windows-xp/Source/XPSP1/NT/admin/admt/workobj/usercopy.cpp

//#pragma title("usercopy- copies user accounts")
/*
================================================================================

  (c) Copyright 1995-1998, Mission Critical Software, Inc., All Rights Reserved
  Proprietary and confidential to Mission Critical Software, Inc.

 Program    - usercopy
 Class      - LAN Manager Utilities
 Author     - Tom Bernhardt
 Created    - 05/08/91
 Description- Merges the NetUser information from the specified source
              server with the target system (or the current system if no
              target is specified).  Group information is also merged if
              the /g option is given.   Existing entries on the target system
              are not overwritten unless the /r option is used.

 Syntax     - USERCOPY source [target] [/u] [/l] [/g] [/r]
        where:
           source   source server
           target   destination server
           /g       copies global group information
           /l       copies local group information

           /u       copies user information
           /r       replaces existing target entries with source entries
           /AddTo:x Adds all newly created users (/u) to group "x"

 Updates    - 
 91/06/17 TPB General code cleanup and change so that all stdout i/o lines up 
              nicely on-screen for reporting.
 93/06/12 TPB Port to Win32
 96/06/21 TPB Support for local groups
 97/09/20 CAB Added subset of accounts option for GUI
 98/06    TPB/CAB Support for computer accounts
 99/01    COM-ization of DCT.
================================================================================
*/
#include "StdAfx.h"

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include <ntdsapi.h>
#include <lm.h>
#include <iads.h>
#include "TxtSid.h"

#define INCL_NETUSER
#define INCL_NETGROUP
#define INCL_NETERRORS
#include <lm.h>

#include "Common.hpp"                    
#include "UString.hpp"                   

#include "WorkObj.h"

//#include "Usercopy.hpp" //#included by ARUtil.hpp below

#include "ARUtil.hpp"
#include "BkupRstr.hpp"
#include "RebootU.h"

#include "DCTStat.h"
#include "ErrDct.hpp"
#include "Win2KErr.h"
#include "RegTrans.h"
#include "TEvent.hpp"
#include <dsgetdc.h>
#include <sddl.h>


//#import "\bin\NetEnum.tlb" no_namespace
//#import "\bin\DBManager.tlb" no_namespace, named_guids
#import "NetEnum.tlb" no_namespace
//#import "DBMgr.tlb" no_namespace, named_guids //already #imported via ARUtil.hpp

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

extern TErrorDct             err;
extern TErrorDct           & errC;


bool                         abortall;
extern bool						  g_bAddSidWorks = false;

// global counts of accounts processed
AccountStats                 warnings =  { 0,0,0,0 };
AccountStats                 errors =    { 0,0,0,0 };
AccountStats                 created =   { 0,0,0,0 };
AccountStats                 replaced =  { 0,0,0,0 };
AccountStats                 processed = { 0,0,0,0 };

BOOL                         machineAcctsCreated = FALSE;
BOOL                         otherAcctsCreated = FALSE;
PSID                         srcSid = NULL;      // SID for source domain


typedef HRESULT (CALLBACK * DSGETDCNAME)(LPWSTR, LPWSTR, GUID*, LPWSTR, DWORD, PDOMAIN_CONTROLLER_INFO*);
typedef UINT (CALLBACK* DSBINDFUNC)(TCHAR*, TCHAR*, HANDLE*);
typedef UINT (CALLBACK* DSADDSIDHISTORY)(HANDLE, DWORD, LPCTSTR, LPCTSTR, LPCTSTR, RPC_AUTH_IDENTITY_HANDLE,LPCTSTR,LPCTSTR);
    

int TNodeCompareSourceName(TNode const * t1,TNode const * t2)
{
   TAcctReplNode     const * n1 = (TAcctReplNode *)t1;
   TAcctReplNode     const * n2 = (TAcctReplNode *)t2;

   return UStrICmp(n1->GetName(),n2->GetName());
}

int TNodeCompareSourceNameValue(TNode const * t1, void const * v)
{
   TAcctReplNode     const * n1 = (TAcctReplNode *)t1;
   WCHAR             const * name = (WCHAR const *)v;

   return UStrICmp(n1->GetName(),name);
}


bool BindToDS( WCHAR * strDestDC, Options * pOpt)
{
	// Get the handle to the Directory service.
	DSBINDFUNC DsBind;
   	HINSTANCE hInst = LoadLibrary(L"NTDSAPI.DLL");
	if ( hInst )
	{
		DsBind = (DSBINDFUNC) GetProcAddress(hInst, "DsBindW");
		if (DsBind)
		{
			DWORD rc = DsBind(strDestDC, NULL, &pOpt->dsBindHandle);
			if ( rc != 0 ) 
			{
				err.SysMsgWrite( ErrE, rc, DCT_MSG_DSBIND_FAILED_S, strDestDC);
            Mark(L"errors", L"generic");
				FreeLibrary(hInst);
				return false;
			}
		}
		else
		{
			err.SysMsgWrite(ErrE,GetLastError(),DCT_MSG_GET_PROC_ADDRESS_FAILED_SSD,L"NTDSAPI.DLL",L"DsBindW",GetLastError());
         Mark(L"errors", L"generic");
			FreeLibrary(hInst);
			return false;
		}
	}
	else
	{
		err.SysMsgWrite(ErrW,GetLastError(),DCT_MSG_LOAD_LIBRARY_FAILED_SD,L"NTDSAPI.DLL",GetLastError());
      Mark(L"warnings", L"generic");
		return false;
	}
	FreeLibrary(hInst);
	return true;
}

// The following function is used to get the actual account name from the source domain
// instead of account that contains the SID in its SID history.
DWORD GetName(PSID pObjectSID, WCHAR * sNameAccount, WCHAR * sDomain)
{
	DWORD		cb = 255;
	DWORD    cbDomain = 255;
   DWORD    tempVal;
   PDWORD   psubAuth;
   PUCHAR   pVal;
   SID_NAME_USE	sid_Use;
   WCHAR    sDC[255];
   DWORD    rc = 0;

   if ((pObjectSID == NULL) || !IsValidSid(pObjectSID))
   {
      return ERROR_INVALID_PARAMETER;
   }
   // Copy the Sid to a temp SID
   DWORD    sidLen = GetLengthSid(pObjectSID);
   PSID     pObjectSID1 = new BYTE[sidLen];
   if (!pObjectSID1)
      return ERROR_NOT_ENOUGH_MEMORY;

   if (!CopySid(sidLen, pObjectSID1, pObjectSID))
   {
      return GetLastError();
   }
   if (!IsValidSid(pObjectSID1))
   {
      rc = GetLastError();
      err.SysMsgWrite(ErrE, rc,DCT_MSG_DOMAIN_LOOKUP_FAILED_D,rc);
      Mark(L"errors", L"generic");
	  delete pObjectSID1;
      return rc;
   }

   // Get the RID out of the SID and get the domain SID
   pVal = GetSidSubAuthorityCount(pObjectSID1);
   (*pVal)--;
   psubAuth = GetSidSubAuthority(pObjectSID1, *pVal);
   tempVal = *psubAuth;
   *psubAuth = -1;

   //Lookup the domain from the SID 
   if (!LookupAccountSid(NULL, pObjectSID1, sNameAccount, &cb, sDomain, &cbDomain, &sid_Use))
   {
      rc = GetLastError();
      err.SysMsgWrite(ErrE, rc,DCT_MSG_DOMAIN_LOOKUP_FAILED_D,rc);
      Mark(L"errors", L"generic");
	  delete pObjectSID1;
      return rc;
   }
   
   // Get a DC for the domain
   DSGETDCNAME DsGetDcName = NULL;
   DOMAIN_CONTROLLER_INFO  * pSrcDomCtrlInfo = NULL;
   
   HMODULE hPro = LoadLibrary(L"NetApi32.dll");
   if ( hPro )
      DsGetDcName = (DSGETDCNAME)GetProcAddress(hPro, "DsGetDcNameW");
   else
   {
      long rc = GetLastError();
      err.SysMsgWrite(ErrE, rc, DCT_MSG_LOAD_LIBRARY_FAILED_SD, L"NetApi32.dll");
      Mark(L"errors", L"generic");
   }

   if (DsGetDcName)   
   {
      if ( DsGetDcName(
                        NULL                                  ,// LPCTSTR ComputerName ?
                        sDomain                               ,// LPCTSTR DomainName
                        NULL                                  ,// GUID *DomainGuid ?
                        NULL                                  ,// LPCTSTR SiteName ?
                        0                                     ,// ULONG Flags ?
                        &pSrcDomCtrlInfo                       // PDOMAIN_CONTROLLER_INFO *DomainControllerInfo
                     ))
      {
         err.SysMsgWrite(ErrE,GetLastError(),DCT_MSG_GET_DCNAME_FAILED_SD,sDomain,GetLastError());
         Mark(L"errors", L"generic");
	     delete pObjectSID1;
         return GetLastError();
      }
      else
      {
         wcscpy(sDC, pSrcDomCtrlInfo->DomainControllerName);
         NetApiBufferFree(pSrcDomCtrlInfo);
      }

      // Reset the sizes
      cb = 255;
      cbDomain = 255;

      // Lookup the account on the PDC that we found above.
      if ( LookupAccountSid(sDC, pObjectSID, sNameAccount, &cb, sDomain, &cbDomain, &sid_Use) == 0)
      {
	     delete pObjectSID1;
         return GetLastError();
      }
   }
   delete pObjectSID1;
   FreeLibrary(hPro);
   return 0;
}

/* This is a list of specific error codes that can be returned by DsAddSidHistory.
This was obtained from Microsoft via email

  > ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED
>     The operation requires that destination domain auditing be enabled for
>     Success and Failure auditing of account management operations.
> 
> ERROR_DS_UNWILLING_TO_PERFORM
>     It may be that the user account is not one of UF_NORMAL_ACCOUNT,
>     UF_WORKSTATION_TRUST_ACCOUNT, or UF_SERVER_TRUST_ACCOUNT.
> 
>     It may be that the source principal is a built in account.
> 
>     It may be that the source principal is a well known RID being added
>     to a destination principal that is a different RID. In other words,
>     Administrators of the source domain can only be assigned to
>     Administrators of the destination domain.
> 
> ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER
>     The source object must be a group or user.
> 
> ERROR_DS_SRC_SID_EXISTS_IN_FOREST
>     The source object's SID already exists in destination forest.
> 
> ERROR_DS_INTERNAL_FAILURE;
>     The directory service encountered an internal failure. Shouldn't
> happen.
> 
> ERROR_DS_MUST_BE_RUN_ON_DST_DC
>     For security reasons, the operation must be run on the destination DC.
>     Specifically, the connection between the client and server
> (destination
>     DC) requires 128-bit encryption when credentials for the source domain
>     are supplied.
> 
> ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION
>     The connection between client and server requires packet privacy or
> better.
> 
> ERROR_DS_SOURCE_DOMAIN_IN_FOREST
>     The source domain may not be in the same forest as destination.
> 
> ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST
>     The destination domain must be in the forest.
> 
> ERROR_DS_MASTERDSA_REQUIRED
>     The operation must be performed at a master DSA (writable DC).
> 
> ERROR_DS_INSUFF_ACCESS_RIGHTS
>     Insufficient access rights to perform the operation. Most likely
>     the caller is not a member of domain admins for the dst domain.
> 
> ERROR_DS_DST_DOMAIN_NOT_NATIVE
>     Destination domain must be in native mode.
> 
> ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN
>     The operation couldn't locate a DC for the source domain.
> 
> ERROR_DS_OBJ_NOT_FOUND
>     Directory object not found. Most likely the FQDN of the 
>     destination principal could not be found in the destination
>     domain.
> 
> ERROR_DS_NAME_ERROR_NOT_UNIQUE
>     Name translation: Input name mapped to more than one
>     output name. Most likely the destination principal mapped
>     to more than one FQDN in the destination domain.
> 
> ERROR_DS_SRC_AND_DST_OBJECT_CLASS_MISMATCH
>     The source and destination object must be of the same type.
> 
> ERROR_DS_OBJ_CLASS_VIOLATION
>     The requested operation did not satisfy one or more constraints
>     associated with the class of the object. Most likely because the
>     destination principal is not a user or group.
> 
> ERROR_DS_UNAVAILABLE
>     The directory service is unavailable. Most likely the
>     ldap_initW() to the NT5 src DC failed.
> 
> ERROR_DS_INAPPROPRIATE_AUTH
>     Inappropriate authentication. Most likely the ldap_bind_sW() to
>     the NT5 src dc failed.
> 
> ERROR_DS_SOURCE_AUDITING_NOT_ENABLED
>     The operation requires that source domain auditing be enabled for
>     Success and Failure auditing of account management operations.
> 
> ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER
>     For security reasons, the source DC must be Service Pack 4 or greater.
> 
*/
BOOL GetDnsAndNetbiosFromName(WCHAR * name,WCHAR * netBios, WCHAR * dns)
{
   IADs      * pDomain = NULL;
   WCHAR       strText[1000];

   // try to connect to the AD, using the specified name
   swprintf(strText,L"LDAP://%ls",name);

   HRESULT hr = ADsGetObject(strText,IID_IADs,(void**)&pDomain);
   if ( SUCCEEDED(hr) )
   {
      _variant_t        var;

      // get the NETBIOS name from the LDAP provider
      hr = pDomain->Get(L"nETBIOSName",&var);
      if ( SUCCEEDED(hr) )
      {
         UStrCpy(netBios,(WCHAR*)var.bstrVal);
      }
      else
      {
         hr = pDomain->Get(L"name",&var);
         if ( SUCCEEDED(hr) )
         {
            UStrCpy(netBios,(WCHAR*)var.bstrVal);
         }
      }

      // get the DNS name from the LDAP provider
      hr = pDomain->Get(L"distinguishedName",&var);
      if ( SUCCEEDED(hr) )
      {
         WCHAR * dn = (WCHAR*)var.bstrVal;
         WCHAR * curr = dns;

         if ( !UStrICmp(dn,L"DC=",3) )
         {
            
            // for each ",DC=" in the name, replace it with a .
            for ( curr = dns, dn = dn+3 ;    // skip the leading "DC="
                  *dn       ;    // until the end of the string is reached
                  curr++         // 
                )
            {
               if ( (L',' == *dn)  && (L'D' == *(dn+1)) && (L'C' == *(dn+2)) && (L'=' == *(dn+3)) )
               {
                  (*curr) = L'.';
                  dn+=4;
               }
               else
               {
                  // just copy the character
                  (*curr) = (*dn);
                  dn++;
               }
            }
            *(curr) = 0;
         }
      }
      pDomain->Release();
   }
   else
   {
      // default to using the specified name as both DNS and NETBIOS
      // this will work for NT 4 domains
      UStrCpy(netBios,name);
      UStrCpy(dns,name);
   }
   return TRUE;
}

HRESULT 
   CopySidHistoryProperty(
      Options              * pOptions,
      TAcctReplNode        * pNode,
      IStatusObj              * pStatus
   )
{
   HRESULT                   hr = S_OK;
   IADs                    * pAds = NULL;
   _variant_t                var;
//   long                      ub = 0, lb = 0;

   // fetch the SIDHistory property for the source account
   // for each entry in the source's SIDHistory, call DsAddSidHistory

   // Get the IADs pointer to the object and get the SIDHistory attribute.
   hr = ADsGetObject(const_cast<WCHAR*>(pNode->GetSourcePath()), IID_IADs, (void**)&pAds);
   if ( SUCCEEDED(hr) )
   {
      hr = pAds->Get(L"sIDHistory", &var);
   }

   if ( SUCCEEDED(hr) )
   {
      // This is a multivalued property so we need to get all the values
      // for each one get the name and the domain of the object and then call the 
      // add sid history function to add the SID to the target objects SIDHistory.
		_variant_t		        var;
		DWORD rc = pAds->GetEx(L"sIDHistory", &var);
		if ( !rc )
		{
			if ( V_VT(&var) == (VT_ARRAY | VT_VARIANT) )
         {
            // This is the array type that we were looking for.
            void HUGEP *pArray;
			   VARIANT var2;
			   ULONG dwSLBound = -1; 
			   ULONG dwSUBound = -1;
			   
			   hr = SafeArrayGetLBound( V_ARRAY(&var),
                                     1,
                                     (long FAR  *) &dwSLBound );
            hr = SafeArrayGetUBound( V_ARRAY(&var),
                                      1,
                                      (long FAR  *) &dwSUBound );
            if (SUCCEEDED(hr))
            {
               // Each element in this array is a SID in form of a VARIANT
               hr = SafeArrayAccessData( V_ARRAY(&var), &pArray );
				   for ( long x = (long)dwSLBound; x <= (long)dwSUBound; x++)
				   {
					   hr = SafeArrayGetElement(V_ARRAY(&var), &x, &var2);
                  // Get the SID from the Variant in a ARRAY form
					   hr = SafeArrayAccessData( V_ARRAY(&var2), &pArray );
					   PSID pObjectSID = (PSID)pArray;
					   //Convert SID to string.
					   if (pObjectSID) 
					   {
						   WCHAR		sNameAccount[255];
						   WCHAR		sDomain[255];
                     WCHAR    sNetBIOS[255];
                     DWORD    rc = 0;

                     rc = GetName(pObjectSID, sNameAccount, sDomain);
                     if (!rc)
                     {
                        WCHAR               sTemp[LEN_Path];
                        WCHAR               sSourceDNS[LEN_Path];
                        // We are going to temporarily change the Domain DNS to the domain of the SID we are adding
                        wcscpy(sTemp, pOptions->srcDomainDns);
                        if ( GetDnsAndNetbiosFromName(sDomain, sNetBIOS, sSourceDNS) )
                        {
                           wcscpy(pOptions->srcDomainDns, sSourceDNS);
                           AddSidHistory(pOptions, sNameAccount, pNode->GetTargetSam(), NULL, FALSE);
                           // Replace the original domain dns.
                           wcscpy(pOptions->srcDomainDns, sTemp);
                        }
                        else
                        {
                           err.SysMsgWrite(ErrE, GetLastError(),DCT_MSG_DOMAIN_DNS_LOOKUP_FAILED_SD, sDomain,GetLastError());
                           Mark(L"errors", pNode->GetType());
                        }
                     }
						   else
                     {
						      // Get name failed we need to log a message.
                        WCHAR                       sSid[LEN_Path];
                        DWORD                       len = LEN_Path;
                        GetTextualSid(pObjectSID, sSid, &len);
                        err.SysMsgWrite(ErrE,rc,DCT_MSG_ERROR_CONVERTING_SID_SSD,
                                        pNode->GetTargetName(), sSid, rc);
                        Mark(L"errors", pNode->GetType());
                     }
					   }
                  SafeArrayUnaccessData(V_ARRAY(&var2));
				   }
               SafeArrayUnaccessData(V_ARRAY(&var));
            }           
         }              
		}
		else
		{
         // No SID History to copy.
		}
   }
   return hr;
}


bool AddSidHistory( const Options * pOptions,
						  const WCHAR   * strSrcPrincipal,
						  const WCHAR   * strDestPrincipal,
                    IStatusObj    * pStatus,
                    BOOL            isFatal)
{
	//Add the sid to the history
	// Authentication Structure 
	SEC_WINNT_AUTH_IDENTITY		auth;
   DWORD                      rc = 0;
	//memset(&auth, 0, sizeof(SEC_WINNT_AUTH_IDENTITY));

	auth.User = const_cast<WCHAR*>(pOptions->authUser);
	auth.UserLength = wcslen(pOptions->authUser);
	auth.Password = const_cast<WCHAR*>(pOptions->authPassword);
	auth.PasswordLength = wcslen(pOptions->authPassword);
	auth.Domain = const_cast<WCHAR*>(pOptions->authDomain);
	auth.DomainLength = wcslen(pOptions->authDomain);
	auth.Flags  = SEC_WINNT_AUTH_IDENTITY_UNICODE;

	// Auth Identity handle
	// if source domain credentials supplied use them
	// otherwise credentials of caller will be used
	RPC_AUTH_IDENTITY_HANDLE pHandle = ((auth.DomainLength > 0) && (auth.UserLength > 0)) ? &auth : NULL;

	DSADDSIDHISTORY	DsAddSidHistory;
	HINSTANCE hInst = LoadLibrary(L"NTDSAPI.DLL");
   

	if ( hInst )
	{
		DsAddSidHistory = (DSADDSIDHISTORY) GetProcAddress(hInst, "DsAddSidHistoryW");
		if (DsAddSidHistory)
		{
         if ( !pOptions->nochange )
         {
            int loopCount = 0;
            rc = RPC_S_SERVER_UNAVAILABLE;
            // If we get the RPC server errors we need to retry 5 times.
			   while ( (((rc == RPC_S_SERVER_UNAVAILABLE) || (rc == RPC_S_CALL_FAILED) || (rc == RPC_S_CALL_FAILED_DNE)) && loopCount < 5)
                     || ( (rc == ERROR_INVALID_HANDLE) && loopCount < 3 ) )      // In case of invalid handle we try it 3 times now.
            {
               // Make the API call to add Sid to the history
			      rc = DsAddSidHistory( 
                                pOptions->dsBindHandle,		//DS Handle
								        NULL,							// flags
								        pOptions->srcDomainDns,			// Source domain
								        strSrcPrincipal,				// Source Account name
								        NULL,			// Source Domain Controller
								        pHandle,						// RPC_AUTH_IDENTITY_HANDLE
								        pOptions->tgtDomainDns,			   // Target domain
								        strDestPrincipal);			// Target Account name
               if ( loopCount > 0 ) Sleep(500);
               loopCount++;
            }
         }

			if ( rc != 0 )
			{
            switch ( rc )
            {
               // these are the error codes caused by permissions or configuration problems
               case ERROR_NONE_MAPPED:
                  err.MsgWrite(ErrE, DCT_MSG_ADDSIDHISTORY_FAIL_BUILTIN_SSD,strSrcPrincipal, strDestPrincipal, rc); 
                  break;
               case ERROR_DS_UNWILLING_TO_PERFORM:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_DS_UNWILLING_TO_PERFORM_SSSSD,strDestPrincipal,pOptions->srcDomain, strSrcPrincipal, pOptions->tgtDomain,rc);
                  break;
               case ERROR_DS_INSUFF_ACCESS_RIGHTS:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_INSUFF_ACCESS_SD,strDestPrincipal,rc);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_INVALID_HANDLE:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_INVALID_HANDLE_SSD,pOptions->srcDomainDns,strDestPrincipal,rc);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NOAUDIT_SSD,strDestPrincipal,pOptions->tgtDomainDns,rc);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_DS_MUST_BE_RUN_ON_DST_DC:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_DST_DC_SD,strDestPrincipal,rc);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_PKT_PRIVACY_SD,strDestPrincipal,rc);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_DS_SOURCE_DOMAIN_IN_FOREST:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_SOURCE_IN_FOREST_S,strDestPrincipal);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_DEST_WRONG_FOREST_S,strDestPrincipal);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_DS_MASTERDSA_REQUIRED:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NO_MASTERDSA_S,strDestPrincipal);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_ACCESS_DENIED:
                  g_bAddSidWorks = FALSE;
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_INSUFF2_SSS,strDestPrincipal,pOptions->authDomain,pOptions->authUser);
                  break;
               case ERROR_DS_DST_DOMAIN_NOT_NATIVE:
                  g_bAddSidWorks = FALSE;
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NOT_NATIVE_S,strDestPrincipal);
                  break;
               case ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN:
                  g_bAddSidWorks = FALSE;
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NO_SOURCE_DC_S,strDestPrincipal);
                  break;
   //            case ERROR_DS_INAPPROPRIATE_AUTH:
               case ERROR_DS_UNAVAILABLE:
                  g_bAddSidWorks = FALSE;
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_DS_UNAVAILABLE_S,strDestPrincipal);
                  break;
               case ERROR_DS_SOURCE_AUDITING_NOT_ENABLED:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_NOAUDIT_SSD,strDestPrincipal,pOptions->srcDomain,rc);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_SOURCE_NOT_SP4_S,strDestPrincipal);
                  g_bAddSidWorks = FALSE;
                  break;
               case ERROR_SESSION_CREDENTIAL_CONFLICT:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_CREDENTIALS_CONFLICT_SSSS,strDestPrincipal,pOptions->srcDomain,pOptions->authDomain,pOptions->authUser);
                  g_bAddSidWorks = FALSE;
                  break;
               // these are error codes that only affect this particular account
               case ERROR_SUCCESS:
                  g_bAddSidWorks = TRUE;
                  // no error message needed for success case!
                  break;

               case ERROR_DS_SRC_SID_EXISTS_IN_FOREST:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_IN_FOREST_SD,strDestPrincipal,rc);
                  g_bAddSidWorks = TRUE;
                  break;

               case ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER:
                  err.MsgWrite(ErrE,DCT_MSG_SID_HISTORY_WRONGTYPE_SD,strDestPrincipal,rc);
                  g_bAddSidWorks = TRUE;
                   break;
               default:
                 err.MsgWrite(ErrE,DCT_MSG_ADDSID_FAILED_SSD,strSrcPrincipal, strDestPrincipal,rc);
                 g_bAddSidWorks = TRUE;
                   break;
               }
      
            Mark(L"errors", L"generic");

            // This may or may not be a fatal error depending on weather we are Adding
            // sid history or copying sid history
            g_bAddSidWorks |= !(isFatal);

            if (! g_bAddSidWorks )
            {
               // log a message indicating that SIDHistory will not be tried for the rest of the accounts
               err.MsgWrite(ErrW,DCT_MSG_SIDHISTORY_FATAL_ERROR);
               Mark(L"warnings", L"generic");
               // we are going to set the status to abort so that we don't try to migrate anymore.
               if ( pStatus )
               {
                  pStatus->put_Status(DCT_STATUS_ABORTING);
               }
               
            }
				FreeLibrary(hInst);
				return false;
			}
			else
			{
				err.MsgWrite(0, DCT_MSG_ADD_SID_SUCCESS_SSSS, pOptions->srcDomainDns, strSrcPrincipal, pOptions->tgtDomainDns, strDestPrincipal);
				FreeLibrary(hInst);
				return true;
			}
		}
		else
		{
			err.SysMsgWrite(ErrE,GetLastError(),DCT_MSG_NO_ADDSIDHISTORY_FUNCTION);
         Mark(L"errors", L"generic");
			FreeLibrary(hInst);
			return false;
		}
	}
	else
	{
		err.SysMsgWrite(ErrE,GetLastError(),DCT_MSG_NO_NTDSAPI_DLL);
      Mark(L"errors", L"generic");
		return false;
	}
}

//--------------------------------------------------------------------------
// FillupNamingContext : This function fills in the target Naming context
//                       for NT5 domain.
//--------------------------------------------------------------------------
void FillupNamingContext(
                     Options * options  //in,out- Options to fill up
                   )
{
   WCHAR                     sPath[LEN_Path];
   IADs                    * pAds;
   _variant_t                var;
   HRESULT                   hr;

   wsprintf(sPath, L"LDAP://%s/rootDSE", options->tgtDomain);
   hr = ADsGetObject(sPath, IID_IADs, (void**)&pAds);
   if ( FAILED(hr) )
   {
      wcscpy(options->tgtNamingContext, L"");
      return;
   }

   hr = pAds->Get(L"defaultNamingContext", &var);
   if ( FAILED(hr) )
   {
      wcscpy(options->tgtNamingContext, L"");
      return;
   }
   pAds->Release();
   wcscpy(options->tgtNamingContext, (WCHAR*) V_BSTR(&var));
}

//--------------------------------------------------------------------------
// MakeFullyQualifiedAdsPath : Makes a LDAP sub path into a fully qualified 
//                             LDAP path name.
//--------------------------------------------------------------------------
void MakeFullyQualifiedAdsPath(
                                 WCHAR * sPath,          //out- Fully qulified LDAP path to the object
								 DWORD	 nPathLen,		 //in - MAX size, in characters, of the sPath buffer
                                 WCHAR * sSubPath,       //in- LDAP subpath of the object
                                 WCHAR * tgtDomain,      //in- Domain name where object exists.
                                 WCHAR * sDN             //in- Default naming context for the Domain 
                              )
{
   if ((!sPath) || (!sSubPath) || (!tgtDomain) || (!sDN))
      return;

   _bstr_t sTempPath;
   if (wcsncmp(sSubPath, L"LDAP://", 7) == 0)
   {
      //it is already a fully qualified LDAP path so lets copy it and return it
      wcsncpy(sPath, sSubPath, nPathLen-1);
      return;
   }

   //We need to build this path so lets get to work
   if ( wcslen(sDN) )
   {
	  sTempPath = L"LDAP://";
	  sTempPath += tgtDomain;
	  sTempPath += L"/";
	  sTempPath += sSubPath;
	  sTempPath += L",";
	  sTempPath += sDN;
	  wcsncpy(sPath, sTempPath, nPathLen-1);
//      wsprintf(sPath, L"LDAP://%s/%s,%s", tgtDomain, sSubPath, sDN);
   }
   else
   {
	  sTempPath = L"LDAP://";
	  sTempPath += tgtDomain;
	  sTempPath += L"/";
	  sTempPath += sSubPath;
	  wcsncpy(sPath, sTempPath, nPathLen-1);
//      wsprintf(sPath, L"LDAP://%s/%s", tgtDomain, sSubPath);
   }
}


//--------------------------------------------------------------------------
// IsAccountMigrated : Function checks if the account has been migrated in
//                     the past. If it has it returns true filling in the
//                     name of the target object in case it was renamed.
//                     Otherwise it returns FALSE and Empty string for the 
//                     target name.
//--------------------------------------------------------------------------
bool IsAccountMigrated( 
                        TAcctReplNode * pNode,     //in -Account node that contains the Account info
                        Options       * pOptions,  //in -Options as specified by the user.
                        IIManageDBPtr   pDb,       //in -Pointer to DB manager. We dont want to create this object for every account we process
                        WCHAR         * sTgtSam    //in,out - Name of the target object that was copied if any.
                     )
{
   IVarSetPtr                pVs(__uuidof(VarSet));
   IUnknown                * pUnk;

   pVs->QueryInterface(IID_IUnknown, (void**) &pUnk);

   HRESULT hrFind = pDb->raw_GetAMigratedObject(const_cast<WCHAR*>(pNode->GetName()), pOptions->srcDomain, pOptions->tgtDomain, &pUnk);
   pUnk->Release();
   if ( hrFind != S_OK )
   {
      wcscpy(sTgtSam,L"");
      return false;
   }
   else
   {
      _bstr_t     sText;
      sText = pVs->get(L"MigratedObjects.TargetSamName");
	  if (!(WCHAR*)sText)
	  {
         wcscpy(sTgtSam,L"");
	     return false;
	  }
      wcscpy(sTgtSam, (WCHAR*) sText);
      return true;
   }
}

bool CheckifAccountExists(
                        Options const * options,   //in-Options as set by the user
                        WCHAR * acctName     //in-Name of the account to look for
                     )
{
   USER_INFO_0             * buf;
   long                      rc = 0;
   if ( (rc = NetUserGetInfo(const_cast<WCHAR*>(options->tgtComp), acctName, 0, (LPBYTE *) &buf)) == NERR_Success )
   {
      NetApiBufferFree(buf);
      return true;
   }
   
   if ( (rc = NetGroupGetInfo(const_cast<WCHAR*>(options->tgtComp), acctName, 0, (LPBYTE *) &buf)) == NERR_Success )
   {
      NetApiBufferFree(buf);
      return true;
   }

   if ( (rc = NetLocalGroupGetInfo(const_cast<WCHAR*>(options->tgtComp), acctName, 0, (LPBYTE *) &buf)) == NERR_Success )
   {
      NetApiBufferFree(buf);
      return true;
   }

   return false;
}

//--------------------------------------------------------------------------
// Mark : Increments appropriate counters depending on the arguments.
//--------------------------------------------------------------------------
void Mark( 
                        _bstr_t sMark,    //in- Represents the type of marking { processed, errors, replaced, created }
                        _bstr_t sObj      //in- Type of object being marked { user, group, computer }
                     )
{
   if (!UStrICmp(sMark,L"processed"))
   {
      if ( !UStrICmp(sObj,L"user")) processed.users++;
      else if ( !UStrICmp(sObj,L"group")) processed.globals++;
      else if ( !UStrICmp(sObj,L"computer")) processed.computers++;
      else if ( !UStrICmp(sObj,L"generic")) processed.generic++;
   }
   else if (!UStrICmp(sMark,L"errors"))
   {
      if ( !UStrICmp(sObj,L"user")) errors.users++;
      else if ( !UStrICmp(sObj,L"group")) errors.globals++;
      else if ( !UStrICmp(sObj,L"computer")) errors.computers++;
      else if ( !UStrICmp(sObj,L"generic")) errors.generic++;
   }
   else if (!UStrICmp(sMark,L"warnings"))
   {
      if ( !UStrICmp(sObj,L"user")) warnings.users++;
      else if ( !UStrICmp(sObj,L"group")) warnings.globals++;
      else if ( !UStrICmp(sObj,L"computer")) warnings.computers++;
      else if ( !UStrICmp(sObj,L"generic")) warnings.generic++;
   }
   else if (!UStrICmp(sMark,L"replaced"))
   {
      if ( !UStrICmp(sObj,L"user")) replaced.users++;
      else if ( !UStrICmp(sObj,L"group")) replaced.globals++;
      else if ( !UStrICmp(sObj,L"computer")) replaced.computers++;
      else if ( !UStrICmp(sObj,L"generic")) replaced.generic++;
   }
   else if (!UStrICmp(sMark,L"created"))
   {
      if ( !UStrICmp(sObj,L"user")) created.users++;
      else if ( !UStrICmp(sObj,L"group")) created.globals++;
      else if ( !UStrICmp(sObj,L"computer")) created.computers++;
      else if ( !UStrICmp(sObj,L"generic")) created.generic++;
   }
}

HRESULT
   GetRidPoolAllocator(
      Options              * pOptions
   )
{
   _bstr_t                   sRidMaster = L"";
   BSTR                      sParent = L"";
   _bstr_t                   sRidAllocator = pOptions->srcComp;
   _variant_t                varProp;
   IADs                    * pAds = NULL;

   WCHAR                     sPath[LEN_Path];
   HRESULT                   hr = S_OK;

   wsprintf(sPath, L"LDAP://%s/CN=RID Manager$,CN=System,%s", pOptions->srcComp + 2, pOptions->srcNamingContext);
   hr = ADsGetObject(sPath, IID_IADs, (void**)&pAds);

   if ( SUCCEEDED(hr) )
   {
      hr = pAds->Get(L"fSMORoleOwner", &varProp);
      pAds->Release();
   }
   
   if ( SUCCEEDED(hr) )
   {
      sRidMaster = varProp.bstrVal;
      wsprintf(sPath, L"LDAP://%s/%s", pOptions->srcDomain, (WCHAR*) sRidMaster);
      hr = ADsGetObject(sPath, IID_IADs, (void**)&pAds);
   }

   if ( SUCCEEDED(hr) )
   {
      hr = pAds->get_Parent(&sParent);
      pAds->Release();
   }

   if ( SUCCEEDED(hr) )
   {
      hr = ADsGetObject((WCHAR*)sParent, IID_IADs, (void**)&pAds);
   }

   if ( SUCCEEDED(hr) )
   {
      hr = pAds->Get(L"name", &varProp);
      pAds->Release();
   }

   if ( SUCCEEDED(hr) )
      sRidAllocator = varProp.bstrVal;

   if ( ((WCHAR*) sRidAllocator)[0] == L'\\' )
      wcscpy(pOptions->srcComp, (WCHAR*) sRidAllocator);
   else
      wsprintf(pOptions->srcComp, L"\\\\%s", (WCHAR*) sRidAllocator);

   return hr;
}