,
                                             NULL );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to set the system volume path for NETLOGON (%d)\n", WinError ));
        goto PromoteUndo;
        
    }

    DsRolepLogPrint(( DEB_TRACE, "Set the system volume path for NETLOGON\n" ));

    //
    // Finally, set the security on the dc files
    //
    WinError = DsRolepSetDcSecurity( PromoteArgs->ImpersonateToken,
                                     PromoteArgs->SysVolRootPath,
                                     PromoteArgs->DsDatabasePath,
                                     PromoteArgs->DsLogPath,
                                     ( BOOLEAN )FLAG_ON( PromoteArgs->Options,
                                                                 DSROLE_DC_DOWNLEVEL_UPGRADE ),
                                     TRUE );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to set security for the domain controller (%d)\n", WinError ));
        goto PromoteUndo;
        
    }

    DsRolepLogPrint(( DEB_TRACE, "Set security for the domain controller\n" ));


    //
    // We have done all operations for the promotion; now continue replicating
    // ds information until done, or cancelled
    //
    DsRolepLogPrint(( DEB_TRACE, "Replicating non critical information\n" ));

    DsRolepSetCriticalOperationsDone();

    if ( !FLAG_ON( PromoteArgs->Options, DSROLE_DC_CRITICAL_REPLICATION_ONLY ) ) {

        //in the Install From Media case we do not want to do a full sync of the
        //Non-Critical objects
        if ((PromoteArgs->RestorePath != NULL)) {
            WinError = (*DsrNtdsInstallReplicateFull) ( DsRolepStringUpdateCallback, PromoteArgs->ImpersonateToken, NTDS_IFM_PROMOTION );
        } else {
            WinError = (*DsrNtdsInstallReplicateFull) ( DsRolepStringUpdateCallback, PromoteArgs->ImpersonateToken, 0 );
        }
    
        if ( WinError != ERROR_SUCCESS ) {
    
            //
            // Error code doesn't matter, but we'll log it anyway
            //
            DsRolepLogOnFailure( WinError,
                                 DsRolepLogPrint(( DEB_WARN,
                                                  "Non critical replication returned %lu\n", WinError )) );
        
            if (ERROR_SUCCESS == WinError) {
                DsRolepLogPrint(( DEB_TRACE, "Replicating non critical information (Complete)\n" ));
            }
            if ( ERROR_SUCCESS != WinError ) {
        
                DSROLEP_SET_NON_CRIT_REPL_ERROR();
            }
    
            WinError = ERROR_SUCCESS;
            
        }
        
    } else {

        DsRolepLogPrint(( DEB_TRACE, "User specified to not replicate non-critical data\n" ));

    }


    //
    // Indicate that we are no longer doing upgrades, if applicable
    //
    if ( FLAG_ON( PromoteArgs->Options, DSROLE_DC_DOWNLEVEL_UPGRADE ) ) {

        WinError = DsRolepDeleteUpgradeInfo();

        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to remove upgrade information (%d)\n",
                                               WinError )) );
        // This error isn't interesting to propogate
        WinError = ERROR_SUCCESS;

    }

    //
    // Remove any old netlogon stuff if we got that far
    //
    WinError = DsRolepCleanupOldNetlogonInformation();

    if ( (FLAG_ON( PromoteArgs->Options, DSROLE_DC_DOWNLEVEL_UPGRADE )) && ERROR_SUCCESS != WinError ) {

        if (ERROR_SUCCESS == WinError) {
            DsRolepLogPrint(( DEB_TRACE, "Removed any old netlogon information\n" ));
        }

        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to clean up old netlogon information (%d)\n",
                                                WinError )) );

    }

    WinError = ERROR_SUCCESS;


    //
    // Set the default logon domain to the current domain name
    //

    //
    // We'll have to get it from the backed up policy information, since it isn't actually
    // passed in
    //
    WinError = DsRolepSetLogonDomain(
                   ( PWSTR )BackupDomainPolicyInfo.DnsDomainInfo->Name.Buffer,
                   FALSE );
    if ( ERROR_SUCCESS != WinError ) {

        PWCHAR bufDnsDomainInfo = NULL;

        bufDnsDomainInfo = (WCHAR*)malloc(BackupDomainPolicyInfo.DnsDomainInfo->Name.Length+1);

        if (bufDnsDomainInfo) {
            CopyMemory(bufDnsDomainInfo,
                       BackupDomainPolicyInfo.DnsDomainInfo->Name.Buffer,
                       BackupDomainPolicyInfo.DnsDomainInfo->Name.Length);
            bufDnsDomainInfo[BackupDomainPolicyInfo.DnsDomainInfo->Name.Length/sizeof(WCHAR)] = L'\0';
        
        
            DsRolepLogOnFailure( WinError,
                                 DsRolepLogPrint(( DEB_WARN,
                                                   "Failed to set default logon domain to %ws (%d)\n",
                                                    bufDnsDomainInfo,
                                                    WinError )) );
    
            if (ERROR_SUCCESS == WinError) {
                DsRolepLogPrint(( DEB_TRACE, "Set default logon domain to %ws\n",
                                              bufDnsDomainInfo ));
            }

            free(bufDnsDomainInfo);

        }

        //
        // This is not worth failing for
        //
        WinError = ERROR_SUCCESS;

    }

    //
    // Stop the ds
    //
    DsRolepStopDs( DsRunning );
    DsRunning = FALSE;

    DsRolepLogPrint(( DEB_TRACE, "Stopped the DS\n" ));

    //
    // Notify the time server we have completed the promotion
    //
    (*DsrW32TimeDcPromo)( W32TIME_PROMOTE );

    
    //
    // Set Netlogon registry key during DCPromo to ensure that kerberos is talking 
    // to a DC w/ new User AccountControl flag
    //
    IgnoreError = NetpStoreIntialDcRecord(DomainControllerInfo);
    if ( IgnoreError != ERROR_SUCCESS ) {

        DsRolepLogPrint(( DEB_WARN,
                         "Failed to set Netlogon registry key during DCPromo %ws\r\n",
                         IgnoreError ));
    }

    //
    // At this point we have succeeded the promotion
    //
    ASSERT( ERROR_SUCCESS == WinError );


PromoteExit:


    //
    // Released acquired resources
    //
    if ( IPCConnection ) {

        RtlRunDecodeUnicodeString( PromoteArgs->Decode, &PromoteArgs->Password );
        IgnoreError = ImpNetpManageIPCConnect( PromoteArgs->ImpersonateToken,
                                               ReplicaServer,
                                               PromoteArgs->Account,
                                               PromoteArgs->Password.Buffer,
                                              (NETSETUPP_DISCONNECT_IPC | NETSETUPP_USE_LOTS_FORCE ) );
        RtlRunEncodeUnicodeString( &PromoteArgs->Decode, &PromoteArgs->Password );
        if ( IgnoreError != ERROR_SUCCESS ) {

            DsRolepLogPrint(( DEB_ERROR,
                             "Failed to destroy the session with %ws: 0x%lx\n", ReplicaServer,
                             IgnoreError ));
        }
        IPCConnection = FALSE;
    }


    if ( DomainControllerInfo != NULL ) {

        if ( PromoteArgs->SiteName == DomainControllerInfo->ClientSiteName ||
             PromoteArgs->SiteName == DomainControllerInfo->DcSiteName ) {

            PromoteArgs->SiteName = NULL;
        }

        NetApiBufferFree( DomainControllerInfo );

    }

    RtlFreeHeap( RtlProcessHeap(), 0, InstalledSite );
    RtlFreeHeap( RtlProcessHeap(), 0, NewDomainSid );

    DsRolepFreeDomainPolicyInfo(&BackupDomainPolicyInfo);
    //
    // Reset our operation handle
    //
    DsRolepSetOperationDone( DSROLEP_OP_PROMOTION, WinError );

    DsRolepFreeArgumentBlock( &ArgumentBlock, TRUE );

    ExitThread( WinError );
    return( WinError );

PromoteUndo:

    //
    // Something must have failed to have gotten us here
    //
    ASSERT( ERROR_SUCCESS != WinError );

    if ( ProductTypeChanged ) {

        IgnoreError = DsRolepSetProductType( DSROLEP_MT_STANDALONE );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback product type (%d)\n",
                                                IgnoreError )) );

        ProductTypeChanged = FALSE;
    }

    if ( DomainControllerServicesChanged ) {

        IgnoreError = DsRolepConfigureDomainControllerServices( DSROLEP_SERVICES_REVERT );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback domain controller services configuration (%d)\n",
                                                IgnoreError )) );

        DomainControllerServicesChanged = FALSE;
    }

    if ( DomainPolicyInfoChanged ) {

        IgnoreError = DsRolepRestoreDomainPolicyInfo(&BackupDomainPolicyInfo);

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to restore domain policy information (%d)\n",
                                                IgnoreError )) );
        DomainPolicyInfoChanged = FALSE;
    }

    if ( DsRunning ) {
        
        IgnoreError = DsRolepStopDs( DsRunning );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to stop the directory service (%d)\n",
                                                IgnoreError )) );
        DsRunning = FALSE;
    }

    if ( DsInstalled ) {

        IgnoreError = DsRolepUninstallDs( );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to undo the directory service installation (%d)\n",
                                                IgnoreError )) );
        DsInstalled = FALSE;
    }

    if ( SysVolCreated ) {

        IgnoreError = DsRolepFinishSysVolPropagation( FALSE, TRUE );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to abort system volume installation (%d)\n",
                                                IgnoreError )) );

        IgnoreError = DsRolepRemoveSysVolPath( PromoteArgs->SysVolRootPath,
                                               PromoteArgs->DnsDomainName,
                                               &DomainGuid );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to remove system volume path (%d)\n",
                                                IgnoreError )) );

        SysVolCreated = FALSE;

    }

    if ( RestartNetlogon ) {

        IgnoreError = DsRolepStartNetlogon();

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to restart NETLOGON (%d)\n",
                                                IgnoreError )) );
        RestartNetlogon = FALSE;
    }

    //
    // That's it -- terminate the operation
    // 

    ASSERT( ERROR_SUCCESS != WinError );

    goto PromoteExit;

}



DWORD
DsRolepThreadDemote(
    IN PVOID ArgumentBlock
    )
/*++

Routine Description:

    This function actually "demotes" a dc to standalone or member server.  This is
    accomplished by:
        Uninstalling the Ds
        Configuring the KDC
        Changing the product type
        Removing the system volume tree

    Required is the new server role

Arguments:

    ArgumentBlock - Block of arguments appropriate for the operation


Returns:

    ERROR_SUCCESS - Success

    ERROR_NO_SUCH_DOMAIN - The local domain information could not be located

    ERROR_NOT_ENOUGH_MEMORY - A memory allocation failed

    ERROR_DS_CANT_ON_NON_LEAF - The domain is not a leaf domain

--*/
{
    DWORD WinError = ERROR_SUCCESS, IgnoreError;
    NET_API_STATUS NetStatus = ERROR_SUCCESS;
    PDOMAIN_CONTROLLER_INFO DomainControllerInfo = NULL;
    PDSROLEP_OPERATION_DEMOTE_ARGS DemoteArgs = ( PDSROLEP_OPERATION_DEMOTE_ARGS )ArgumentBlock;
    DSROLEP_DOMAIN_POLICY_INFO BackupDomainPolicyInfo;
    PPOLICY_DNS_DOMAIN_INFO DnsDomainInfo = NULL;
    HANDLE Policy = NULL;
    NTSTATUS Status;
    PWSTR ParentDomainName = NULL, CurrentDomain = NULL, SupportDc = NULL;
    PWSTR SupportDomain = NULL;
    OBJECT_ATTRIBUTES ObjectAttributes;

    ULONG ServicesOffFlags = DSROLEP_SERVICES_OFF | DSROLEP_SERVICES_STOP;
    ULONG ServicesOnFlags = DSROLEP_SERVICES_REVERT;

    PNTDS_DNS_RR_INFO pDnsRRInfo = NULL;

    ULONG Flags = 0;
    PSEC_WINNT_AUTH_IDENTITY Credentials = NULL;

    //
    // BOOLEAN's to maintain state
    //
    // N.B. The order of these booleans is the order in which they
    //      are changed -- please maintain order and make sure that
    //      the DemoteUndo section undoes them in the reverse order
    //
    BOOLEAN IPCConnection                   = FALSE;  // resource -- release on exit
    BOOLEAN DsPrepareDemote                 = FALSE;
    BOOLEAN FrsDemote                       = FALSE;
    BOOLEAN NotifiedNetlogonToDeregister    = FALSE;
    BOOLEAN RestartNetlogon                 = FALSE;
    BOOLEAN DomainControllerServicesChanged = FALSE; 
    BOOLEAN DomainServicesChanged           = FALSE; 
    BOOLEAN Unrollable                      = FALSE;  // at this point, don't
                                                      // try to rollback
    //
    // Set our event to indicate we're starting
    //
    NtSetEvent( DsRolepCurrentOperationHandle.CompletionEvent, NULL );


    //
    // Get the current domain information, potentially the parent Domain and see if
    // we are valid to be demoted
    //
    DSROLEP_CURRENT_OP0( DSROLEEVT_LOCAL_POLICY );

    RtlZeroMemory( &ObjectAttributes, sizeof( ObjectAttributes ) );
    Status = LsaOpenPolicy( NULL,
                            &ObjectAttributes,
                            POLICY_VIEW_LOCAL_INFORMATION,
                            &Policy );

    if ( NT_SUCCESS( Status ) ) {

        Status = LsaQueryInformationPolicy( Policy,
                                            PolicyDnsDomainInformation,
                                            &DnsDomainInfo );

    }

    if ( !NT_SUCCESS( Status ) ) {

        WinError = RtlNtStatusToDosError( Status );
        DSROLEP_FAIL0( WinError, DSROLERES_POLICY_READ_LOCAL );
        goto DemoteUndo;
    }

    if ( DemoteArgs->DomainName == NULL ) {

        CurrentDomain = DnsDomainInfo->DnsDomainName.Buffer;

    } else {

        //
        // Strip the trailing '.' from the Dns name if we happen to have an absolute name
        //
        DSROLEP_MAKE_DNS_RELATIVE( DemoteArgs->DomainName );

        CurrentDomain = DemoteArgs->DomainName;
    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, DemoteUndo );

    //
    // Determine whether it is legal to demote this domain.  Also, get the parent Dns domain name
    //
    if ( DemoteArgs->LastDcInDomain ) {

        PLSAPR_FOREST_TRUST_INFO ForestTrustInfo = NULL;
        PLSAPR_TREE_TRUST_INFO OwnEntry = NULL, ParentEntry = NULL;

        Status = LsaIQueryForestTrustInfo( Policy,
                                           &ForestTrustInfo );
        WinError = RtlNtStatusToDosError( Status );

        if ( WinError == ERROR_SUCCESS ) {

            //
            // Check the root
            //
            if ( RtlCompareUnicodeString(
                    ( PUNICODE_STRING )&ForestTrustInfo->RootTrust.DnsDomainName,
                    &DnsDomainInfo->DnsDomainName,
                    TRUE ) == 0  ) {

                OwnEntry = &ForestTrustInfo->RootTrust;
                ParentEntry = NULL;

            } else {

                //
                // Find our own entry in the list and our parent...
                //
                DsRolepFindSelfAndParentInForest( ForestTrustInfo,
                                                  &ForestTrustInfo->RootTrust,
                                                  &DnsDomainInfo->DnsDomainName,
                                                  &ParentEntry,
                                                  &OwnEntry );
            }

            if ( OwnEntry == NULL ) {

                WinError = ERROR_NO_SUCH_DOMAIN;

            } else {

                //
                // If we have children, it's an error
                //
                if ( OwnEntry->Children != 0 ) {

                    WCHAR *BufOwnEntry = NULL;
                    DsRolepUnicodestringtowstr( BufOwnEntry, OwnEntry->DnsDomainName )
                    if (BufOwnEntry) {
                      DsRolepLogPrint(( DEB_TRACE,
                                      "We ( %ws ) think we have %lu children\n",
                                      BufOwnEntry,
                                      OwnEntry->Children ));
                      free(BufOwnEntry);
                    } else {
                      DsRolepLogPrint(( DEB_TRACE,
                                      "We think we have %lu children: Can display string ERROR_NOT_ENOUGH_MEMORY\n",
                                      OwnEntry->Children ));
                    }

                    WinError = ERROR_DS_CANT_ON_NON_LEAF;
                }

                //
                // Copy off our parent information
                //
                if ( WinError == ERROR_SUCCESS && ParentEntry != NULL ) {

                    WCHAR *BufOwnEntry = NULL;
                    DsRolepUnicodestringtowstr( BufOwnEntry, OwnEntry->DnsDomainName )
                    if (BufOwnEntry) {
                      DsRolepLogPrint((DEB_TRACE,
                                      "Domain %ws is our parent parent\n",
                                      BufOwnEntry));
                      free(BufOwnEntry);
                    } else {
                      DsRolepLogPrint(( DEB_TRACE,
                                      "Domain (?) is our parent parent: Can display domain string ERROR_NOT_ENOUGH_MEMORY\n"));
                    }

                    ParentDomainName = RtlAllocateHeap(
                                  RtlProcessHeap(), 0,
                                  ParentEntry->DnsDomainName.Length + sizeof( WCHAR ) );
                    if ( ParentDomainName == NULL ) {

                        WinError = ERROR_NOT_ENOUGH_MEMORY;

                    } else {

                        RtlCopyMemory( ParentDomainName,
                                       ParentEntry->DnsDomainName.Buffer,
                                       ParentEntry->DnsDomainName.Length );
                        ParentDomainName[
                            ParentEntry->DnsDomainName.Length / sizeof( WCHAR ) ] = UNICODE_NULL;
                    }
                }

            }
        }

        LsaIFreeForestTrustInfo( ForestTrustInfo );

        if ( ERROR_SUCCESS != WinError ) {

            DSROLEP_FAIL1( WinError, DSROLERES_LEAF_DOMAIN, CurrentDomain );
            goto DemoteUndo;
        }

    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, DemoteUndo );


    //
    // Locate a Dc to help with the demotion
    //
    if ( DemoteArgs->LastDcInDomain ) {

        SupportDomain = ParentDomainName;

    } else {

        SupportDomain = CurrentDomain;
    }

    //
    // If this is the last domain in the enterprise, there will be no
    // parent domain and possibly no replicas to assist.
    //
    // Note: netlogon is still running, so use the avoid self flag
    //
    if ( SupportDomain ) {

        DSROLEP_CURRENT_OP1( DSROLEEVT_SEARCH_DC, SupportDomain  );

        if ( !DemoteArgs->LastDcInDomain )
        {
            //
            // Demoting a replica - find someone with our machine account
            //
            ULONG FindOptions = DS_DIRECTORY_SERVICE_REQUIRED | 
                                DS_WRITABLE_REQUIRED | 
                                DS_FORCE_REDISCOVERY | 
                                DS_AVOID_SELF;

            WCHAR LocalMachineAccountName[ MAX_COMPUTERNAME_LENGTH + 2 ];
            ULONG Length = sizeof(LocalMachineAccountName) / sizeof(LocalMachineAccountName[0]);

            //
            // Get the account name
            //
            if ( GetComputerName( LocalMachineAccountName, &Length ) == FALSE ) {

                WinError = GetLastError();

                DsRolepLogPrint(( DEB_ERROR, "Failed to get computer name (%d)\n", WinError ));

                goto DemoteUndo;
        
            } else {

                wcscat( LocalMachineAccountName, L"$" );
                WinError = DsRolepDsGetDcForAccount( NULL,
                                                     SupportDomain,
                                                     LocalMachineAccountName,
                                                     FindOptions,
                                                     UF_WORKSTATION_TRUST_ACCOUNT |
                                                        UF_SERVER_TRUST_ACCOUNT,
                                                     &DomainControllerInfo );
            }

        } else {

            WinError = DsGetDcName( NULL, SupportDomain, NULL, NULL,
                                    DS_DIRECTORY_SERVICE_REQUIRED |
                                    DS_WRITABLE_REQUIRED |
                                    DS_AVOID_SELF |
                                    DS_FORCE_REDISCOVERY,
                                    &DomainControllerInfo );
        }

        if ( ERROR_SUCCESS != WinError ) {

            DsRolepLogPrint(( DEB_ERROR,
                              "Failed to find a domain controller for %ws: %lu\n",
                              SupportDomain, WinError ));
            
            DSROLEP_FAIL1( WinError, DSROLERES_FIND_DC, SupportDomain );

            goto DemoteUndo;
        }

        SupportDc = DomainControllerInfo->DomainControllerName;
        if ( *SupportDc == L'\\' ) {

            SupportDc += 2;
        }

        DsRolepLogPrint(( DEB_TRACE_DS, "Support Dc in %ws is %ws\n",
                          SupportDomain,
                          SupportDc ));
        DSROLEP_CURRENT_OP2( DSROLEEVT_FOUND_DC,
                             SupportDc,
                             SupportDomain );
    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, DemoteUndo );

    //
    // Attempt to establish a RDR session with our support DC
    // if necessary
    //
    if ( SupportDc ) {
        
        //
        // Impersonate to get logon id of caller
        //
        RtlRunDecodeUnicodeString( DemoteArgs->Decode, &DemoteArgs->Password );
        WinError = ImpNetpManageIPCConnect( DemoteArgs->ImpersonateToken,
                                            SupportDc,
                                            DemoteArgs->Account,
                                            DemoteArgs->Password.Buffer,
                                            NETSETUPP_CONNECT_IPC );
    
        RtlRunEncodeUnicodeString( &DemoteArgs->Decode, &DemoteArgs->Password );
        if ( ERROR_SUCCESS != WinError ) {
    
            DSROLEP_FAIL1( WinError, DSROLERES_NET_USE, SupportDc );
            DsRolepLogPrint(( DEB_ERROR,
                              "Failed to establish the session with %ws: 0x%lx\n", SupportDc,
                              WinError ));
            goto DemoteUndo;
    
        }
        IPCConnection = TRUE;
    }


    //
    // Prepare the ds for demotion
    //

    DSROLE_GET_SETUP_FUNC( WinError, DsrNtdsPrepareForDemotion );
    ASSERT( ERROR_SUCCESS == WinError );

    RtlRunDecodeUnicodeString( DemoteArgs->Decode, &DemoteArgs->Password );

    WinError = DsRolepCreateAuthIdentForCreds(DemoteArgs->Account,
                                              DemoteArgs->Password.Buffer,
                                              &Credentials);

    if ( ERROR_SUCCESS == WinError ) {

        if ( DemoteArgs->LastDcInDomain ) {
    
            Flags |= NTDS_LAST_DC_IN_DOMAIN;
        }
    
        Flags |= DsRolepDemoteFlagsToNtdsFlags( DemoteArgs->Options );
    
        DSROLEP_CURRENT_OP0( DSROLEEVT_PREPARE_DEMOTION );
        WinError = ( *DsrNtdsPrepareForDemotion ) ( Flags,
                                                    SupportDc,
                                                    Credentials,
                                                    DsRolepStringUpdateCallback,
                                                    DsRolepStringErrorUpdateCallback,
                                                    DemoteArgs->ImpersonateToken,
                                                    &pDnsRRInfo );

    
        RtlRunEncodeUnicodeString( &DemoteArgs->Decode, &DemoteArgs->Password );


        if ( ERROR_SUCCESS != WinError ) {

            DsRolepLogPrint(( DEB_ERROR, "Failed to prepare the Directory Service for uninstallation (%d)\n", WinError ));

            goto DemoteUndo;
            
        }
        DsPrepareDemote = TRUE;

    } else {

        DsRolepLogPrint(( DEB_ERROR, "Failed to create authentication credentials (%d)\n", WinError ));

        goto DemoteUndo;
    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, DemoteUndo );

    //
    // Start the sysvol demotions
    //
    RtlRunDecodeUnicodeString( DemoteArgs->Decode, &DemoteArgs->Password );

    WinError = ( *DsrNtFrsApi_PrepareForDemotionUsingCredW ) ( Credentials,
                                                               DemoteArgs->ImpersonateToken,
                                                              DsRolepStringErrorUpdateCallback );


    RtlRunEncodeUnicodeString( &DemoteArgs->Decode, &DemoteArgs->Password );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR, "Failed to get computer name (%d)\n", WinError ));
        DSROLEP_FAIL0( WinError, DSROLERES_SYSVOL_DEMOTION );
        goto DemoteUndo;
        
    }

    WinError = ( *DsrNtFrsApi_StartDemotionW )( CurrentDomain,
                                                DsRolepStringErrorUpdateCallback );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR,
                          "Failed to start system volume demotion on domain (%d)\n",
                          WinError ));

        DSROLEP_FAIL0( WinError, DSROLERES_SYSVOL_DEMOTION );
        goto DemoteUndo;
        
    }
    // At this point we have signalled one frs replica set to be demote so
    // we must wait on it
    FrsDemote = TRUE;

    WinError = ( *DsrNtFrsApi_StartDemotionW )( L"ENTERPRISE",
                                                DsRolepStringErrorUpdateCallback );

    if ( WinError != ERROR_SUCCESS ) {

        DsRolepLogPrint(( DEB_ERROR,
                          "Failed to start system volume demotion on enterprise (%d)\n",
                          WinError ));

        DSROLEP_FAIL0( WinError, DSROLERES_SYSVOL_DEMOTION );
        goto DemoteUndo;

    }

    DsRolepLogPrint(( DEB_TRACE,
                      "Started system volume demotion on enterprise\n" ));


    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, DemoteUndo );

    //
    // Note that if a failure occurs after we uninstall the Ds, than we will not attempt to
    // reinstall it, since we don't have enough information to do so.  In that case, the machine
    // will be in a somewhat inconsistent state.  However, some errors are acceptable:
    //
    //   Failure to delete the trusted domain object - Continuable
    //   Stoping the KDC - Continuable
    //
    //
    // Also, note that "uninstalling the DS" also sets the LSA account domain
    // sid and the server role so no errors should be returned to the caller
    // after uninstalling the DS. The machine will become the new role on the
    // next reboot.
    //

    WinError = DsRolepBackupDomainPolicyInfo( NULL, &BackupDomainPolicyInfo );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR,
                          "Failed to backup LSA domain policy (%d)\n",
                          WinError ));

        DSROLEP_FAIL0( WinError, DSROLERES_POLICY_READ_LOCAL );
        goto DemoteUndo;
    }

    DsRolepLogPrint(( DEB_TRACE,
                      "Read the LSA policy information from the local machine\n" ));

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, DemoteUndo );


    //
    // Set netlogon we are demoting so it will deregister the DNS records
    //
    Status = I_NetNotifyDsChange( NlDcDemotionInProgress );
    if ( !NT_SUCCESS( Status ) ) {

        WinError = RtlNtStatusToDosError( Status );
        
        DsRolepLogPrint(( DEB_ERROR,
                          "Failed to tell NETLOGON to deregister records (%d)\n",
                          WinError ));
        goto DemoteUndo;
    }

    DsRolepLogPrint(( DEB_TRACE,
                      "Informed NETLOGON to deregister records\n" ));

    NotifiedNetlogonToDeregister = TRUE;

    //
    // Stop netlogon
    //
    WinError = DsRolepStopNetlogon( &RestartNetlogon );
    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR,
                          "Failed to stop NETLOGON (%d)\n",
                          WinError ));
        goto DemoteUndo;
    }

    DsRolepLogPrint(( DEB_TRACE,
                      "Stopped NETLOGON\n" ));

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, DemoteUndo );

    //
    // Disable the domain controller services
    //
    WinError  = DsRolepConfigureDomainControllerServices( ServicesOffFlags );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR,
                          "Failed to configure domain controller services (%d)\n",
                          WinError ));
        goto DemoteUndo;
    }

    DsRolepLogPrint(( DEB_TRACE,
                      "Configured domain controller services\n" ));

    DomainControllerServicesChanged = TRUE;
        
    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, DemoteUndo );

    //
    // Disable the domain related services if necessary
    //
    if ( DemoteArgs->ServerRole == DsRoleServerStandalone ) {

        WinError  = DsRolepConfigureDomainServices( ServicesOffFlags );

        if ( ERROR_SUCCESS != WinError ) {

            DsRolepLogPrint(( DEB_ERROR,
                              "Failed to configure domain services (%d)\n",
                              WinError ));

            goto DemoteUndo;

        }
        DsRolepLogPrint(( DEB_TRACE,
                      "Configured domain services\n" ));

        DomainServicesChanged = TRUE;
    }

    DSROLEP_CHECK_FOR_CANCEL_EX( WinError, DemoteUndo );

    //
    // Remove the Ds
    //
    RtlRunDecodeUnicodeString( DemoteArgs->Decode, &DemoteArgs->Password );
    RtlRunDecodeUnicodeString( DemoteArgs->Decode, &DemoteArgs->AdminPassword );
    WinError = DsRolepDemoteDs( CurrentDomain,
                                DemoteArgs->Account,
                                DemoteArgs->Password.Buffer,
                                DemoteArgs->AdminPassword.Buffer,
                                SupportDc,
                                SupportDomain,
                                DemoteArgs->ImpersonateToken,
                                DemoteArgs->LastDcInDomain );

    RtlRunEncodeUnicodeString( &DemoteArgs->Decode, &DemoteArgs->Password );
    RtlRunEncodeUnicodeString( &DemoteArgs->Decode, &DemoteArgs->AdminPassword );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogPrint(( DEB_ERROR,
                          "Failed to demote the directory service (%d)\n",
                          WinError ));
        goto DemoteUndo;
        
    }

    DsRolepLogPrint(( DEB_TRACE, "This machine is no longer a domain controller\n" ));

    //
    // The operation cannot be cancelled at this point since the ds has
    // been removed from the machine and from the enterprise
    //
    Unrollable = TRUE;

    //
    // Optionally remove the trust with the parent
    //
    if ( DemoteArgs->LastDcInDomain &&
         ParentDomainName != NULL ) {

        //
        // Establish a session first -- should be a no-op since we already
        // have a connection
        //
        RtlRunDecodeUnicodeString( DemoteArgs->Decode, &DemoteArgs->Password );
        WinError = ImpNetpManageIPCConnect( DemoteArgs->ImpersonateToken,
                                            SupportDc,
                                            DemoteArgs->Account,
                                            DemoteArgs->Password.Buffer,
                                            NETSETUPP_CONNECT_IPC );

        RtlRunEncodeUnicodeString( &DemoteArgs->Decode, &DemoteArgs->Password );
        if ( WinError == ERROR_SUCCESS ) {

            WinError = DsRolepDeleteParentTrustObject( DemoteArgs->ImpersonateToken,
                                                       SupportDc,
                                                       DnsDomainInfo );

            if ( WinError != ERROR_SUCCESS ) {

                DsRolepLogOnFailure( WinError,
                                     DsRolepLogPrint(( DEB_WARN,
                                                       "Failed to delete the "
                                                       "trust on %ws: %lu\n",
                                                       SupportDc,
                                                       WinError )) );
                if (ERROR_SUCCESS == WinError) {
                    DsRolepLogPrint(( DEB_TRACE,
                                      "Deleted the trust on %ws\n",
                                       SupportDc ));
                }
            }

        } else {

            // This is not a fatal error
            DsRolepLogPrint(( DEB_WARN,
                              "Failed to establish the session with %ws: 0x%lx\n", SupportDc,
                              WinError ));

        }

        //
        // This error is not fatal
        //
        if ( ERROR_SUCCESS != WinError )
        {

            SpmpReportEvent( TRUE,
                             EVENTLOG_WARNING_TYPE,
                             DSROLERES_FAILED_TO_DELETE_TRUST,
                             0,
                             sizeof( ULONG ),
                             &WinError,
                             1,
                             ParentDomainName );

            DSROLEP_SET_NON_FATAL_ERROR( WinError );

            // Error case is handled

            WinError = ERROR_SUCCESS;
        }
    }

    //
    // Finish our NTFRS demotion
    //
    if ( FrsDemote ) {

        WinError = DsRolepFinishSysVolPropagation( TRUE,
                                                   FALSE );

        if ( ERROR_SUCCESS != WinError ) {

            DsRolepLogOnFailure( WinError,
                                 DsRolepLogPrint(( DEB_TRACE,
                                                   "Failed to finish system volume demotion (%d)\n",
                                                    WinError )) );

            if (ERROR_SUCCESS == WinError) {
                    DsRolepLogPrint(( DEB_TRACE,
                                      "Finished system volume demotion\n" ));
            }
            
        }

        //
        // It is not fatal if the FRS fails at this point
        //
        if ( ERROR_SUCCESS != WinError )
        {
            SpmpReportEvent( TRUE,
                             EVENTLOG_WARNING_TYPE,
                             DSROLERES_FAILED_TO_DEMOTE_FRS,
                             0,
                             sizeof( ULONG ),
                             &WinError,
                             0,
                             NULL );

            DSROLEP_SET_NON_FATAL_ERROR( WinError );

        }

        // Reset status code
        WinError = ERROR_SUCCESS;

    }

    //
    // Call into the SCE so we can be configured to be a server
    //
    WinError = ( *DsrSceDcPromoteSecurityEx )( DemoteArgs->ImpersonateToken,
                                               SCE_PROMOTE_FLAG_DEMOTE,
                                               DsRolepStringUpdateCallback );

    if ( ERROR_SUCCESS != WinError ) {

        DsRolepLogOnFailure( WinError,
                             DsRolepLogPrint(( DEB_ERROR,
                                               "Setting security on server files failed with %lu\n",
                                               WinError )) );

        if (ERROR_SUCCESS == WinError) {
                DsRolepLogPrint(( DEB_TRACE,
                                  "Set security on server files\n" ));
        }

        // This error has been handled
        WinError = ERROR_SUCCESS;
    }

    //
    // remove all trusted root certificates from DC when the machine will dis-join from the enterprise
    //
    if (DemoteArgs->ServerRole == DsRoleServerStandalone) {

        if (!CertAutoRemove(CERT_AUTO_REMOVE_COMMIT)){

            DsRolepLogPrint(( DEB_WARN,
                              "Failed to remove all trusted root certificates from this machine: (%d)\n",
                              GetLastError()));

        }

    } 

    //
    // Notify the time server we have completed the demotion
    //
    (*DsrW32TimeDcPromo)( W32TIME_DEMOTE );
    

    //
    // At this point we have successfully completed the demotion
    //
    ASSERT( ERROR_SUCCESS == WinError );

    //
    // Clear errors components may have erroneously set while running
    //
    DsRolepClearErrors();

DemoteExit:

    if ( Policy ) {

        LsaClose( Policy );
    }

    if ( Credentials ) {

        RtlFreeHeap( RtlProcessHeap(), 0, Credentials );

    }

    if ( pDnsRRInfo ) {

        ( *DsrNtdsFreeDnsRRInfo )(pDnsRRInfo);
        
    }

    //
    // Tear down the session to the parent, if we have one
    //
    if ( IPCConnection ) {

        RtlRunDecodeUnicodeString( DemoteArgs->Decode, &DemoteArgs->Password );
        IgnoreError = ImpNetpManageIPCConnect( DemoteArgs->ImpersonateToken,
                                               SupportDc,
                                               DemoteArgs->Account,
                                               DemoteArgs->Password.Buffer,
                                               (NETSETUPP_DISCONNECT_IPC|NETSETUPP_USE_LOTS_FORCE) );
        RtlRunEncodeUnicodeString( &DemoteArgs->Decode, &DemoteArgs->Password );
        if ( IgnoreError != ERROR_SUCCESS ) {

            DsRolepLogPrint(( DEB_WARN,
                             "Failed to destroy the session with %ws: 0x%lx\n", SupportDc,
                             IgnoreError ));
        }

        IPCConnection = FALSE;
    }

    //Delete persistent shares 
    NetStatus = NetShareDel( NULL, L"SYSVOL", 0);

    if(NetStatus != ERROR_SUCCESS) {

        DsRolepLogPrint(( DEB_WARN,
                             "Failed to destroy the share SYSVOL.  Failed with %d\n", NetStatus ));
    }


    NetStatus = NetShareDel( NULL, L"NETLOGON", 0);

    if(NetStatus != ERROR_SUCCESS) {

        DsRolepLogPrint(( DEB_WARN,
                             "Failed to destroy the share NETLOGON.  Failed with %d\n", NetStatus ));
    }

    //
    // Reset our operation handle
    //
    DsRolepSetOperationDone( DSROLEP_OP_DEMOTION, WinError );

    DsRolepFreeArgumentBlock( &ArgumentBlock, FALSE );

    LsaFreeMemory( DnsDomainInfo );

    RtlFreeHeap( RtlProcessHeap(), 0, ParentDomainName );

    NetApiBufferFree( DomainControllerInfo );

    
    ExitThread( WinError );
    return( WinError );

DemoteUndo:

    //
    // Assert that aomething went wrong if we are here
    //
    ASSERT( ERROR_SUCCESS != WinError );

    //
    // We shouldn't be here if we are in an unrollable state
    //
    ASSERT( FALSE == Unrollable );

    if ( FrsDemote ) {

        IgnoreError = DsRolepFinishSysVolPropagation( FALSE,
                                                      FALSE );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to abort system volume demotion (%d)\n",
                                                IgnoreError )) );

        FrsDemote = FALSE;
    }

    if ( NotifiedNetlogonToDeregister ) {

        //
        // "NlDcDemotionCompleted" sounds strange here since the demotion
        // failed.  However, the meaning is that netlogon should now continue
        // to perform as if demotion is not running.  No need to set in the
        // success case since NETLOGON won't be restarted.
        //

        Status = I_NetNotifyDsChange( NlDcDemotionCompleted );
        IgnoreError = RtlNtStatusToDosError( Status );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to tell NETLOGON that demotion is over (%d)\n",
                                                IgnoreError )) );

        NotifiedNetlogonToDeregister = FALSE;
        
    }

    if ( RestartNetlogon ) {

        IgnoreError = DsRolepStartNetlogon();

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to restart netlogon (%d)\n",
                                                IgnoreError )) );

        RestartNetlogon = FALSE;
    }

    if ( DomainControllerServicesChanged ) {

        IgnoreError = DsRolepConfigureDomainControllerServices( DSROLEP_SERVICES_REVERT );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback domain controller services configuration (%d)\n",
                                                IgnoreError )) );

        DomainControllerServicesChanged = FALSE;
    }

    if ( DomainServicesChanged ) {

        IgnoreError = DsRolepConfigureDomainServices( DSROLEP_SERVICES_REVERT );

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to rollback domain controller services configuration (%d)\n",
                                                IgnoreError )) );

        DomainServicesChanged = FALSE;
    }

    if ( DsPrepareDemote ) {

        IgnoreError = ( *DsrNtdsPrepareForDemotionUndo ) ();

        DsRolepLogOnFailure( IgnoreError,
                             DsRolepLogPrint(( DEB_WARN,
                                               "Failed to undo directory service preparation for demotion (%d)\n",
                                                IgnoreError )) );


        DsPrepareDemote = FALSE;

    }

    //
    // Ok -- we have rolled back, make sure we still have an error and then 
    // exit
    //
    ASSERT( ERROR_SUCCESS != WinError );

    goto DemoteExit;

}