[2010/03/30 11:09:49, 0] winbindd/winbindd.c:main(1127) winbindd version 3.2.5 started. Copyright Andrew Tridgell and the Samba Team 1992-2008 [2010/03/30 11:09:49, 5] lib/debug.c:debug_dump_status(407) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 doing parameter max log size = 1000 doing parameter syslog = 0 doing parameter panic action = /usr/share/samba/panic-action %d doing parameter security = ADS doing parameter encrypt passwords = yes doing parameter passdb backend = tdbsam doing parameter obey pam restrictions = yes doing parameter unix password sync = yes doing parameter passwd program = /usr/bin/passwd %u doing parameter passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . doing parameter pam password change = yes doing parameter allow trusted domains = yes doing parameter winbind trusted domains only = no doing parameter idmap backend = ad doing parameter idmap uid = 10000-1000000 doing parameter idmap gid = 10000-1000000 doing parameter template homedir = /home/%U doing parameter winbind use default domain = yes doing parameter winbind nss info = rfc2307 doing parameter winbind nested groups = yes doing parameter client use spnego = yes doing parameter client ntlmv2 auth = yes doing parameter restrict anonymous = 2 doing parameter winbind enum groups = no doing parameter winbind enum users = no doing parameter winbind cache time = 30 [2010/03/30 11:09:49, 4] param/loadparm.c:lp_load_ex(8827) pm_process() returned Yes [2010/03/30 11:09:49, 7] param/loadparm.c:lp_servicenumber(9032) lp_servicenumber: couldn't find homes [2010/03/30 11:09:49, 10] param/loadparm.c:set_server_role(8005) set_server_role: role = ROLE_DOMAIN_MEMBER [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset UCS-2LE [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset UCS-2LE [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset UTF-16LE [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset UTF-16LE [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset UCS-2BE [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset UCS-2BE [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset UTF-16BE [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset UTF-16BE [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset UTF8 [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset UTF8 [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset UTF-8 [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset UTF-8 [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset ASCII [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset ASCII [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset 646 [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset 646 [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset ISO-8859-1 [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset ISO-8859-1 [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(104) Attempting to register new charset UCS2-HEX [2010/03/30 11:09:49, 5] lib/iconv.c:smb_register_charset(112) Registered charset UCS2-HEX [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 2] lib/tallocmsg.c:register_msg_pool_usage(106) Registered MSG_REQ_POOL_USAGE [2010/03/30 11:09:49, 2] lib/dmallocmsg.c:register_dmalloc_msgs(77) Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED [2010/03/30 11:09:49, 3] param/loadparm.c:lp_load_ex(8783) lp_load_ex: refreshing parameters Initialising global parameters [2010/03/30 11:09:49, 3] param/params.c:pm_process(569) params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf" [2010/03/30 11:09:49, 3] param/loadparm.c:do_section(7446) Processing section "[global]" doing parameter workgroup = RDOMAINPRV doing parameter realm = RDOMAIN.PRV doing parameter server string = %h server doing parameter dns proxy = no doing parameter name resolve order = lmhosts host wins bcast doing parameter log file = /var/log/samba/log.%m doing parameter log level = 10 [2010/03/30 11:09:49, 5] lib/debug.c:debug_dump_status(407) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 doing parameter max log size = 1000 doing parameter syslog = 0 doing parameter panic action = /usr/share/samba/panic-action %d doing parameter security = ADS doing parameter encrypt passwords = yes doing parameter passdb backend = tdbsam doing parameter obey pam restrictions = yes doing parameter unix password sync = yes doing parameter passwd program = /usr/bin/passwd %u doing parameter passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . doing parameter pam password change = yes doing parameter allow trusted domains = yes doing parameter winbind trusted domains only = no doing parameter idmap backend = ad doing parameter idmap uid = 10000-1000000 doing parameter idmap gid = 10000-1000000 doing parameter template homedir = /home/%U doing parameter winbind use default domain = yes doing parameter winbind nss info = rfc2307 doing parameter winbind nested groups = yes doing parameter client use spnego = yes doing parameter client ntlmv2 auth = yes doing parameter restrict anonymous = 2 doing parameter winbind enum groups = no doing parameter winbind enum users = no doing parameter winbind cache time = 30 [2010/03/30 11:09:49, 2] param/loadparm.c:do_section(7463) Processing section "[homes]" [2010/03/30 11:09:49, 8] param/loadparm.c:add_a_service(5785) add_a_service: Creating snum = 0 for homes [2010/03/30 11:09:49, 10] param/loadparm.c:hash_a_service(5823) hash_a_service: creating servicehash [2010/03/30 11:09:49, 10] param/loadparm.c:hash_a_service(5832) hash_a_service: hashing index 0 for service name homes doing parameter comment = Home Directories doing parameter browseable = no doing parameter read only = yes doing parameter create mask = 0700 doing parameter directory mask = 0700 doing parameter valid users = %S [2010/03/30 11:09:49, 2] param/loadparm.c:do_section(7463) Processing section "[printers]" [2010/03/30 11:09:49, 8] param/loadparm.c:add_a_service(5785) add_a_service: Creating snum = 1 for printers [2010/03/30 11:09:49, 10] param/loadparm.c:hash_a_service(5832) hash_a_service: hashing index 1 for service name printers doing parameter comment = All Printers doing parameter browseable = no doing parameter path = /var/spool/samba doing parameter printable = yes doing parameter guest ok = no doing parameter read only = yes doing parameter create mask = 0700 [2010/03/30 11:09:49, 2] param/loadparm.c:do_section(7463) Processing section "[print$]" [2010/03/30 11:09:49, 8] param/loadparm.c:add_a_service(5785) add_a_service: Creating snum = 2 for print$ [2010/03/30 11:09:49, 10] param/loadparm.c:hash_a_service(5832) hash_a_service: hashing index 2 for service name print$ doing parameter comment = Printer Drivers doing parameter path = /var/lib/samba/printers doing parameter browseable = yes doing parameter read only = yes doing parameter guest ok = no [2010/03/30 11:09:49, 4] param/loadparm.c:lp_load_ex(8827) pm_process() returned Yes [2010/03/30 11:09:49, 8] param/loadparm.c:add_a_service(5785) add_a_service: Creating snum = 3 for IPC$ [2010/03/30 11:09:49, 10] param/loadparm.c:hash_a_service(5832) hash_a_service: hashing index 3 for service name IPC$ [2010/03/30 11:09:49, 3] param/loadparm.c:lp_add_ipc(5934) adding IPC service [2010/03/30 11:09:49, 10] param/loadparm.c:set_server_role(8005) set_server_role: role = ROLE_DOMAIN_MEMBER [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 2] lib/interface.c:add_interface(337) added interface eth0 ip=fe80::20c:29ff:fe26:fe95%eth0 bcast=fe80::ffff:ffff:ffff:ffff%eth0 netmask=ffff:ffff:ffff:ffff:: [2010/03/30 11:09:49, 2] lib/interface.c:add_interface(337) added interface eth1 ip=fe80::20c:29ff:fe26:fe9f%eth1 bcast=fe80::ffff:ffff:ffff:ffff%eth1 netmask=ffff:ffff:ffff:ffff:: [2010/03/30 11:09:49, 2] lib/interface.c:add_interface(337) added interface eth1 ip=192.168.100.123 bcast=192.168.100.255 netmask=255.255.255.0 [2010/03/30 11:09:49, 2] lib/interface.c:add_interface(337) added interface eth0 ip=10.1.66.123 bcast=10.1.66.255 netmask=255.255.255.0 [2010/03/30 11:09:49, 5] lib/util.c:init_names(271) Netbios name list:- my_netbios_names[0]="CORMAILTEST01" [2010/03/30 11:09:49, 2] lib/interface.c:add_interface(337) added interface eth0 ip=fe80::20c:29ff:fe26:fe95%eth0 bcast=fe80::ffff:ffff:ffff:ffff%eth0 netmask=ffff:ffff:ffff:ffff:: [2010/03/30 11:09:49, 2] lib/interface.c:add_interface(337) added interface eth1 ip=fe80::20c:29ff:fe26:fe9f%eth1 bcast=fe80::ffff:ffff:ffff:ffff%eth1 netmask=ffff:ffff:ffff:ffff:: [2010/03/30 11:09:49, 2] lib/interface.c:add_interface(337) added interface eth1 ip=192.168.100.123 bcast=192.168.100.255 netmask=255.255.255.0 [2010/03/30 11:09:49, 2] lib/interface.c:add_interface(337) added interface eth0 ip=10.1.66.123 bcast=10.1.66.255 netmask=255.255.255.0 [2010/03/30 11:09:49, 5] lib/gencache.c:gencache_init(61) Opening cache file at /var/run/samba/gencache.tdb [2010/03/30 11:09:49, 5] libsmb/namecache.c:namecache_enable(59) namecache_enable: enabling netbios namecache, timeout 660 seconds [2010/03/30 11:09:49, 10] winbindd/idmap_cache.c:idmap_cache_init(59) Opening cache file at /var/cache/samba/idmap_cache.tdb [2010/03/30 11:09:49, 8] lib/util.c:fcntl_lock(2014) fcntl_lock fd=9 op=6 offset=0 count=1 type=1 [2010/03/30 11:09:49, 8] lib/util.c:fcntl_lock(2033) fcntl_lock: Lock call successful [2010/03/30 11:09:49, 4] lib/time.c:TimeInit(1287) TimeInit: Serverzone is 18000 [2010/03/30 11:09:49, 0] winbindd/winbindd_cache.c:initialize_winbindd_cache(2374) initialize_winbindd_cache: clearing cache and re-creating with version number 1 [2010/03/30 11:09:49, 5] smbd/connection.c:claim_connection(142) claiming [] [2010/03/30 11:09:49, 10] lib/dbwrap_tdb.c:db_tdb_fetch_locked(100) Locking key 545D0000FFFFFFFF0000 [2010/03/30 11:09:49, 10] lib/dbwrap_tdb.c:db_tdb_fetch_locked(129) Allocated locked data 0x0x97e4a0 [2010/03/30 11:09:49, 10] lib/dbwrap_tdb.c:db_tdb_record_destr(42) Unlocking key 545D0000FFFFFFFF0000 [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:wcache_tdc_add_domain(3822) wcache_tdc_add_domain: Adding domain BUILTIN (), SID S-1-5-32, flags = 0x0, attributes = 0x0, type = 0x0 [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3631) pack_tdc_domains: Packing 1 trusted domains [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain BUILTIN () [2010/03/30 11:09:49, 2] winbindd/winbindd_util.c:add_trusted_domain(192) Added domain BUILTIN S-1-5-32 [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:wcache_tdc_add_domain(3822) wcache_tdc_add_domain: Adding domain CORMAILTEST01 (), SID S-1-5-21-2944797316-3624137806-300041362, flags = 0x0, attributes = 0x0, type = 0x0 [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3631) pack_tdc_domains: Packing 2 trusted domains [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain BUILTIN () [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain CORMAILTEST01 () [2010/03/30 11:09:49, 2] winbindd/winbindd_util.c:add_trusted_domain(192) Added domain CORMAILTEST01 S-1-5-21-2944797316-3624137806-300041362 [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:wcache_tdc_add_domain(3822) wcache_tdc_add_domain: Adding domain RDOMAINPRV (RDOMAIN.PRV), SID S-1-5-21-807755311-932547689-390315301, flags = 0x0, attributes = 0x0, type = 0x0 [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3631) pack_tdc_domains: Packing 3 trusted domains [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain BUILTIN () [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain CORMAILTEST01 () [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain RDOMAINPRV (RDOMAIN.PRV) [2010/03/30 11:09:49, 2] winbindd/winbindd_util.c:add_trusted_domain(192) Added domain RDOMAINPRV RDOMAIN.PRV S-1-5-21-807755311-932547689-390315301 [2010/03/30 11:09:49, 10] winbindd/winbindd_cm.c:set_domain_online_request(464) set_domain_online_request: called for domain RDOMAINPRV [2010/03/30 11:09:49, 10] winbindd/winbindd_cm.c:set_domain_online_request(484) set_domain_online_request: domain RDOMAINPRV was globally offline. [2010/03/30 11:09:49, 10] lib/events.c:event_add_timed(128) Added timed event "check_domain_online_handler": 9804d0 [2010/03/30 11:09:49, 10] winbindd/winbindd_util.c:open_winbindd_socket(1207) open_winbindd_socket: opened socket fd 13 [2010/03/30 11:09:49, 10] winbindd/winbindd_util.c:open_winbindd_priv_socket(1219) open_winbindd_priv_socket: opened socket fd 14 [2010/03/30 11:09:49, 10] winbindd/winbindd_dual.c:fork_domain_child(1001) fork_domain_child called for domain 'RDOMAINPRV' [2010/03/30 11:09:49, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 4/995952 [2010/03/30 11:09:49, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 979190 [2010/03/30 11:09:49, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 4/995668 [2010/03/30 11:09:49, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 979190 "async_request_timeout" [2010/03/30 11:09:49, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:09:49, 5] winbindd/winbindd_util.c:init_child_recv(617) Received child initialization response for domain RDOMAINPRV [2010/03/30 11:09:49, 8] winbindd/winbindd_cm.c:connection_ok(1563) connection_ok: Connection to for domain RDOMAINPRV has NULL cli! [2010/03/30 11:09:49, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = SAF/DOMAIN/RDOMAINPRV, value = ADDC05.rdomain.prv, timeout = Tue Mar 30 11:24:49 2010 [2010/03/30 11:09:49, 5] libsmb/namequery.c:saf_fetch(138) saf_fetch: Returning "ADDC05.rdomain.prv" for "RDOMAINPRV" domain [2010/03/30 11:09:49, 10] winbindd/winbindd_cm.c:cm_open_connection(1398) cm_open_connection: saf_servername is 'ADDC05.rdomain.prv' for domain RDOMAINPRV [2010/03/30 11:09:49, 10] winbindd/winbindd_cm.c:cm_open_connection(1430) cm_open_connection: dcname is 'ADDC05.rdomain.prv' for domain RDOMAINPRV [2010/03/30 11:09:49, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = AD_SITENAME/DOMAIN/RDOMAIN.PRV, value = DataCenter, timeout = Sun Feb 7 00:28:15 2106 [2010/03/30 11:09:49, 5] libads/dns.c:sitename_fetch(817) sitename_fetch: Returning sitename for RDOMAIN.PRV: "DataCenter" [2010/03/30 11:09:49, 10] libsmb/namequery.c:internal_resolve_name(1443) internal_resolve_name: looking up ADDC05.rdomain.prv#20 (sitename DataCenter) [2010/03/30 11:09:49, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = NBT/ADDC05.RDOMAIN.PRV#20, value = 10.1.66.12:0, timeout = Tue Mar 30 11:20:42 2010 [2010/03/30 11:09:49, 5] libsmb/namecache.c:namecache_fetch(233) name ADDC05.rdomain.prv#20 found. [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 5] lib/charcnv.c:charset_name(82) Substituting charset 'UTF-8' for LOCALE [2010/03/30 11:09:49, 10] winbindd/winbindd_cm.c:cm_prepare_connection(753) cm_prepare_connection: connecting to DC ADDC05.rdomain.prv for domain RDOMAINPRV [2010/03/30 11:09:49, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,194) [2010/03/30 11:09:49, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,194) wrote 194 [2010/03/30 11:09:49, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 181 [2010/03/30 11:09:49, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:49, 5] lib/util.c:show_msg(652) size=181 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=23892 smb_uid=0 smb_mid=1 smt_wct=17 smb_vwv[ 0]= 9 (0x9) smb_vwv[ 1]=12815 (0x320F) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]= 499 (0x1F3) smb_vwv[11]=16512 (0x4080) smb_vwv[12]=44607 (0xAE3F) smb_vwv[13]= 9068 (0x236C) smb_vwv[14]=51920 (0xCAD0) smb_vwv[15]=11265 (0x2C01) smb_vwv[16]= 1 (0x1) smb_bcc=112 [2010/03/30 11:09:49, 10] lib/util.c:dump_data(2223) [000] BC 07 BB F3 C3 2C D3 45 B6 C5 8A 0B DC 83 41 9F .....,.E ......A. [010] 60 5E 06 06 2B 06 01 05 05 02 A0 54 30 52 A0 30 `^..+... ...T0R.0 [020] 30 2E 06 09 2A 86 48 82 F7 12 01 02 02 06 09 2A 0...*.H. .......* [030] 86 48 86 F7 12 01 02 02 06 0A 2A 86 48 86 F7 12 .H...... ..*.H... [040] 01 02 02 03 06 0A 2B 06 01 04 01 82 37 02 02 0A ......+. ....7... [050] A3 1E 30 1C A0 1A 1B 18 61 75 72 61 64 64 6F 6D ..0..... auraddom [060] 30 35 24 40 50 52 4F 54 4F 43 4F 4C 2E 50 52 56 05$@PROT OCOL.PRV [2010/03/30 11:09:49, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:49, 5] lib/util.c:show_msg(652) size=181 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=23892 smb_uid=0 smb_mid=1 smt_wct=17 smb_vwv[ 0]= 9 (0x9) smb_vwv[ 1]=12815 (0x320F) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]= 499 (0x1F3) smb_vwv[11]=16512 (0x4080) smb_vwv[12]=44607 (0xAE3F) smb_vwv[13]= 9068 (0x236C) smb_vwv[14]=51920 (0xCAD0) smb_vwv[15]=11265 (0x2C01) smb_vwv[16]= 1 (0x1) smb_bcc=112 [2010/03/30 11:09:49, 10] lib/util.c:dump_data(2223) [000] BC 07 BB F3 C3 2C D3 45 B6 C5 8A 0B DC 83 41 9F .....,.E ......A. [010] 60 5E 06 06 2B 06 01 05 05 02 A0 54 30 52 A0 30 `^..+... ...T0R.0 [020] 30 2E 06 09 2A 86 48 82 F7 12 01 02 02 06 09 2A 0...*.H. .......* [030] 86 48 86 F7 12 01 02 02 06 0A 2A 86 48 86 F7 12 .H...... ..*.H... [040] 01 02 02 03 06 0A 2B 06 01 04 01 82 37 02 02 0A ......+. ....7... [050] A3 1E 30 1C A0 1A 1B 18 61 75 72 61 64 64 6F 6D ..0..... auraddom [060] 30 35 24 40 50 52 4F 54 4F 43 4F 4C 2E 50 52 56 05$@PROT OCOL.PRV [2010/03/30 11:09:49, 5] winbindd/winbindd_cm.c:cm_prepare_connection(831) connecting to ADDC05.rdomain.prv from CORMAILTEST01 with kerberos principal [CORMAILTEST01$@RDOMAIN.PRV] and realm [rdomain.prv] [2010/03/30 11:09:49, 3] libsmb/cliconnect.c:cli_session_setup_spnego(804) Doing spnego session setup (blob length=112) [2010/03/30 11:09:49, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 2 840 48018 1 2 2 [2010/03/30 11:09:49, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 2 840 113554 1 2 2 [2010/03/30 11:09:49, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 2 840 113554 1 2 2 3 [2010/03/30 11:09:49, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 3 6 1 4 1 311 2 2 10 [2010/03/30 11:09:49, 3] libsmb/cliconnect.c:cli_session_setup_spnego(839) got principal=auraddom05$@RDOMAIN.PRV [2010/03/30 11:09:49, 10] libads/kerberos.c:kerberos_kinit_password_ext(217) kerberos_kinit_password: as CORMAILTEST01$@RDOMAIN.PRV using [MEMORY:cliconnect] as ccache and config [(null)] [2010/03/30 11:09:49, 2] libsmb/cliconnect.c:cli_session_setup_kerberos(619) Doing kerberos session setup [2010/03/30 11:09:50, 3] libsmb/clikrb5.c:ads_cleanup_expired_creds(604) ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect] expiration Tue, 30 Mar 2010 21:09:49 CDT [2010/03/30 11:09:50, 10] libsmb/clikrb5.c:ads_krb5_mk_req(702) ads_krb5_mk_req: Ticket (auraddom05$@RDOMAIN.PRV) in ccache (MEMORY:cliconnect) is valid until: (Tue, 30 Mar 2010 21:09:49 CDT - 1270001389) [2010/03/30 11:09:50, 3] libsmb/clikrb5.c:ads_krb5_mk_req(713) ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT [2010/03/30 11:09:50, 10] libsmb/clikrb5.c:get_krb5_smb_session_key(873) Got KRB5 session key of length 16 [2010/03/30 11:09:50, 5] libsmb/smb_signing.c:set_smb_signing_real_common(140) Mandatory SMB signing enabled! [2010/03/30 11:09:50, 5] libsmb/smb_signing.c:set_smb_signing_real_common(144) SMB signing enabled! [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:cli_simple_set_signing(494) cli_simple_set_signing: user_session_key [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 1E 7A 06 7E 77 91 8E 42 41 A7 B2 04 E4 F0 55 C6 .z.~w..B A.....U. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:cli_simple_set_signing(502) cli_simple_set_signing: NULL response_data [2010/03/30 11:09:50, 10] libsmb/cliconnect.c:cli_session_setup_blob(578) cli_session_setup_blob: Remaining (0) sending (2532) current (2532) [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 0 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 6D E6 DD 2C 02 75 AF A1 m..,.u.. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 1 mid = 2 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,2618) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,2618) wrote 2618 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 209 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=209 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=0 smb_pid=23892 smb_uid=18433 smb_mid=2 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 209 (0xD1) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 26 (0x1A) smb_bcc=166 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] A1 18 30 16 A0 03 0A 01 00 A1 0B 06 09 2A 86 48 ..0..... .....*.H [010] 82 F7 12 01 02 02 A2 02 04 00 89 57 00 69 00 6E ........ ...W.i.n [020] 00 64 00 6F 00 77 00 73 00 20 00 53 00 65 00 72 .d.o.w.s . .S.e.r [030] 00 76 00 65 00 72 00 20 00 32 00 30 00 30 00 33 .v.e.r. .2.0.0.3 [040] 00 20 00 52 00 32 00 20 00 33 00 37 00 39 00 30 . .R.2. .3.7.9.0 [050] 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 . .S.e.r .v.i.c.e [060] 00 20 00 50 00 61 00 63 00 6B 00 20 00 32 00 00 . .P.a.c .k. .2.. [070] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. [080] 00 53 00 65 00 72 00 76 00 65 00 72 00 20 00 32 .S.e.r.v .e.r. .2 [090] 00 30 00 30 00 33 00 20 00 52 00 32 00 20 00 35 .0.0.3. .R.2. .5 [0A0] 00 2E 00 32 00 00 ...2.. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 1 mid = 2 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 1 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 1: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 97 86 E6 03 1B 1E 73 F7 ......s. [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=209 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=0 smb_pid=23892 smb_uid=18433 smb_mid=2 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 209 (0xD1) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 26 (0x1A) smb_bcc=166 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] A1 18 30 16 A0 03 0A 01 00 A1 0B 06 09 2A 86 48 ..0..... .....*.H [010] 82 F7 12 01 02 02 A2 02 04 00 89 57 00 69 00 6E ........ ...W.i.n [020] 00 64 00 6F 00 77 00 73 00 20 00 53 00 65 00 72 .d.o.w.s . .S.e.r [030] 00 76 00 65 00 72 00 20 00 32 00 30 00 30 00 33 .v.e.r. .2.0.0.3 [040] 00 20 00 52 00 32 00 20 00 33 00 37 00 39 00 30 . .R.2. .3.7.9.0 [050] 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 . .S.e.r .v.i.c.e [060] 00 20 00 50 00 61 00 63 00 6B 00 20 00 32 00 00 . .P.a.c .k. .2.. [070] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. [080] 00 53 00 65 00 72 00 76 00 65 00 72 00 20 00 32 .S.e.r.v .e.r. .2 [090] 00 30 00 30 00 33 00 20 00 52 00 32 00 20 00 35 .0.0.3. .R.2. .5 [0A0] 00 2E 00 32 00 00 ...2.. [2010/03/30 11:09:50, 10] libsmb/clientgen.c:cli_init_creds(415) cli_init_creds: user CORMAILTEST01$ domain RDOMAINPRV [2010/03/30 11:09:50, 10] libsmb/namequery.c:saf_store(75) saf_store: domain = [RDOMAINPRV], server = [ADDC05.rdomain.prv], expire = [1269966290] [2010/03/30 11:09:50, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = SAF/DOMAIN/RDOMAINPRV; value = ADDC05.rdomain.prv and timeout = Tue Mar 30 11:24:50 2010 (900 seconds ahead) [2010/03/30 11:09:50, 10] libsmb/namequery.c:saf_store(75) saf_store: domain = [rdomain.prv], server = [ADDC05.rdomain.prv], expire = [1269966290] [2010/03/30 11:09:50, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = SAF/DOMAIN/RDOMAIN.PRV; value = ADDC05.rdomain.prv and timeout = Tue Mar 30 11:24:50 2010 (900 seconds ahead) [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 2 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] A6 F7 56 0E 39 53 04 F3 ..V.9S.. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 3 mid = 3 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,114) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,114) wrote 114 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 56 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=56 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=3 smt_wct=7 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 56 (0x38) smb_vwv[ 2]= 1 (0x1) smb_vwv[ 3]= 511 (0x1FF) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 511 (0x1FF) smb_vwv[ 6]= 0 (0x0) smb_bcc=7 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 49 50 43 00 00 00 00 IPC.... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 3 mid = 3 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 3 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 3: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 82 24 A3 91 79 F6 49 A7 .$..y.I. [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:set_global_winbindd_state_online(2859) set_global_winbindd_state_online: online requested. [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:set_global_winbindd_state_online(2862) set_global_winbindd_state_online: rejecting. [2010/03/30 11:09:50, 10] winbindd/winbindd_cm.c:set_domain_online(385) set_domain_online: called for domain RDOMAINPRV [2010/03/30 11:09:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9804d0 "check_domain_online_handler" [2010/03/30 11:09:50, 10] winbindd/winbindd_cm.c:set_dc_type_and_flags(1917) set_dc_type_and_flags: setting up flags for primary domain [2010/03/30 11:09:50, 5] winbindd/winbindd_cm.c:set_dc_type_and_flags_connect(1765) set_dc_type_and_flags_connect: domain RDOMAINPRV [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 4 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 21 43 02 41 53 91 2B 8E !C.AS.+. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 5 mid = 4 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,104) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,104) wrote 104 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 103 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=4 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 103 (0x67) smb_vwv[ 2]= 2816 (0xB00) smb_vwv[ 3]= 384 (0x180) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 16 (0x10) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 5 mid = 4 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 5 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 5: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] C8 45 70 C8 02 26 D5 A9 .Ep..&.. [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2049) Bind RPC Pipe[800b]: \lsarpc auth_type 0, auth_level 0 [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) Bind Abstract Syntax: [000] 6A 28 19 39 0C B1 D0 11 9B A8 00 C0 4F D9 2E F5 j(.9.... ....O... [010] 00 00 00 00 .... [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1653) Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [010] 02 00 00 00 .... [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0b [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0048 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000001 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_rb [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 00000000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0018 num_contexts: 01 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 001c context_id : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 001e num_transfer_syntaxes: 01 [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 00001f smb_io_rpc_iface [2010/03/30 11:09:50, 7] rpc_parse/parse_prs.c:prs_debug(88) 000020 smb_io_uuid uuid [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0020 data : 3919286a [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0024 data : b10c [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0026 data : 11d0 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0028 data : 9b a8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002a data : 00 c0 4f d9 2e f5 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 version: 00000000 [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_rpc_iface [2010/03/30 11:09:50, 7] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_uuid uuid [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0034 data : 8a885d04 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0038 data : 1ceb [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 003a data : 11c9 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003c data : 9f e8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003e data : 08 00 2b 10 48 60 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0044 version: 00000002 [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800b [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=5 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32779 (0x800B) smb_bcc=87 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 6A ........ .......j [030] 28 19 39 0C B1 D0 11 9B A8 00 C0 4F D9 2E F5 00 (.9..... ...O.... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 6 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] C7 AE AB 82 23 8C CD CA ....#... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 7 mid = 5 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,158) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,158) wrote 158 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 124 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=5 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... [010] 00 B8 10 B8 10 5A 3B 0C 00 0C 00 5C 50 49 50 45 .....Z;. ...\PIPE [020] 5C 6C 73 61 73 73 00 FD 27 01 00 00 00 00 00 00 \lsass.. '....... [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 7 mid = 5 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 7 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 7: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 83 4C 64 B5 39 5F CF E9 .Ld.9_.. [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=5 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... [010] 00 B8 10 B8 10 5A 3B 0C 00 0C 00 5C 50 49 50 45 .....Z;. ...\PIPE [020] 5C 6C 73 61 73 73 00 FD 27 01 00 00 00 00 00 00 \lsass.. '....... [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 7 mid = 5 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000001 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 68 at offset 0 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800b returned 68 bytes. [2010/03/30 11:09:50, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2086) rpc_pipe_bind: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800b bind request returned ok. [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000001 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_ba [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 000c3b5a [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000018 smb_io_rpc_addr_str [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0018 len: 000c [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 001a str: \PIPE\lsass. [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000026 smb_io_rpc_results [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0028 num_results: 01 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002c result : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002e reason : 0000 [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_rpc_iface [2010/03/30 11:09:50, 7] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_uuid uuid [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 data : 8a885d04 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0034 data : 1ceb [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0036 data : 11c9 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0038 data : 9f e8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003a data : 08 00 2b 10 48 60 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0040 version: 00000002 [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:check_bind_response(1704) check_bind_response: accepted! [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2282) cli_rpc_pipe_open_noauth: opened pipe \lsarpc to machine ADDC05.rdomain.prv and bound anonymously. dssetup_DsRoleGetPrimaryDomainInformation: struct dssetup_DsRoleGetPrimaryDomainInformation in: struct dssetup_DsRoleGetPrimaryDomainInformation level : DS_ROLE_BASIC_INFORMATION (1) [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 001a [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000002 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000002 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 0000 [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800b [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=108 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=6 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 26 (0x1A) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 26 (0x1A) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32779 (0x800B) smb_bcc=41 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 1A 00 00 00 02 00 00 00 02 ........ ........ [020] 00 00 00 00 00 00 00 01 00 ........ . [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 8 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 22 55 96 2D 75 BA 0A 65 "U.-u..e [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 9 mid = 6 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,112) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,112) wrote 112 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 244 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=244 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=6 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 188 (0xBC) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 188 (0xBC) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=189 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 BC 00 00 00 02 00 00 ........ ........ [010] 00 A4 00 00 00 00 00 00 00 00 00 02 00 01 00 00 ........ ........ [020] 00 04 00 00 00 01 00 00 01 04 00 02 00 08 00 02 ........ ........ [030] 00 0C 00 02 00 06 FE 65 45 9D C7 08 4B 94 F0 D6 .......e E...K... [040] 71 45 2E B6 AA 0C 00 00 00 00 00 00 00 0C 00 00 qE...... ........ [050] 00 50 00 52 00 4F 00 54 00 4F 00 43 00 4F 00 4C .P.R.O.T .O.C.O.L [060] 00 50 00 52 00 56 00 00 00 0D 00 00 00 00 00 00 .P.R.V.. ........ [070] 00 0D 00 00 00 70 00 72 00 6F 00 74 00 6F 00 63 .....p.r .o.t.o.c [080] 00 6F 00 6C 00 2E 00 70 00 72 00 76 00 00 00 02 .o.l...p .r.v.... [090] 00 0D 00 00 00 00 00 00 00 0D 00 00 00 70 00 72 ........ .....p.r [0A0] 00 6F 00 74 00 6F 00 63 00 6F 00 6C 00 2E 00 70 .o.t.o.c .o.l...p [0B0] 00 72 00 76 00 00 00 76 00 00 00 00 00 .r.v...v ..... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 9 mid = 6 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 9 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 9: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 4E CA F4 16 81 D1 72 98 N.....r. [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=244 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=6 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 188 (0xBC) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 188 (0xBC) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=189 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 BC 00 00 00 02 00 00 ........ ........ [010] 00 A4 00 00 00 00 00 00 00 00 00 02 00 01 00 00 ........ ........ [020] 00 04 00 00 00 01 00 00 01 04 00 02 00 08 00 02 ........ ........ [030] 00 0C 00 02 00 06 FE 65 45 9D C7 08 4B 94 F0 D6 .......e E...K... [040] 71 45 2E B6 AA 0C 00 00 00 00 00 00 00 0C 00 00 qE...... ........ [050] 00 50 00 52 00 4F 00 54 00 4F 00 43 00 4F 00 4C .P.R.O.T .O.C.O.L [060] 00 50 00 52 00 56 00 00 00 0D 00 00 00 00 00 00 .P.R.V.. ........ [070] 00 0D 00 00 00 70 00 72 00 6F 00 74 00 6F 00 63 .....p.r .o.t.o.c [080] 00 6F 00 6C 00 2E 00 70 00 72 00 76 00 00 00 02 .o.l...p .r.v.... [090] 00 0D 00 00 00 00 00 00 00 0D 00 00 00 70 00 72 ........ .....p.r [0A0] 00 6F 00 74 00 6F 00 63 00 6F 00 6C 00 2E 00 70 .o.t.o.c .o.l...p [0B0] 00 72 00 76 00 00 00 76 00 00 00 00 00 .r.v...v ..... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 9 mid = 6 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 00bc [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000002 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 000000a4 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 188, data_len 164, ss_len 0 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 188 at offset 0 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800b returned 328 bytes. dssetup_DsRoleGetPrimaryDomainInformation: struct dssetup_DsRoleGetPrimaryDomainInformation out: struct dssetup_DsRoleGetPrimaryDomainInformation info : * info : union dssetup_DsRoleInfo(case 1) basic: struct dssetup_DsRolePrimaryDomInfoBasic role : DS_ROLE_BACKUP_DC (4) flags : 0x01000001 (16777217) 1: DS_ROLE_PRIMARY_DS_RUNNING 0: DS_ROLE_PRIMARY_DS_MIXED_MODE 0: DS_ROLE_UPGRADE_IN_PROGRESS 1: DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT domain : * domain : 'RDOMAINPRV' dns_domain : * dns_domain : 'rdomain.prv' forest : * forest : 'rdomain.prv' domain_guid : 4565fe06-c79d-4b08-94f0-d671452eb6aa result : WERR_OK [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 10 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] AE 3D 07 41 5F 7E CC 0D .=.A_~.. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 11 mid = 7 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,45) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,45) wrote 45 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 35 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=7 smt_wct=0 smb_bcc=0 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 11 mid = 7 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 11 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 11: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 2D 7E 05 81 09 11 63 9D -~....c. [2010/03/30 11:09:50, 10] libsmb/clientgen.c:cli_rpc_pipe_close(553) cli_rpc_pipe_close: closed pipe \lsarpc to machine ADDC05.rdomain.prv [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 12 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 11 01 24 96 C3 51 95 11 ..$..Q.. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 13 mid = 8 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,104) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,104) wrote 104 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 103 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=8 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 103 (0x67) smb_vwv[ 2]= 3072 (0xC00) smb_vwv[ 3]= 384 (0x180) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 16 (0x10) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 13 mid = 8 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 13 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 13: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 7A 2B CF 67 1F 13 6B 03 z+.g..k. [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2049) Bind RPC Pipe[800c]: \lsarpc auth_type 0, auth_level 0 [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. [010] 00 00 00 00 .... [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1653) Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [010] 02 00 00 00 .... [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0b [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0048 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000003 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_rb [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 00000000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0018 num_contexts: 01 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 001c context_id : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 001e num_transfer_syntaxes: 01 [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 00001f smb_io_rpc_iface [2010/03/30 11:09:50, 7] rpc_parse/parse_prs.c:prs_debug(88) 000020 smb_io_uuid uuid [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0020 data : 12345778 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0024 data : 1234 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0026 data : abcd [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0028 data : ef 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002a data : 01 23 45 67 89 ab [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 version: 00000000 [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_rpc_iface [2010/03/30 11:09:50, 7] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_uuid uuid [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0034 data : 8a885d04 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0038 data : 1ceb [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 003a data : 11c9 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003c data : 9f e8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003e data : 08 00 2b 10 48 60 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0044 version: 00000002 [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800c [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=9 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32780 (0x800C) smb_bcc=87 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 03 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 W4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 14 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] E8 BF 6B ED 9B 3D EC 0E ..k..=.. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 15 mid = 9 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,158) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,158) wrote 158 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 124 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=9 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 03 00 00 ........ .D...... [010] 00 B8 10 B8 10 5B 3B 0C 00 0C 00 5C 50 49 50 45 .....[;. ...\PIPE [020] 5C 6C 73 61 73 73 00 00 01 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 15 mid = 9 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 15 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 15: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] A4 1E 86 11 6B DB EF 6F ....k..o [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=9 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 03 00 00 ........ .D...... [010] 00 B8 10 B8 10 5B 3B 0C 00 0C 00 5C 50 49 50 45 .....[;. ...\PIPE [020] 5C 6C 73 61 73 73 00 00 01 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 15 mid = 9 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000003 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 68 at offset 0 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800c returned 68 bytes. [2010/03/30 11:09:50, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2086) rpc_pipe_bind: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800c bind request returned ok. [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000003 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_ba [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 000c3b5b [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000018 smb_io_rpc_addr_str [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0018 len: 000c [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 001a str: \PIPE\lsass. [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000026 smb_io_rpc_results [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0028 num_results: 01 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002c result : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002e reason : 0000 [2010/03/30 11:09:50, 6] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_rpc_iface [2010/03/30 11:09:50, 7] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_uuid uuid [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 data : 8a885d04 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0034 data : 1ceb [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0036 data : 11c9 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0038 data : 9f e8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003a data : 08 00 2b 10 48 60 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0040 version: 00000002 [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:check_bind_response(1704) check_bind_response: accepted! [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2282) cli_rpc_pipe_open_noauth: opened pipe \lsarpc to machine ADDC05.rdomain.prv and bound anonymously. [2010/03/30 11:09:50, 5] rpc_client/init_lsa.c:init_lsa_sec_qos(70) init_lsa_sec_qos [2010/03/30 11:09:50, 5] rpc_client/init_lsa.c:init_lsa_obj_attr(90) init_lsa_obj_attr lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '' attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0050 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000004 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000038 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 002c [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800c [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=162 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=10 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 80 (0x50) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 80 (0x50) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32780 (0x800C) smb_bcc=95 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 50 00 00 00 04 00 00 00 38 .......P .......8 [020] 00 00 00 00 00 2C 00 00 00 02 00 01 00 00 00 00 .....,.. ........ [030] 00 00 00 01 00 00 00 00 00 00 00 18 00 00 00 00 ........ ........ [040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 ........ ........ [050] 00 02 00 0C 00 00 00 02 00 01 00 00 00 00 02 ........ ....... [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 16 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 9F 85 62 41 D8 D8 78 EB ..bA..x. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 17 mid = 10 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,166) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,166) wrote 166 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 104 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=10 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 16 12 65 ........ .......e [020] 23 F4 5B 36 40 8C EC 33 16 6D 29 13 5F 00 00 00 #.[6@..3 .m)._... [030] 00 . [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 17 mid = 10 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 17 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 17: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 59 26 C8 B5 A2 ED A9 09 Y&...... [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=10 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 16 12 65 ........ .......e [020] 23 F4 5B 36 40 8C EC 33 16 6D 29 13 5F 00 00 00 #.[6@..3 .m)._... [030] 00 . [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 17 mid = 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0030 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000004 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000018 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 48, data_len 24, ss_len 0 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 48 at offset 0 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800c returned 48 bytes. lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 23651216-5bf4-4036-8cec-33166d29135f result : NT_STATUS_OK lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 in: struct lsa_QueryInfoPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 23651216-5bf4-4036-8cec-33166d29135f level : LSA_POLICY_INFO_DNS (12) [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 002e [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000005 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000016 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 002e [2010/03/30 11:09:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800c [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=11 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 46 (0x2E) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 46 (0x2E) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32780 (0x800C) smb_bcc=61 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 2E 00 00 00 05 00 00 00 16 ........ ........ [020] 00 00 00 00 00 2E 00 00 00 00 00 16 12 65 23 F4 ........ .....e#. [030] 5B 36 40 8C EC 33 16 6D 29 13 5F 0C 00 [6@..3.m )._.. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 18 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] FE 44 28 DB 6B DE 77 1A .D(.k.w. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 19 mid = 11 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,132) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,132) wrote 132 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 272 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=272 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=11 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 216 (0xD8) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 216 (0xD8) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=217 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 D8 00 00 00 05 00 00 ........ ........ [010] 00 C0 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 ........ ........ [020] 00 16 00 18 00 04 00 02 00 18 00 1A 00 08 00 02 ........ ........ [030] 00 18 00 1A 00 0C 00 02 00 06 FE 65 45 9D C7 08 ........ ...eE... [040] 4B 94 F0 D6 71 45 2E B6 AA 10 00 02 00 0C 00 00 K...qE.. ........ [050] 00 00 00 00 00 0B 00 00 00 50 00 52 00 4F 00 54 ........ .P.R.O.T [060] 00 4F 00 43 00 4F 00 4C 00 50 00 52 00 56 00 00 .O.C.O.L .P.R.V.. [070] 00 0D 00 00 00 00 00 00 00 0C 00 00 00 70 00 72 ........ .....p.r [080] 00 6F 00 74 00 6F 00 63 00 6F 00 6C 00 2E 00 70 .o.t.o.c .o.l...p [090] 00 72 00 76 00 0D 00 00 00 00 00 00 00 0C 00 00 .r.v.... ........ [0A0] 00 70 00 72 00 6F 00 74 00 6F 00 63 00 6F 00 6C .p.r.o.t .o.c.o.l [0B0] 00 2E 00 70 00 72 00 76 00 04 00 00 00 01 04 00 ...p.r.v ........ [0C0] 00 00 00 00 05 15 00 00 00 2F 5E 25 30 69 8C 95 ........ ./^%0i.. [0D0] 37 25 BD 43 17 00 00 00 00 7%.C.... . [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 19 mid = 11 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 19 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 19: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] A3 32 C0 F9 B8 98 B2 76 .2.....v [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=272 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=11 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 216 (0xD8) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 216 (0xD8) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=217 [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 D8 00 00 00 05 00 00 ........ ........ [010] 00 C0 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 ........ ........ [020] 00 16 00 18 00 04 00 02 00 18 00 1A 00 08 00 02 ........ ........ [030] 00 18 00 1A 00 0C 00 02 00 06 FE 65 45 9D C7 08 ........ ...eE... [040] 4B 94 F0 D6 71 45 2E B6 AA 10 00 02 00 0C 00 00 K...qE.. ........ [050] 00 00 00 00 00 0B 00 00 00 50 00 52 00 4F 00 54 ........ .P.R.O.T [060] 00 4F 00 43 00 4F 00 4C 00 50 00 52 00 56 00 00 .O.C.O.L .P.R.V.. [070] 00 0D 00 00 00 00 00 00 00 0C 00 00 00 70 00 72 ........ .....p.r [080] 00 6F 00 74 00 6F 00 63 00 6F 00 6C 00 2E 00 70 .o.t.o.c .o.l...p [090] 00 72 00 76 00 0D 00 00 00 00 00 00 00 0C 00 00 .r.v.... ........ [0A0] 00 70 00 72 00 6F 00 74 00 6F 00 63 00 6F 00 6C .p.r.o.t .o.c.o.l [0B0] 00 2E 00 70 00 72 00 76 00 04 00 00 00 01 04 00 ...p.r.v ........ [0C0] 00 00 00 00 05 15 00 00 00 2F 5E 25 30 69 8C 95 ........ ./^%0i.. [0D0] 37 25 BD 43 17 00 00 00 00 7%.C.... . [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 19 mid = 11 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 00d8 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000005 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 000000c0 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2010/03/30 11:09:50, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 216, data_len 192, ss_len 0 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 216 at offset 0 [2010/03/30 11:09:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \lsarpc fnum 0x800c returned 384 bytes. lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 out: struct lsa_QueryInfoPolicy2 info : * info : * info : union lsa_PolicyInformation(case 12) dns: struct lsa_DnsDomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'RDOMAINPRV' dns_domain: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'rdomain.prv' dns_forest: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'rdomain.prv' domain_guid : 4565fe06-c79d-4b08-94f0-d671452eb6aa sid : * sid : S-1-5-21-807755311-932547689-390315301 result : NT_STATUS_OK [2010/03/30 11:09:50, 5] winbindd/winbindd_cm.c:set_dc_type_and_flags_connect(1895) set_dc_type_and_flags_connect: domain RDOMAINPRV is in native mode. [2010/03/30 11:09:50, 5] winbindd/winbindd_cm.c:set_dc_type_and_flags_connect(1898) set_dc_type_and_flags_connect: domain RDOMAINPRV is running active directory. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 20 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 49 FF E8 E6 39 88 31 B0 I...9.1. [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 21 mid = 12 [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,45) [2010/03/30 11:09:50, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,45) wrote 45 [2010/03/30 11:09:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 35 [2010/03/30 11:09:50, 5] lib/util.c:show_msg(642) [2010/03/30 11:09:50, 5] lib/util.c:show_msg(652) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=12 smt_wct=0 smb_bcc=0 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 21 mid = 12 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 21 [2010/03/30 11:09:50, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 21: got good SMB signature of [2010/03/30 11:09:50, 10] lib/util.c:dump_data(2223) [000] 1D A5 40 7C 24 65 FB 16 ..@|$e.. [2010/03/30 11:09:50, 10] libsmb/clientgen.c:cli_rpc_pipe_close(553) cli_rpc_pipe_close: closed pipe \lsarpc to machine ADDC05.rdomain.prv [2010/03/30 11:09:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:09:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999956 [2010/03/30 11:09:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:wcache_tdc_add_domain(3822) wcache_tdc_add_domain: Adding domain EXTRDOMAINPRV (external.rdomain.prv), SID S-1-5-21-1597506669-720194359-3590636158, flags = 0x0, attributes = 0x0, type = 0x0 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:add_wbdomain_to_tdc_array(3547) add_wbdomain_to_tdc_array: Found existing record for EXTRDOMAINPRV [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3631) pack_tdc_domains: Packing 8 trusted domains [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain BUILTIN () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain CORMAILTEST01 () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain RDOMAINPRV (rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain EXTRDOMAINPRV (external.rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain USTNET () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain SDOMAIN () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain MEC () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain KID (kid.rdomain.prv) [2010/03/30 11:09:50, 2] winbindd/winbindd_util.c:add_trusted_domain(192) Added domain EXTRDOMAINPRV external.rdomain.prv S-1-5-21-1597506669-720194359-3590636158 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:wcache_tdc_add_domain(3822) wcache_tdc_add_domain: Adding domain USTNET (USTNET), SID S-1-5-21-1803833563-1315966708-355810188, flags = 0x0, attributes = 0x0, type = 0x0 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:add_wbdomain_to_tdc_array(3547) add_wbdomain_to_tdc_array: Found existing record for USTNET [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3631) pack_tdc_domains: Packing 8 trusted domains [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain BUILTIN () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain CORMAILTEST01 () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain RDOMAINPRV (rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain EXTRDOMAINPRV (external.rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain USTNET (USTNET) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain SDOMAIN () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain MEC () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain KID (kid.rdomain.prv) [2010/03/30 11:09:50, 2] winbindd/winbindd_util.c:add_trusted_domain(192) Added domain USTNET USTNET S-1-5-21-1803833563-1315966708-355810188 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:wcache_tdc_add_domain(3822) wcache_tdc_add_domain: Adding domain SDOMAIN (SDOMAIN), SID S-1-5-21-2100367721-831330134-1706709998, flags = 0x0, attributes = 0x0, type = 0x0 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:add_wbdomain_to_tdc_array(3547) add_wbdomain_to_tdc_array: Found existing record for SDOMAIN [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3631) pack_tdc_domains: Packing 8 trusted domains [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain BUILTIN () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain CORMAILTEST01 () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain RDOMAINPRV (rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain EXTRDOMAINPRV (external.rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain USTNET (USTNET) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain SDOMAIN (SDOMAIN) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain MEC () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain KID (kid.rdomain.prv) [2010/03/30 11:09:50, 2] winbindd/winbindd_util.c:add_trusted_domain(192) Added domain SDOMAIN SDOMAIN S-1-5-21-2100367721-831330134-1706709998 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:wcache_tdc_add_domain(3822) wcache_tdc_add_domain: Adding domain MEC (MEC), SID S-1-5-21-1702257101-1623065054-1714775081, flags = 0x0, attributes = 0x0, type = 0x0 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:add_wbdomain_to_tdc_array(3547) add_wbdomain_to_tdc_array: Found existing record for MEC [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3631) pack_tdc_domains: Packing 8 trusted domains [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain BUILTIN () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain CORMAILTEST01 () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain RDOMAINPRV (rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain EXTRDOMAINPRV (external.rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain USTNET (USTNET) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain SDOMAIN (SDOMAIN) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain MEC (MEC) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain KID (kid.rdomain.prv) [2010/03/30 11:09:50, 2] winbindd/winbindd_util.c:add_trusted_domain(192) Added domain MEC MEC S-1-5-21-1702257101-1623065054-1714775081 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:wcache_tdc_add_domain(3822) wcache_tdc_add_domain: Adding domain KID (kid.rdomain.prv), SID S-1-5-21-29899443-2986348974-2400605501, flags = 0x0, attributes = 0x0, type = 0x0 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:add_wbdomain_to_tdc_array(3547) add_wbdomain_to_tdc_array: Found existing record for KID [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3631) pack_tdc_domains: Packing 8 trusted domains [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain BUILTIN () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain CORMAILTEST01 () [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain RDOMAINPRV (rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain EXTRDOMAINPRV (external.rdomain.prv) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain USTNET (USTNET) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain SDOMAIN (SDOMAIN) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain MEC (MEC) [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:pack_tdc_domains(3650) pack_tdc_domains: Packing domain KID (kid.rdomain.prv) [2010/03/30 11:09:50, 2] winbindd/winbindd_util.c:add_trusted_domain(192) Added domain KID kid.rdomain.prv S-1-5-21-29899443-2986348974-2400605501 [2010/03/30 11:09:50, 10] winbindd/winbindd_util.c:rescan_forest_root_trusts(407) rescan_forest_root_trusts: Following trust path for domain tree root RDOMAINPRV (rdomain.prv) [2010/03/30 11:09:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97c7a0 [2010/03/30 11:09:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 11:09:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97c7a0 "async_request_timeout" [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:09:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:09:59, 6] winbindd/winbindd.c:new_connection(717) accepted socket 19 [2010/03/30 11:09:59, 10] winbindd/winbindd.c:process_request(402) process_request: request fn INTERFACE_VERSION [2010/03/30 11:09:59, 3] winbindd/winbindd_misc.c:winbindd_interface_version(757) [23899]: request interface version [2010/03/30 11:09:59, 10] winbindd/winbindd.c:process_request(402) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2010/03/30 11:09:59, 3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790) [23899]: request location of privileged pipe [2010/03/30 11:09:59, 6] winbindd/winbindd.c:new_connection(717) accepted socket 20 [2010/03/30 11:09:59, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETPWNAM [2010/03/30 11:09:59, 3] winbindd/winbindd_user.c:winbindd_getpwnam(373) [23899]: getpwnam RDOMAINPRV\plauss [2010/03/30 11:09:59, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:09:59, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 11:09:59, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:09:59, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:09:59, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:09:59, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999967 [2010/03/30 11:09:59, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:09:59, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:09:59, 10] winbindd/winbindd_dual.c:fork_domain_child(1003) fork_domain_child called without domain. [2010/03/30 11:09:59, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:09:59, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999857 [2010/03/30 11:09:59, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:09:59, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:09:59, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-513 to a gid [2010/03/30 11:09:59, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:09:59, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999969 [2010/03/30 11:09:59, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:09:59, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:09:59, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:10:09, 6] winbindd/winbindd.c:new_connection(717) accepted socket 19 [2010/03/30 11:10:09, 10] winbindd/winbindd.c:process_request(402) process_request: request fn INTERFACE_VERSION [2010/03/30 11:10:09, 3] winbindd/winbindd_misc.c:winbindd_interface_version(757) [23901]: request interface version [2010/03/30 11:10:09, 10] winbindd/winbindd.c:process_request(402) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2010/03/30 11:10:09, 3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790) [23901]: request location of privileged pipe [2010/03/30 11:10:09, 6] winbindd/winbindd.c:new_connection(717) accepted socket 20 [2010/03/30 11:10:09, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETPWNAM [2010/03/30 11:10:09, 3] winbindd/winbindd_user.c:winbindd_getpwnam(373) [23901]: getpwnam KID\testuser [2010/03/30 11:10:09, 8] winbindd/winbindd_cm.c:connection_ok(1563) connection_ok: Connection to for domain KID has NULL cli! [2010/03/30 11:10:09, 10] lib/gencache.c:gencache_get(208) Returning expired cache entry: key = SAF/DOMAIN/KID, value = 10.5.28.3, timeout = Mon Mar 29 15:16:43 2010 [2010/03/30 11:10:09, 5] libsmb/namequery.c:saf_fetch(135) saf_fetch: failed to find server for "KID" domain [2010/03/30 11:10:09, 10] winbindd/winbindd_cm.c:cm_open_connection(1430) cm_open_connection: dcname is '' for domain KID [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 22 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 94 38 74 3B 8B 5E FB 48 .8t;.^.H [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 23 mid = 13 [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,108) [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,108) wrote 108 [2010/03/30 11:10:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 103 [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=13 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 103 (0x67) smb_vwv[ 2]= 3328 (0xD00) smb_vwv[ 3]= 384 (0x180) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 16 (0x10) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 23 mid = 13 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 23 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 23: got good SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 35 0B 3A E4 7C A0 A6 7F 5.:.|... [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2049) Bind RPC Pipe[800d]: \NETLOGON auth_type 0, auth_level 0 [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) Bind Abstract Syntax: [000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [010] 01 00 00 00 .... [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:valid_pipe_name(1653) Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [010] 02 00 00 00 .... [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0b [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0048 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000006 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_rb [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 00000000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0018 num_contexts: 01 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 001c context_id : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 001e num_transfer_syntaxes: 01 [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 00001f smb_io_rpc_iface [2010/03/30 11:10:09, 7] rpc_parse/parse_prs.c:prs_debug(88) 000020 smb_io_uuid uuid [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0020 data : 12345678 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0024 data : 1234 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0026 data : abcd [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0028 data : ef 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002a data : 01 23 45 67 cf fb [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 version: 00000001 [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_rpc_iface [2010/03/30 11:10:09, 7] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_uuid uuid [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0034 data : 8a885d04 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0038 data : 1ceb [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 003a data : 11c9 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003c data : 9f e8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003e data : 08 00 2b 10 48 60 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0044 version: 00000002 [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800d [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=14 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32781 (0x800D) smb_bcc=87 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 06 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 24 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 3F 27 5E 26 01 72 1F 31 ?'^&.r.1 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 25 mid = 14 [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,158) [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,158) wrote 158 [2010/03/30 11:10:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 124 [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=14 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 06 00 00 ........ .D...... [010] 00 B8 10 B8 10 8B 3B 0C 00 0C 00 5C 50 49 50 45 ......;. ...\PIPE [020] 5C 6C 73 61 73 73 00 71 5D 01 00 00 00 00 00 00 \lsass.q ]....... [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 25 mid = 14 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 25 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 25: got good SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 03 C6 1A 73 0E 97 A9 60 ...s...` [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=14 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 06 00 00 ........ .D...... [010] 00 B8 10 B8 10 8B 3B 0C 00 0C 00 5C 50 49 50 45 ......;. ...\PIPE [020] 5C 6C 73 61 73 73 00 71 5D 01 00 00 00 00 00 00 \lsass.q ]....... [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 25 mid = 14 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000006 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 68 at offset 0 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800d returned 68 bytes. [2010/03/30 11:10:09, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2086) rpc_pipe_bind: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800d bind request returned ok. [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0044 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000006 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_ba [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 000c3b8b [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000018 smb_io_rpc_addr_str [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0018 len: 000c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 001a str: \PIPE\lsass. [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000026 smb_io_rpc_results [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0028 num_results: 01 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002c result : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002e reason : 0000 [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_rpc_iface [2010/03/30 11:10:09, 7] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_uuid uuid [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 data : 8a885d04 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0034 data : 1ceb [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0036 data : 11c9 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0038 data : 9f e8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003a data : 08 00 2b 10 48 60 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0040 version: 00000002 [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:check_bind_response(1704) check_bind_response: accepted! [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2282) cli_rpc_pipe_open_noauth: opened pipe \NETLOGON to machine ADDC05.rdomain.prv and bound anonymously. netr_ServerReqChallenge: struct netr_ServerReqChallenge in: struct netr_ServerReqChallenge server_name : * server_name : '\\ADDC05.rdomain.prv' computer_name : 'CORMAILTEST01' credentials : * credentials: struct netr_Credential data : 83a25b92f7a33ca9 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 008c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000007 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000074 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 0004 [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800d [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=222 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=15 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 140 (0x8C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 140 (0x8C) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32781 (0x800D) smb_bcc=155 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 8C 00 00 00 07 00 00 00 74 ........ .......t [020] 00 00 00 00 00 04 00 00 00 02 00 1A 00 00 00 00 ........ ........ [030] 00 00 00 1A 00 00 00 5C 00 5C 00 41 00 55 00 52 .......\ .\.A.U.R [040] 00 41 00 44 00 44 00 4F 00 4D 00 30 00 35 00 2E .A.D.D.O .M.0.5.. [050] 00 70 00 72 00 6F 00 74 00 6F 00 63 00 6F 00 6C .p.r.o.t .o.c.o.l [060] 00 2E 00 70 00 72 00 76 00 00 00 0E 00 00 00 00 ...p.r.v ........ [070] 00 00 00 0E 00 00 00 43 00 4F 00 52 00 4D 00 41 .......C .O.R.M.A [080] 00 49 00 4C 00 54 00 45 00 53 00 54 00 30 00 31 .I.L.T.E .S.T.0.1 [090] 00 00 00 83 A2 5B 92 F7 A3 3C A9 .....[.. .<. [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 26 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] D4 C9 55 30 24 C4 72 80 ..U0$.r. [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 27 mid = 15 [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,226) [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,226) wrote 226 [2010/03/30 11:10:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 92 [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=92 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=15 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 36 (0x24) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 36 (0x24) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=37 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 24 00 00 00 07 00 00 ........ .$...... [010] 00 0C 00 00 00 00 00 00 00 9F E3 97 46 2A 5E 7B ........ ....F*^{ [020] 52 00 00 00 00 R.... [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 27 mid = 15 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 27 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 27: got good SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] BE 79 45 91 D4 B5 51 3F .yE...Q? [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=92 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=15 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 36 (0x24) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 36 (0x24) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=37 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 24 00 00 00 07 00 00 ........ .$...... [010] 00 0C 00 00 00 00 00 00 00 9F E3 97 46 2A 5E 7B ........ ....F*^{ [020] 52 00 00 00 00 R.... [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 27 mid = 15 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0024 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000007 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 0000000c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 36, data_len 12, ss_len 0 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 36 at offset 0 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800d returned 24 bytes. netr_ServerReqChallenge: struct netr_ServerReqChallenge out: struct netr_ServerReqChallenge return_credentials : * return_credentials: struct netr_Credential data : 9fe397462a5e7b52 result : NT_STATUS_OK [2010/03/30 11:10:09, 10] libsmb/credentials.c:creds_client_init(294) creds_client_init: neg_flags : 600fffff [2010/03/30 11:10:09, 10] libsmb/credentials.c:creds_client_init(295) creds_client_init: client chal : 83A25B92F7A33CA9 [2010/03/30 11:10:09, 10] libsmb/credentials.c:creds_client_init(296) creds_client_init: server chal : 9FE397462A5E7B52 [2010/03/30 11:10:09, 5] libsmb/credentials.c:creds_init_128(70) creds_init_128 [2010/03/30 11:10:09, 5] libsmb/credentials.c:creds_init_128(71) clnt_chal_in: 83A25B92F7A33CA9 [2010/03/30 11:10:09, 5] libsmb/credentials.c:creds_init_128(72) srv_chal_in : 9FE397462A5E7B52 [2010/03/30 11:10:09, 10] libsmb/credentials.c:creds_client_init(314) creds_client_init: clnt : 982091AED29EDC41 [2010/03/30 11:10:09, 10] libsmb/credentials.c:creds_client_init(315) creds_client_init: server : D9EA5B84C000BDC4 [2010/03/30 11:10:09, 10] libsmb/credentials.c:creds_client_init(316) creds_client_init: seed : 982091AED29EDC41 netr_ServerAuthenticate2: struct netr_ServerAuthenticate2 in: struct netr_ServerAuthenticate2 server_name : * server_name : '\\ADDC05.rdomain.prv' account_name : 'CORMAILTEST01$' secure_channel_type : SEC_CHAN_WKSTA (2) computer_name : 'CORMAILTEST01' credentials : * credentials: struct netr_Credential data : 982091aed29edc41 negotiate_flags : * negotiate_flags : 0x600fffff (1611661311) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_128BIT 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_SCHANNEL [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 00bc [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000008 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 000000a4 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 000f [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800d [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=270 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=16 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 188 (0xBC) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 188 (0xBC) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32781 (0x800D) smb_bcc=203 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 BC 00 00 00 08 00 00 00 A4 ........ ........ [020] 00 00 00 00 00 0F 00 00 00 02 00 1A 00 00 00 00 ........ ........ [030] 00 00 00 1A 00 00 00 5C 00 5C 00 41 00 55 00 52 .......\ .\.A.U.R [040] 00 41 00 44 00 44 00 4F 00 4D 00 30 00 35 00 2E .A.D.D.O .M.0.5.. [050] 00 70 00 72 00 6F 00 74 00 6F 00 63 00 6F 00 6C .p.r.o.t .o.c.o.l [060] 00 2E 00 70 00 72 00 76 00 00 00 0F 00 00 00 00 ...p.r.v ........ [070] 00 00 00 0F 00 00 00 43 00 4F 00 52 00 4D 00 41 .......C .O.R.M.A [080] 00 49 00 4C 00 54 00 45 00 53 00 54 00 30 00 31 .I.L.T.E .S.T.0.1 [090] 00 24 00 00 00 02 00 0E 00 00 00 00 00 00 00 0E .$...... ........ [0A0] 00 00 00 43 00 4F 00 52 00 4D 00 41 00 49 00 4C ...C.O.R .M.A.I.L [0B0] 00 54 00 45 00 53 00 54 00 30 00 31 00 00 00 98 .T.E.S.T .0.1.... [0C0] 20 91 AE D2 9E DC 41 FF FF 0F 60 .....A. ..` [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 28 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 50 96 4C 0C E9 08 C0 CC P.L..... [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 29 mid = 16 [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,274) [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,274) wrote 274 [2010/03/30 11:10:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 96 [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=96 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=16 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=41 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 28 00 00 00 08 00 00 ........ .(...... [010] 00 10 00 00 00 00 00 00 00 D9 EA 5B 84 C0 00 BD ........ ...[.... [020] C4 FF FF 0F 60 00 00 00 00 ....`... . [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 29 mid = 16 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 29 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 29: got good SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] B9 5F 50 FE 75 82 79 F2 ._P.u.y. [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=96 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=16 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=41 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 28 00 00 00 08 00 00 ........ .(...... [010] 00 10 00 00 00 00 00 00 00 D9 EA 5B 84 C0 00 BD ........ ...[.... [020] C4 FF FF 0F 60 00 00 00 00 ....`... . [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 29 mid = 16 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0028 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000008 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000010 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 40, data_len 16, ss_len 0 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 40 at offset 0 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800d returned 32 bytes. netr_ServerAuthenticate2: struct netr_ServerAuthenticate2 out: struct netr_ServerAuthenticate2 return_credentials : * return_credentials: struct netr_Credential data : d9ea5b84c000bdc4 negotiate_flags : * negotiate_flags : 0x600fffff (1611661311) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_128BIT 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_SCHANNEL result : NT_STATUS_OK [2010/03/30 11:10:09, 10] libsmb/credentials.c:netlogon_creds_client_check(338) netlogon_creds_client_check: credentials check OK. [2010/03/30 11:10:09, 5] rpc_client/cli_netlogon.c:rpccli_netlogon_setup_creds(221) rpccli_netlogon_setup_creds: server ADDC05.rdomain.prv credential chain established. [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 30 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 98 F9 38 FE AA 57 E9 DE ..8..W.. [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 31 mid = 17 [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,108) [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,108) wrote 108 [2010/03/30 11:10:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 103 [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=17 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 103 (0x67) smb_vwv[ 2]= 3840 (0xF00) smb_vwv[ 3]= 384 (0x180) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 16 (0x10) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 31 mid = 17 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 31 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 31: got good SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] AC 9E 7E 79 80 77 8D F4 ..~y.w.. [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2049) Bind RPC Pipe[800f]: \NETLOGON auth_type 2, auth_level 6 [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) Bind Abstract Syntax: [000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [010] 01 00 00 00 .... [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:valid_pipe_name(1653) Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [010] 02 00 00 00 .... [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_auth_schannel_neg schannel_neg [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0000 type1: 00000000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0004 type2: 00000003 [2010/03/30 11:10:09, 6] lib/util.c:dump_data(2223) [000] 50 52 4F 54 4F 43 4F 4C 50 52 56 RDOMAIN.PRV [2010/03/30 11:10:09, 6] lib/util.c:dump_data(2223) [000] 43 4F 52 4D 41 49 4C 54 45 53 54 30 31 CORMAILT EST01 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0b [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0072 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0022 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000009 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_rb [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 00000000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0018 num_contexts: 01 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 001c context_id : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 001e num_transfer_syntaxes: 01 [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 00001f smb_io_rpc_iface [2010/03/30 11:10:09, 7] rpc_parse/parse_prs.c:prs_debug(88) 000020 smb_io_uuid uuid [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0020 data : 12345678 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0024 data : 1234 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0026 data : abcd [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0028 data : ef 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 002a data : 01 23 45 67 cf fb [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 version: 00000001 [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_rpc_iface [2010/03/30 11:10:09, 7] rpc_parse/parse_prs.c:prs_debug(88) 000034 smb_io_uuid uuid [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0034 data : 8a885d04 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0038 data : 1ceb [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 003a data : 11c9 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003c data : 9f e8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003e data : 08 00 2b 10 48 60 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0044 version: 00000002 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000048 smb_io_rpc_hdr_auth hdr_auth [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0048 auth_type : 44 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0049 auth_level : 06 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 004a auth_pad_len : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 004b auth_reserved: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 004c auth_context_id: 00000001 [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800f [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=196 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=18 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 114 (0x72) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 114 (0x72) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32783 (0x800F) smb_bcc=129 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 72 00 22 00 09 00 00 00 B8 .......r ."...... [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 44 06 00 00 01 00 00 00 00 .H`....D ........ [060] 00 00 00 03 00 00 00 50 52 4F 54 4F 43 4F 4C 50 .......P ROTOCOLP [070] 52 56 00 43 4F 52 4D 41 49 4C 54 45 53 54 30 31 RV.CORMA ILTEST01 [080] 00 . [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 32 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] E4 C4 4B 56 51 D4 76 CC ..KVQ.v. [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 33 mid = 18 [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,200) [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,200) wrote 200 [2010/03/30 11:10:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 144 [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=18 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 88 (0x58) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=89 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 0C 03 10 00 00 00 58 00 0C 00 09 00 00 ........ .X...... [010] 00 B8 10 B8 10 8C 3B 0C 00 0C 00 5C 50 49 50 45 ......;. ...\PIPE [020] 5C 6C 73 61 73 73 00 41 10 01 00 00 00 00 00 00 \lsass.A ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 44 06 00 00 01 00 00 00 01 00 00 `....D.. ........ [050] 00 00 00 00 00 00 00 5F 00 ......._ . [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 33 mid = 18 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 33 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 33: got good SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] DC BF AC 16 19 21 9E 58 .....!.X [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=18 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 88 (0x58) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=89 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 0C 03 10 00 00 00 58 00 0C 00 09 00 00 ........ .X...... [010] 00 B8 10 B8 10 8C 3B 0C 00 0C 00 5C 50 49 50 45 ......;. ...\PIPE [020] 5C 6C 73 61 73 73 00 41 10 01 00 00 00 00 00 00 \lsass.A ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 44 06 00 00 01 00 00 00 01 00 00 `....D.. ........ [050] 00 00 00 00 00 00 00 5F 00 ......._ . [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 33 mid = 18 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0058 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 000c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000009 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 88 at offset 0 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800f returned 88 bytes. [2010/03/30 11:10:09, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2086) rpc_pipe_bind: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800f bind request returned ok. [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 0c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0058 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 000c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 00000009 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_ba [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_bba [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0010 max_tsize: 10b8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0012 max_rsize: 10b8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0014 assoc_gid: 000c3b8c [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000018 smb_io_rpc_addr_str [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0018 len: 000c [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 001a str: \PIPE\lsass. [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000026 smb_io_rpc_results [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0028 num_results: 01 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002c result : 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 002e reason : 0000 [2010/03/30 11:10:09, 6] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_rpc_iface [2010/03/30 11:10:09, 7] rpc_parse/parse_prs.c:prs_debug(88) 000030 smb_io_uuid uuid [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0030 data : 8a885d04 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0034 data : 1ceb [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0036 data : 11c9 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0038 data : 9f e8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 003a data : 08 00 2b 10 48 60 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0040 version: 00000002 [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:check_bind_response(1704) check_bind_response: accepted! [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_schannel_with_key(2554) cli_rpc_pipe_open_schannel_with_key: opened pipe \NETLOGON to machine ADDC05.rdomain.prv for domain RDOMAINPRV and bound using schannel. [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 34 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] CF F0 E7 FB D8 91 B3 97 ........ [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 35 mid = 19 [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,45) [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,45) wrote 45 [2010/03/30 11:10:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 35 [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=19 smt_wct=0 smb_bcc=0 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 35 mid = 19 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 35 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 35: got good SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 2A 53 7D 2C 42 DC EE 52 *S},B..R [2010/03/30 11:10:09, 10] libsmb/clientgen.c:cli_rpc_pipe_close(553) cli_rpc_pipe_close: closed pipe \NETLOGON to machine ADDC05.rdomain.prv netr_DsRGetDCName: struct netr_DsRGetDCName in: struct netr_DsRGetDCName server_unc : * server_unc : 'ADDC05.rdomain.prv' domain_name : * domain_name : 'KID' domain_guid : NULL site_guid : NULL flags : 0x40000000 (1073741824) 0: DS_FORCE_REDISCOVERY 0: DS_DIRECTORY_SERVICE_REQUIRED 0: DS_DIRECTORY_SERVICE_PREFERRED 0: DS_GC_SERVER_REQUIRED 0: DS_PDC_REQUIRED 0: DS_BACKGROUND_ONLY 0: DS_IP_REQUIRED 0: DS_KDC_REQUIRED 0: DS_TIMESERV_REQUIRED 0: DS_WRITABLE_REQUIRED 0: DS_GOOD_TIMESERV_PREFERRED 0: DS_AVOID_SELF 0: DS_ONLY_LDAP_NEEDED 0: DS_IS_FLAT_NAME 0: DS_IS_DNS_NAME 0: DS_TRY_NEXTCLOSEST_SITE 0: DS_DIRECTORY_SERVICE_6_REQUIRED 1: DS_RETURN_DNS_NAME 0: DS_RETURN_FLAT_NAME [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 00a8 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0020 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 0000000a [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000068 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 0014 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000080 smb_io_rpc_hdr_auth hdr_auth [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0080 auth_type : 44 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0081 auth_level : 06 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0082 auth_pad_len : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0083 auth_reserved: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0084 auth_context_id: 00000001 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:add_schannel_auth_footer(1357) add_schannel_auth_footer: SCHANNEL seq_num=0 [2010/03/30 11:10:09, 10] rpc_parse/parse_prs.c:schannel_encode(1666) SCHANNEL: schannel_encode seq_num=0 data_len=104 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000088 smb_io_rpc_auth_schannel_chk [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0088 sig : 77 00 7a 00 ff ff 00 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0090 seq_num: 59 25 54 49 b8 9d 68 20 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0098 packet_digest: 9f 40 4a 0d 77 ec 25 86 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 00a0 confounder: 3b e7 ed 5d fa 57 d0 b1 [2010/03/30 11:10:09, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800f [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=250 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=20 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 168 (0xA8) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 168 (0xA8) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32783 (0x800F) smb_bcc=183 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 A8 00 20 00 0A 00 00 00 68 ........ . .....h [020] 00 00 00 00 00 14 00 CD 68 33 96 9F A7 A9 D6 5D ........ h3.....] [030] 50 75 6B 7A F6 20 7B 78 92 0C 8D C6 7F 80 7C 26 Pukz. {x ......|& [040] 56 A2 A5 72 6A 86 8C 24 A4 7C 2B 46 12 03 33 59 V..rj..$ .|+F..3Y [050] 96 FC E7 2C 90 FE E2 B0 6C 0C 25 A6 9C 6F 31 46 ...,.... l.%..o1F [060] F9 28 34 DC 4A 9C 6B EA FF BF D5 99 5F 51 4A 41 .(4.J.k. ...._QJA [070] 8B 1F 15 E5 2C 3A 32 6A 12 13 14 7E BA CD CF F7 ....,:2j ...~.... [080] 8B 76 B1 04 62 BD 4E D8 8B 4E 08 A3 CD 48 BE 44 .v..b.N. .N...H.D [090] 06 00 00 01 00 00 00 77 00 7A 00 FF FF 00 00 59 .......w .z.....Y [0A0] 25 54 49 B8 9D 68 20 9F 40 4A 0D 77 EC 25 86 3B %TI..h . @J.w.%.; [0B0] E7 ED 5D FA 57 D0 B1 ..].W.. [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 36 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 26 59 6D 5C 58 41 E5 E5 &Ym\XA.. [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 37 mid = 20 [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,254) [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,254) wrote 254 [2010/03/30 11:10:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 440 [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=440 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=20 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 384 (0x180) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 384 (0x180) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=385 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 80 01 20 00 0A 00 00 ........ ... .... [010] 00 40 01 00 00 00 00 00 00 3B E4 4E FB 9E 3E DE .@...... .;.N..>. [020] 77 60 39 2C 1B B2 69 95 45 0F E9 B1 CE 9C A7 97 w`9,..i. E....... [030] 89 2E 6F B9 41 49 0F F3 44 4E 9B 10 23 CD B3 92 ..o.AI.. DN..#... [040] CB 2B A9 05 7F 0C 97 F2 C6 C4 3E 75 FB 69 AC 75 .+...... ..>u.i.u [050] 96 69 6F 9D 7F B3 57 3A 49 97 9A 0F 4B 53 25 D3 .io...W: I...KS%. [060] 2C 2B 2F ED 9D F8 D9 C2 92 D8 0F C8 D9 75 B1 EB ,+/..... .....u.. [070] 3E B8 7F 7D 08 72 9C 15 6A 72 5B 0F A4 DD 4A FF >..}.r.. jr[...J. [080] 69 49 41 69 1D 65 C9 55 14 CB 4E 26 64 3A BB 03 iIAi.e.U ..N&d:.. [090] AB 44 A3 8D 74 46 E1 E7 1A 85 0F 3B 71 FD 7A 2F .D..tF.. ...;q.z/ [0A0] 18 A8 59 A3 FB C9 44 6C 58 B0 E3 FA 3B 40 DB EE ..Y...Dl X...;@.. [0B0] 80 FF 3D A0 DA CC 97 F3 8F 6E C5 2B CA DA 1A 0A ..=..... .n.+.... [0C0] 2C 5A DF 22 D1 63 9B 96 33 1A E7 6B 67 DE 0B 04 ,Z.".c.. 3..kg... [0D0] 55 36 C4 18 A9 98 2F E8 04 63 AE E5 1A F5 87 32 U6..../. .c.....2 [0E0] 10 1B BF 05 2D 0E 03 A0 C2 C3 13 69 6B 33 A0 E1 ....-... ...ik3.. [0F0] 93 79 42 A9 24 9F 13 2F 54 51 2E C7 17 97 37 4C .yB.$../ TQ....7L [100] 52 10 BB 8F C5 C4 DE EC A5 93 CC 0D 1B 13 36 06 R....... ......6. [110] 95 A3 3E 89 75 DD 18 7C AF DE 54 4C E9 80 1A 66 ..>.u..| ..TL...f [120] 93 07 8E F1 C2 E3 37 8E 44 13 E3 7D F2 47 62 4E ......7. D..}.GbN [130] 59 5A A5 9E A2 81 3D 32 B9 42 29 6D 2D C3 4B F7 YZ....=2 .B)m-.K. [140] B4 92 B8 7D C4 05 D3 CF F5 77 D5 BF 0F 00 5E F8 ...}.... .w....^. [150] 73 D3 7B 2A B2 36 CD D4 10 44 06 00 00 01 00 00 s.{*.6.. .D...... [160] 00 77 00 7A 00 FF FF 00 00 F8 53 AC BA B0 A7 73 .w.z.... ..S....s [170] A5 DC 1B 24 AE AB 16 B1 BE 02 76 7C 51 F4 6E E4 ...$.... ..v|Q.n. [180] C2 . [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 37 mid = 20 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 37 [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 37: got good SMB signature of [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 8C 8F 25 F9 7B AF 1C 38 ..%.{..8 [2010/03/30 11:10:09, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:09, 5] lib/util.c:show_msg(652) size=440 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=20 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 384 (0x180) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 384 (0x180) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=385 [2010/03/30 11:10:09, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 80 01 20 00 0A 00 00 ........ ... .... [010] 00 40 01 00 00 00 00 00 00 3B E4 4E FB 9E 3E DE .@...... .;.N..>. [020] 77 60 39 2C 1B B2 69 95 45 0F E9 B1 CE 9C A7 97 w`9,..i. E....... [030] 89 2E 6F B9 41 49 0F F3 44 4E 9B 10 23 CD B3 92 ..o.AI.. DN..#... [040] CB 2B A9 05 7F 0C 97 F2 C6 C4 3E 75 FB 69 AC 75 .+...... ..>u.i.u [050] 96 69 6F 9D 7F B3 57 3A 49 97 9A 0F 4B 53 25 D3 .io...W: I...KS%. [060] 2C 2B 2F ED 9D F8 D9 C2 92 D8 0F C8 D9 75 B1 EB ,+/..... .....u.. [070] 3E B8 7F 7D 08 72 9C 15 6A 72 5B 0F A4 DD 4A FF >..}.r.. jr[...J. [080] 69 49 41 69 1D 65 C9 55 14 CB 4E 26 64 3A BB 03 iIAi.e.U ..N&d:.. [090] AB 44 A3 8D 74 46 E1 E7 1A 85 0F 3B 71 FD 7A 2F .D..tF.. ...;q.z/ [0A0] 18 A8 59 A3 FB C9 44 6C 58 B0 E3 FA 3B 40 DB EE ..Y...Dl X...;@.. [0B0] 80 FF 3D A0 DA CC 97 F3 8F 6E C5 2B CA DA 1A 0A ..=..... .n.+.... [0C0] 2C 5A DF 22 D1 63 9B 96 33 1A E7 6B 67 DE 0B 04 ,Z.".c.. 3..kg... [0D0] 55 36 C4 18 A9 98 2F E8 04 63 AE E5 1A F5 87 32 U6..../. .c.....2 [0E0] 10 1B BF 05 2D 0E 03 A0 C2 C3 13 69 6B 33 A0 E1 ....-... ...ik3.. [0F0] 93 79 42 A9 24 9F 13 2F 54 51 2E C7 17 97 37 4C .yB.$../ TQ....7L [100] 52 10 BB 8F C5 C4 DE EC A5 93 CC 0D 1B 13 36 06 R....... ......6. [110] 95 A3 3E 89 75 DD 18 7C AF DE 54 4C E9 80 1A 66 ..>.u..| ..TL...f [120] 93 07 8E F1 C2 E3 37 8E 44 13 E3 7D F2 47 62 4E ......7. D..}.GbN [130] 59 5A A5 9E A2 81 3D 32 B9 42 29 6D 2D C3 4B F7 YZ....=2 .B)m-.K. [140] B4 92 B8 7D C4 05 D3 CF F5 77 D5 BF 0F 00 5E F8 ...}.... .w....^. [150] 73 D3 7B 2A B2 36 CD D4 10 44 06 00 00 01 00 00 s.{*.6.. .D...... [160] 00 77 00 7A 00 FF FF 00 00 F8 53 AC BA B0 A7 73 .w.z.... ..S....s [170] A5 DC 1B 24 AE AB 16 B1 BE 02 76 7C 51 F4 6E E4 ...$.... ..v|Q.n. [180] C2 . [2010/03/30 11:10:09, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 37 mid = 20 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0180 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0020 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 0000000a [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000140 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000158 smb_io_rpc_hdr_auth hdr_auth [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0158 auth_type : 44 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0159 auth_level : 06 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 015a auth_pad_len : 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8(624) 015b auth_reserved: 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint32(718) 015c auth_context_id: 00000001 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_debug(88) 000160 smb_io_rpc_auth_schannel_chk [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0160 sig : 77 00 7a 00 ff ff 00 00 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0168 seq_num: f8 53 ac ba b0 a7 73 a5 [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0170 packet_digest: dc 1b 24 ae ab 16 b1 be [2010/03/30 11:10:09, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0178 confounder: 02 76 7c 51 f4 6e e4 c2 [2010/03/30 11:10:09, 10] rpc_parse/parse_prs.c:schannel_decode(1743) SCHANNEL: schannel_decode seq_num=1 data_len=320 [2010/03/30 11:10:09, 10] rpc_parse/parse_prs.c:schannel_decode(1763) SCHANNEL: schannel_decode seq_num=1 data_len=320 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 384, data_len 320, ss_len 0 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 384 at offset 0 [2010/03/30 11:10:09, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800f returned 640 bytes. netr_DsRGetDCName: struct netr_DsRGetDCName out: struct netr_DsRGetDCName info : * info : * info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : '\\chlddc01.kid.rdomain.prv' dc_address : * dc_address : '\\10.5.28.3' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : 5e4eeaf2-76ed-4295-89dc-59eb027a3d03 domain_name : * domain_name : 'kid.rdomain.prv' forest_name : * forest_name : 'rdomain.prv' dc_flags : 0xe00001fd (3758096893) 1: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 0: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST dc_site_name : * dc_site_name : 'Manila' client_site_name : * client_site_name : 'DataCenter' result : WERR_OK [2010/03/30 11:10:09, 10] winbindd/winbindd_cm.c:get_dc_name_via_netlogon(664) rpccli_netr_GetAnyDCName returned chlddc01.kid.rdomain.prv [2010/03/30 11:10:09, 10] lib/gencache.c:gencache_get(208) Returning valid cache entry: key = AD_SITENAME/DOMAIN/RDOMAIN.PRV, value = DataCenter, timeout = Sun Feb 7 00:28:15 2106 [2010/03/30 11:10:09, 5] libads/dns.c:sitename_fetch(817) sitename_fetch: Returning sitename for RDOMAIN.PRV: "DataCenter" [2010/03/30 11:10:09, 10] libsmb/namequery.c:internal_resolve_name(1443) internal_resolve_name: looking up chlddc01.kid.rdomain.prv#20 (sitename DataCenter) [2010/03/30 11:10:09, 10] lib/gencache.c:gencache_get(208) Returning expired cache entry: key = NBT/MANADDOM01.KID.RDOMAIN.PRV#20, value = 10.5.28.3:0, timeout = Thu Mar 25 15:01:03 2010 [2010/03/30 11:10:09, 5] libsmb/namecache.c:namecache_fetch(229) no entry for chlddc01.kid.rdomain.prv#20 found. [2010/03/30 11:10:09, 3] libsmb/namequery.c:resolve_lmhosts(1162) resolve_lmhosts: Attempting lmhosts lookup for name chlddc01.kid.rdomain.prv<0x20> [2010/03/30 11:10:09, 4] libsmb/namequery.c:getlmhostsent(846) getlmhostsent: lmhost entry: 10.5.28.3 MANADDOM01 [2010/03/30 11:10:09, 4] libsmb/namequery.c:getlmhostsent(846) getlmhostsent: lmhost entry: 10.5.28.3 chlddc01.kid.rdomain.prv [2010/03/30 11:10:09, 10] libsmb/namequery.c:remove_duplicate_addrs2(520) remove_duplicate_addrs2: looking for duplicate address/port pairs [2010/03/30 11:10:09, 5] libsmb/namecache.c:namecache_store(143) namecache_store: storing 1 address for chlddc01.kid.rdomain.prv#20: 10.5.28.3 [2010/03/30 11:10:09, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = NBT/MANADDOM01.KID.RDOMAIN.PRV#20; value = 10.5.28.3:0 and timeout = Tue Mar 30 11:21:09 2010 (660 seconds ahead) [2010/03/30 11:10:09, 10] libsmb/namequery.c:internal_resolve_name(1590) internal_resolve_name: returning 1 addresses: 10.5.28.3:0 [2010/03/30 11:10:09, 10] winbindd/winbindd_cm.c:get_dcs(1178) Retrieved DC chlddc01.kid.rdomain.prv at 10.5.28.3 via netlogon [2010/03/30 11:10:09, 10] winbindd/winbindd_cm.c:cm_prepare_connection(753) cm_prepare_connection: connecting to DC chlddc01.kid.rdomain.prv for domain KID [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(236) write_socket(22,72) [2010/03/30 11:10:09, 6] libsmb/clientgen.c:write_socket(239) write_socket(22,72) wrote 72 [2010/03/30 11:10:09, 5] libsmb/cliconnect.c:cli_session_request(1429) Sent session request [2010/03/30 11:10:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 0 [2010/03/30 11:10:10, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:10, 5] lib/util.c:show_msg(652) size=0 smb_com=0x0 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=0 smb_flg2=0 smb_tid=0 smb_pid=0 smb_uid=0 smb_mid=0 smt_wct=0 smb_bcc=0 [2010/03/30 11:10:10, 6] libsmb/clientgen.c:write_socket(236) write_socket(22,194) [2010/03/30 11:10:10, 6] libsmb/clientgen.c:write_socket(239) write_socket(22,194) wrote 194 [2010/03/30 11:10:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 186 [2010/03/30 11:10:10, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:10, 5] lib/util.c:show_msg(652) size=186 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=23892 smb_uid=0 smb_mid=2 smt_wct=17 smb_vwv[ 0]= 9 (0x9) smb_vwv[ 1]=12815 (0x320F) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]= 499 (0x1F3) smb_vwv[11]=12416 (0x3080) smb_vwv[12]=46733 (0xB68D) smb_vwv[13]= 9080 (0x2378) smb_vwv[14]=51920 (0xCAD0) smb_vwv[15]=11265 (0x2C01) smb_vwv[16]= 1 (0x1) smb_bcc=117 [2010/03/30 11:10:10, 10] lib/util.c:dump_data(2223) [000] A2 D6 31 5C FD FD A1 46 BE 2E B9 1B 6C 22 90 07 ..1\...F ....l".. [010] 60 63 06 06 2B 06 01 05 05 02 A0 59 30 57 A0 30 `c..+... ...Y0W.0 [020] 30 2E 06 09 2A 86 48 82 F7 12 01 02 02 06 09 2A 0...*.H. .......* [030] 86 48 86 F7 12 01 02 02 06 0A 2A 86 48 86 F7 12 .H...... ..*.H... [040] 01 02 02 03 06 0A 2B 06 01 04 01 82 37 02 02 0A ......+. ....7... [050] A3 23 30 21 A0 1F 1B 1D 6D 61 6E 61 64 64 6F 6D .#0!.... manaddom [060] 30 31 24 40 50 48 55 42 2E 50 52 4F 54 4F 43 4F 01$@KID .PROTOCO [070] 4C 2E 50 52 56 L.PRV [2010/03/30 11:10:10, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:10, 5] lib/util.c:show_msg(652) size=186 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=23892 smb_uid=0 smb_mid=2 smt_wct=17 smb_vwv[ 0]= 9 (0x9) smb_vwv[ 1]=12815 (0x320F) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]= 499 (0x1F3) smb_vwv[11]=12416 (0x3080) smb_vwv[12]=46733 (0xB68D) smb_vwv[13]= 9080 (0x2378) smb_vwv[14]=51920 (0xCAD0) smb_vwv[15]=11265 (0x2C01) smb_vwv[16]= 1 (0x1) smb_bcc=117 [2010/03/30 11:10:10, 10] lib/util.c:dump_data(2223) [000] A2 D6 31 5C FD FD A1 46 BE 2E B9 1B 6C 22 90 07 ..1\...F ....l".. [010] 60 63 06 06 2B 06 01 05 05 02 A0 59 30 57 A0 30 `c..+... ...Y0W.0 [020] 30 2E 06 09 2A 86 48 82 F7 12 01 02 02 06 09 2A 0...*.H. .......* [030] 86 48 86 F7 12 01 02 02 06 0A 2A 86 48 86 F7 12 .H...... ..*.H... [040] 01 02 02 03 06 0A 2B 06 01 04 01 82 37 02 02 0A ......+. ....7... [050] A3 23 30 21 A0 1F 1B 1D 6D 61 6E 61 64 64 6F 6D .#0!.... manaddom [060] 30 31 24 40 50 48 55 42 2E 50 52 4F 54 4F 43 4F 01$@KID .PROTOCO [070] 4C 2E 50 52 56 L.PRV [2010/03/30 11:10:10, 5] winbindd/winbindd_cm.c:cm_prepare_connection(831) connecting to chlddc01.kid.rdomain.prv from CORMAILTEST01 with kerberos principal [CORMAILTEST01$@RDOMAIN.PRV] and realm [kid.rdomain.prv] [2010/03/30 11:10:10, 3] libsmb/cliconnect.c:cli_session_setup_spnego(804) Doing spnego session setup (blob length=117) [2010/03/30 11:10:10, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 2 840 48018 1 2 2 [2010/03/30 11:10:10, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 2 840 113554 1 2 2 [2010/03/30 11:10:10, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 2 840 113554 1 2 2 3 [2010/03/30 11:10:10, 3] libsmb/cliconnect.c:cli_session_setup_spnego(831) got OID=1 3 6 1 4 1 311 2 2 10 [2010/03/30 11:10:10, 3] libsmb/cliconnect.c:cli_session_setup_spnego(839) got principal=chlddc01$@KID.RDOMAIN.PRV [2010/03/30 11:10:10, 10] libads/kerberos.c:kerberos_kinit_password_ext(217) kerberos_kinit_password: as CORMAILTEST01$@RDOMAIN.PRV using [MEMORY:cliconnect] as ccache and config [(null)] [2010/03/30 11:10:10, 2] libsmb/cliconnect.c:cli_session_setup_kerberos(619) Doing kerberos session setup [2010/03/30 11:10:10, 3] libsmb/clikrb5.c:ads_cleanup_expired_creds(604) ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect] expiration Tue, 30 Mar 2010 21:10:10 CDT [2010/03/30 11:10:10, 10] libsmb/clikrb5.c:ads_krb5_mk_req(702) ads_krb5_mk_req: Ticket (chlddc01$@KID.RDOMAIN.PRV) in ccache (MEMORY:cliconnect) is valid until: (Tue, 30 Mar 2010 21:10:10 CDT - 1270001410) [2010/03/30 11:10:10, 3] libsmb/clikrb5.c:ads_krb5_mk_req(713) ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT [2010/03/30 11:10:10, 10] libsmb/clikrb5.c:get_krb5_smb_session_key(873) Got KRB5 session key of length 16 [2010/03/30 11:10:10, 5] libsmb/smb_signing.c:set_smb_signing_real_common(140) Mandatory SMB signing enabled! [2010/03/30 11:10:10, 5] libsmb/smb_signing.c:set_smb_signing_real_common(144) SMB signing enabled! [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:cli_simple_set_signing(494) cli_simple_set_signing: user_session_key [2010/03/30 11:10:10, 10] lib/util.c:dump_data(2223) [000] C9 F6 AE 3F 18 E9 AD 88 6F B4 D0 42 59 48 46 58 ...?.... o..BYHFX [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:cli_simple_set_signing(502) cli_simple_set_signing: NULL response_data [2010/03/30 11:10:10, 10] libsmb/cliconnect.c:cli_session_setup_blob(578) cli_session_setup_blob: Remaining (0) sending (2539) current (2539) [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 0 [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:10, 10] lib/util.c:dump_data(2223) [000] A1 90 DB BC 4E 41 9A A7 ....NA.. [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 1 mid = 3 [2010/03/30 11:10:10, 6] libsmb/clientgen.c:write_socket(236) write_socket(22,2624) [2010/03/30 11:10:10, 6] libsmb/clientgen.c:write_socket(239) write_socket(22,2624) wrote 2624 [2010/03/30 11:10:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 209 [2010/03/30 11:10:10, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:10, 5] lib/util.c:show_msg(652) size=209 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=0 smb_pid=23892 smb_uid=24578 smb_mid=3 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 209 (0xD1) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 26 (0x1A) smb_bcc=166 [2010/03/30 11:10:10, 10] lib/util.c:dump_data(2223) [000] A1 18 30 16 A0 03 0A 01 00 A1 0B 06 09 2A 86 48 ..0..... .....*.H [010] 82 F7 12 01 02 02 A2 02 04 00 A2 57 00 69 00 6E ........ ...W.i.n [020] 00 64 00 6F 00 77 00 73 00 20 00 53 00 65 00 72 .d.o.w.s . .S.e.r [030] 00 76 00 65 00 72 00 20 00 32 00 30 00 30 00 33 .v.e.r. .2.0.0.3 [040] 00 20 00 52 00 32 00 20 00 33 00 37 00 39 00 30 . .R.2. .3.7.9.0 [050] 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 . .S.e.r .v.i.c.e [060] 00 20 00 50 00 61 00 63 00 6B 00 20 00 32 00 00 . .P.a.c .k. .2.. [070] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. [080] 00 53 00 65 00 72 00 76 00 65 00 72 00 20 00 32 .S.e.r.v .e.r. .2 [090] 00 30 00 30 00 33 00 20 00 52 00 32 00 20 00 35 .0.0.3. .R.2. .5 [0A0] 00 2E 00 32 00 00 ...2.. [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 1 mid = 3 [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 1 [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 1: got good SMB signature of [2010/03/30 11:10:10, 10] lib/util.c:dump_data(2223) [000] 6E EB 3D BE 06 ED A2 FF n.=..... [2010/03/30 11:10:10, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:10, 5] lib/util.c:show_msg(652) size=209 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=0 smb_pid=23892 smb_uid=24578 smb_mid=3 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 209 (0xD1) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 26 (0x1A) smb_bcc=166 [2010/03/30 11:10:10, 10] lib/util.c:dump_data(2223) [000] A1 18 30 16 A0 03 0A 01 00 A1 0B 06 09 2A 86 48 ..0..... .....*.H [010] 82 F7 12 01 02 02 A2 02 04 00 A2 57 00 69 00 6E ........ ...W.i.n [020] 00 64 00 6F 00 77 00 73 00 20 00 53 00 65 00 72 .d.o.w.s . .S.e.r [030] 00 76 00 65 00 72 00 20 00 32 00 30 00 30 00 33 .v.e.r. .2.0.0.3 [040] 00 20 00 52 00 32 00 20 00 33 00 37 00 39 00 30 . .R.2. .3.7.9.0 [050] 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 . .S.e.r .v.i.c.e [060] 00 20 00 50 00 61 00 63 00 6B 00 20 00 32 00 00 . .P.a.c .k. .2.. [070] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. [080] 00 53 00 65 00 72 00 76 00 65 00 72 00 20 00 32 .S.e.r.v .e.r. .2 [090] 00 30 00 30 00 33 00 20 00 52 00 32 00 20 00 35 .0.0.3. .R.2. .5 [0A0] 00 2E 00 32 00 00 ...2.. [2010/03/30 11:10:10, 10] libsmb/clientgen.c:cli_init_creds(415) cli_init_creds: user CORMAILTEST01$ domain RDOMAINPRV [2010/03/30 11:10:10, 10] libsmb/namequery.c:saf_store(75) saf_store: domain = [KID], server = [chlddc01.kid.rdomain.prv], expire = [1269966310] [2010/03/30 11:10:10, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = SAF/DOMAIN/KID; value = chlddc01.kid.rdomain.prv and timeout = Tue Mar 30 11:25:10 2010 (900 seconds ahead) [2010/03/30 11:10:10, 10] libsmb/namequery.c:saf_store(75) saf_store: domain = [kid.rdomain.prv], server = [chlddc01.kid.rdomain.prv], expire = [1269966310] [2010/03/30 11:10:10, 10] lib/gencache.c:gencache_set(131) Adding cache entry with key = SAF/DOMAIN/KID.RDOMAIN.PRV; value = chlddc01.kid.rdomain.prv and timeout = Tue Mar 30 11:25:10 2010 (900 seconds ahead) [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 2 [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:10, 10] lib/util.c:dump_data(2223) [000] D2 55 ED B4 A4 E9 57 04 .U....W. [2010/03/30 11:10:10, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 3 mid = 4 [2010/03/30 11:10:10, 6] libsmb/clientgen.c:write_socket(236) write_socket(22,124) [2010/03/30 11:10:10, 6] libsmb/clientgen.c:write_socket(239) write_socket(22,124) wrote 124 [2010/03/30 11:10:11, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 56 [2010/03/30 11:10:11, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:11, 5] lib/util.c:show_msg(652) size=56 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=14340 smb_pid=23892 smb_uid=24578 smb_mid=4 smt_wct=7 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 56 (0x38) smb_vwv[ 2]= 1 (0x1) smb_vwv[ 3]= 511 (0x1FF) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 511 (0x1FF) smb_vwv[ 6]= 0 (0x0) smb_bcc=7 [2010/03/30 11:10:11, 10] lib/util.c:dump_data(2223) [000] 49 50 43 00 00 00 00 IPC.... [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 3 mid = 4 [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 3 [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 3: got good SMB signature of [2010/03/30 11:10:11, 10] lib/util.c:dump_data(2223) [000] F9 6D 76 51 67 57 59 67 .mvQgWYg [2010/03/30 11:10:11, 10] winbindd/winbindd_cache.c:set_global_winbindd_state_online(2859) set_global_winbindd_state_online: online requested. [2010/03/30 11:10:11, 10] winbindd/winbindd_cache.c:set_global_winbindd_state_online(2862) set_global_winbindd_state_online: rejecting. [2010/03/30 11:10:11, 10] winbindd/winbindd_cm.c:set_domain_online(385) set_domain_online: called for domain KID [2010/03/30 11:10:11, 5] winbindd/winbindd_cm.c:set_dc_type_and_flags_trustinfo(1645) set_dc_type_and_flags_trustinfo: domain KID netr_DsrEnumerateDomainTrusts: struct netr_DsrEnumerateDomainTrusts in: struct netr_DsrEnumerateDomainTrusts server_name : * server_name : 'ADDC05.rdomain.prv' trust_flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr hdr [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0088 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0020 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 0000000b [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_req hdr_req [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000044 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0016 opnum : 0028 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_debug(88) 000060 smb_io_rpc_hdr_auth hdr_auth [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0060 auth_type : 44 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0061 auth_level : 06 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0062 auth_pad_len : 04 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0063 auth_reserved: 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0064 auth_context_id: 00000001 [2010/03/30 11:10:11, 10] rpc_client/cli_pipe.c:add_schannel_auth_footer(1357) add_schannel_auth_footer: SCHANNEL seq_num=2 [2010/03/30 11:10:11, 10] rpc_parse/parse_prs.c:schannel_encode(1666) SCHANNEL: schannel_encode seq_num=2 data_len=72 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_debug(88) 000068 smb_io_rpc_auth_schannel_chk [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0068 sig : 77 00 7a 00 ff ff 00 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0070 seq_num: 9b c9 de d0 23 a5 a0 75 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0078 packet_digest: b2 52 f4 3c c3 30 62 82 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0080 confounder: 77 71 6c 96 b4 4c 95 35 [2010/03/30 11:10:11, 5] rpc_client/cli_pipe.c:rpc_api_pipe(769) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800f [2010/03/30 11:10:11, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:11, 5] lib/util.c:show_msg(652) size=218 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=21 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 136 (0x88) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 136 (0x88) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=32783 (0x800F) smb_bcc=151 [2010/03/30 11:10:11, 10] lib/util.c:dump_data(2223) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 88 00 20 00 0B 00 00 00 44 ........ . .....D [020] 00 00 00 00 00 28 00 AF A0 91 68 7F 8E 40 48 69 .....(.. ..h..@Hi [030] E2 6F 3D 76 EA F0 95 C6 6F 41 36 4B 10 2D 66 A8 .o=v.... oA6K.-f. [040] 23 14 BD 96 BF C7 BD C9 73 97 C3 15 69 71 00 64 #....... s...iq.d [050] 7E 4B 88 BF 57 D4 5B 31 D3 0C 29 E1 ED 02 27 DE ~K..W.[1 ..)...'. [060] 15 29 BD A8 DA 12 92 1B 50 95 F5 5D F5 7C 99 44 .)...... P..].|.D [070] 06 04 00 01 00 00 00 77 00 7A 00 FF FF 00 00 9B .......w .z...... [080] C9 DE D0 23 A5 A0 75 B2 52 F4 3C C3 30 62 82 77 ...#..u. R.<.0b.w [090] 71 6C 96 B4 4C 95 35 ql..L.5 [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 38 [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:client_sign_outgoing_message(351) client_sign_outgoing_message: sent SMB signature of [2010/03/30 11:10:11, 10] lib/util.c:dump_data(2223) [000] 51 DC 9A AD 73 91 FE C8 Q...s... [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:store_sequence_for_reply(67) store_sequence_for_reply: stored seq = 39 mid = 21 [2010/03/30 11:10:11, 6] libsmb/clientgen.c:write_socket(236) write_socket(18,222) [2010/03/30 11:10:11, 6] libsmb/clientgen.c:write_socket(239) write_socket(18,222) wrote 222 [2010/03/30 11:10:11, 10] lib/util_sock.c:read_smb_length_return_keepalive(1187) got smb length of 904 [2010/03/30 11:10:11, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:11, 5] lib/util.c:show_msg(652) size=904 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=21 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 848 (0x350) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 848 (0x350) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=849 [2010/03/30 11:10:11, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 50 03 20 00 0B 00 00 ........ .P. .... [010] 00 04 03 00 00 00 00 00 00 D7 70 93 D8 CE FC 54 ........ ..p....T [020] FF 49 48 93 B4 88 66 DD EB 9B EB 5E CD 5B 32 8B .IH...f. ...^.[2. [030] DE 8F 0B B7 CB 98 C4 3F 82 36 45 2E 8B 00 42 25 .......? .6E...B% [040] 90 4B E0 87 1F 24 E2 42 9B 2C 11 86 25 F0 C0 5A .K...$.B .,..%..Z [050] 54 65 31 F7 49 43 E0 8D 8C 6D 76 3C F9 D4 EA 1B Te1.IC.. .mv<.... [060] ED C0 B8 C1 E4 94 7A 8C 17 E2 30 9F D6 EA 38 BD ......z. ..0...8. [070] CD 00 18 EA 75 65 F5 EC 27 1F 13 32 2E AF 22 3D ....ue.. '..2.."= [080] 28 4D 27 BF 6F 17 B4 15 9F 1A 82 93 D5 D5 0A 9A (M'.o... ........ [090] 4F FA EA 9F 1D 59 82 75 AF EC A6 66 0C 17 9B 7A O....Y.u ...f...z [0A0] 33 FF 14 CF 3F 46 D6 49 CF 82 D2 8C 80 AE 05 0C 3...?F.I ........ [0B0] 3C FD E6 91 38 18 E9 C3 D6 82 48 3B B4 2D 02 02 <...8... ..H;.-.. [0C0] 2B 90 AE 65 E1 05 74 29 EB EB 0E 9D 66 7F 09 0C +..e..t) ....f... [0D0] 5B F0 51 3B EF 7F FE 91 7E E3 D0 EB 5E C7 DD 00 [.Q;.... ~...^... [0E0] BC 35 1B B7 D2 13 86 E5 EC 45 67 CC 4A 04 B6 41 .5...... .Eg.J..A [0F0] 9A CC 83 BF 0A D4 C1 2F 7B E8 82 6A 54 F6 9E 6C ......./ {..jT..l [100] 18 66 F2 A7 D2 1A 6D 9F B6 0D F2 7D 2D E5 56 B6 .f....m. ...}-.V. [110] F5 A5 6D AE 5B F8 59 79 20 F8 36 6E CD 0A BC 6F ..m.[.Yy .6n...o [120] 2A 6E 67 5F 39 80 12 64 36 22 72 45 6E D9 CF 73 *ng_9..d 6"rEn..s [130] FE 99 CD 43 2C 4D F1 87 96 FA E9 21 03 13 19 CA ...C,M.. ...!.... [140] 37 3A 62 5B EB 2B 39 1C E4 BB 90 3A A2 7F 90 51 7:b[.+9. ...:...Q [150] AC 15 D1 DF CC 72 46 64 36 8C BE D9 01 95 ED 19 .....rFd 6....... [160] BE 9B 6A C5 3E 79 4B 51 0A E4 9B F7 8B FB 74 87 ..j.>yKQ ......t. [170] FE E6 03 84 92 6C AA B4 2E 1C 04 A3 3F BA C1 D0 .....l.. ....?... [180] 92 3B 53 DE 9A 29 87 33 F4 93 19 A8 D5 44 87 E0 .;S..).3 .....D.. [190] 32 FD 3C 98 11 7A A9 93 4B B0 4F 98 E6 19 85 58 2.<..z.. K.O....X [1A0] 81 3B 89 F7 F1 F5 A3 1C 5A A7 AD 1F 9B 87 39 FE .;...... Z.....9. [1B0] 0B D1 5C AE 18 56 24 A4 AA E0 6B DC 42 7E DC 80 ..\..V$. ..k.B~.. [1C0] 9D DC 32 B4 04 93 5E 9F 3D 97 0A 1B F4 31 35 21 ..2...^. =....15! [1D0] F6 D0 B6 EC 37 B9 D5 8F 8A CD C8 53 B3 4D 88 4C ....7... ...S.M.L [1E0] 4B 01 02 C0 1C EC 71 61 60 BA 91 20 9C 01 87 1E K.....qa `.. .... [1F0] C6 D5 E6 00 B2 D1 95 30 38 48 DC 6D CF 77 8F 7D .......0 8H.m.w.} [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 39 mid = 21 [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:simple_packet_signature(285) simple_packet_signature: sequence number 39 [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:client_check_incoming_message(434) client_check_incoming_message: seq 39: got good SMB signature of [2010/03/30 11:10:11, 10] lib/util.c:dump_data(2223) [000] 68 BD 4C FD C5 17 2C E6 h.L...,. [2010/03/30 11:10:11, 5] lib/util.c:show_msg(642) [2010/03/30 11:10:11, 5] lib/util.c:show_msg(652) size=904 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51205 smb_tid=10241 smb_pid=23892 smb_uid=18433 smb_mid=21 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 848 (0x350) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 848 (0x350) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=849 [2010/03/30 11:10:11, 10] lib/util.c:dump_data(2223) [000] 00 05 00 02 03 10 00 00 00 50 03 20 00 0B 00 00 ........ .P. .... [010] 00 04 03 00 00 00 00 00 00 D7 70 93 D8 CE FC 54 ........ ..p....T [020] FF 49 48 93 B4 88 66 DD EB 9B EB 5E CD 5B 32 8B .IH...f. ...^.[2. [030] DE 8F 0B B7 CB 98 C4 3F 82 36 45 2E 8B 00 42 25 .......? .6E...B% [040] 90 4B E0 87 1F 24 E2 42 9B 2C 11 86 25 F0 C0 5A .K...$.B .,..%..Z [050] 54 65 31 F7 49 43 E0 8D 8C 6D 76 3C F9 D4 EA 1B Te1.IC.. .mv<.... [060] ED C0 B8 C1 E4 94 7A 8C 17 E2 30 9F D6 EA 38 BD ......z. ..0...8. [070] CD 00 18 EA 75 65 F5 EC 27 1F 13 32 2E AF 22 3D ....ue.. '..2.."= [080] 28 4D 27 BF 6F 17 B4 15 9F 1A 82 93 D5 D5 0A 9A (M'.o... ........ [090] 4F FA EA 9F 1D 59 82 75 AF EC A6 66 0C 17 9B 7A O....Y.u ...f...z [0A0] 33 FF 14 CF 3F 46 D6 49 CF 82 D2 8C 80 AE 05 0C 3...?F.I ........ [0B0] 3C FD E6 91 38 18 E9 C3 D6 82 48 3B B4 2D 02 02 <...8... ..H;.-.. [0C0] 2B 90 AE 65 E1 05 74 29 EB EB 0E 9D 66 7F 09 0C +..e..t) ....f... [0D0] 5B F0 51 3B EF 7F FE 91 7E E3 D0 EB 5E C7 DD 00 [.Q;.... ~...^... [0E0] BC 35 1B B7 D2 13 86 E5 EC 45 67 CC 4A 04 B6 41 .5...... .Eg.J..A [0F0] 9A CC 83 BF 0A D4 C1 2F 7B E8 82 6A 54 F6 9E 6C ......./ {..jT..l [100] 18 66 F2 A7 D2 1A 6D 9F B6 0D F2 7D 2D E5 56 B6 .f....m. ...}-.V. [110] F5 A5 6D AE 5B F8 59 79 20 F8 36 6E CD 0A BC 6F ..m.[.Yy .6n...o [120] 2A 6E 67 5F 39 80 12 64 36 22 72 45 6E D9 CF 73 *ng_9..d 6"rEn..s [130] FE 99 CD 43 2C 4D F1 87 96 FA E9 21 03 13 19 CA ...C,M.. ...!.... [140] 37 3A 62 5B EB 2B 39 1C E4 BB 90 3A A2 7F 90 51 7:b[.+9. ...:...Q [150] AC 15 D1 DF CC 72 46 64 36 8C BE D9 01 95 ED 19 .....rFd 6....... [160] BE 9B 6A C5 3E 79 4B 51 0A E4 9B F7 8B FB 74 87 ..j.>yKQ ......t. [170] FE E6 03 84 92 6C AA B4 2E 1C 04 A3 3F BA C1 D0 .....l.. ....?... [180] 92 3B 53 DE 9A 29 87 33 F4 93 19 A8 D5 44 87 E0 .;S..).3 .....D.. [190] 32 FD 3C 98 11 7A A9 93 4B B0 4F 98 E6 19 85 58 2.<..z.. K.O....X [1A0] 81 3B 89 F7 F1 F5 A3 1C 5A A7 AD 1F 9B 87 39 FE .;...... Z.....9. [1B0] 0B D1 5C AE 18 56 24 A4 AA E0 6B DC 42 7E DC 80 ..\..V$. ..k.B~.. [1C0] 9D DC 32 B4 04 93 5E 9F 3D 97 0A 1B F4 31 35 21 ..2...^. =....15! [1D0] F6 D0 B6 EC 37 B9 D5 8F 8A CD C8 53 B3 4D 88 4C ....7... ...S.M.L [1E0] 4B 01 02 C0 1C EC 71 61 60 BA 91 20 9C 01 87 1E K.....qa `.. .... [1F0] C6 D5 E6 00 B2 D1 95 30 38 48 DC 6D CF 77 8F 7D .......0 8H.m.w.} [2010/03/30 11:10:11, 10] libsmb/smb_signing.c:get_sequence_for_reply(80) get_sequence_for_reply: found seq = 39 mid = 21 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_debug(88) 000000 smb_io_rpc_hdr rpc_hdr [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0000 major : 05 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0001 minor : 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0002 pkt_type : 02 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0003 flags : 03 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0004 pack_type0: 10 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0005 pack_type1: 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0006 pack_type2: 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0007 pack_type3: 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0008 frag_len : 0350 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint16(689) 000a auth_len : 0020 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint32(718) 000c call_id : 0000000b [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_debug(88) 000010 smb_io_rpc_hdr_resp rpc_hdr_resp [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint32(718) 0010 alloc_hint: 00000304 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint16(689) 0014 context_id: 0000 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0016 cancel_ct : 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0017 reserved : 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_debug(88) 000328 smb_io_rpc_hdr_auth hdr_auth [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0328 auth_type : 44 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 0329 auth_level : 06 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 032a auth_pad_len : 0c [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8(624) 032b auth_reserved: 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint32(718) 032c auth_context_id: 00000001 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_debug(88) 000330 smb_io_rpc_auth_schannel_chk [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0330 sig : 77 00 7a 00 ff ff 00 00 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0338 seq_num: fc a0 eb da 93 95 68 f8 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0340 packet_digest: af 8f 0c 52 c2 41 f8 e7 [2010/03/30 11:10:11, 5] rpc_parse/parse_prs.c:prs_uint8s(865) 0348 confounder: e9 23 42 47 2d a0 2e 00 [2010/03/30 11:10:11, 10] rpc_parse/parse_prs.c:schannel_decode(1743) SCHANNEL: schannel_decode seq_num=3 data_len=784 [2010/03/30 11:10:11, 10] rpc_parse/parse_prs.c:schannel_decode(1763) SCHANNEL: schannel_decode seq_num=3 data_len=784 [2010/03/30 11:10:11, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(576) cli_pipe_validate_current_pdu: got pdu len 848, data_len 772, ss_len 12 [2010/03/30 11:10:11, 10] rpc_client/cli_pipe.c:rpc_api_pipe(842) rpc_api_pipe: got PDU len of 848 at offset 0 [2010/03/30 11:10:11, 10] rpc_client/cli_pipe.c:rpc_api_pipe(893) rpc_api_pipe: Remote machine ADDC05.rdomain.prv pipe \NETLOGON fnum 0x800f returned 1544 bytes. netr_DsrEnumerateDomainTrusts: struct netr_DsrEnumerateDomainTrusts out: struct netr_DsrEnumerateDomainTrusts trusts : * trusts: struct netr_DomainTrustList count : 0x00000006 (6) array : * array: ARRAY(6) array: struct netr_DomainTrust netbios_name : * netbios_name : 'EXTRDOMAINPRV' dns_name : * dns_name : 'external.rdomain.prv' trust_flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND parent_index : 0x00000005 (5) trust_type : NETR_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000020 (32) 0: NETR_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 1: NETR_TRUST_ATTRIBUTE_WITHIN_FOREST 0: NETR_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL sid : * sid : S-1-5-21-1597506669-720194359-3590636158 guid : 065cb337-3975-46ff-976a-3577b6fd03c8 array: struct netr_DomainTrust netbios_name : * netbios_name : 'USTNET' dns_name : NULL trust_flags : 0x00000022 (34) 0: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND parent_index : 0x00000000 (0) trust_type : NETR_TRUST_TYPE_DOWNLEVEL (1) trust_attributes : 0x00000004 (4) 0: NETR_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_UPLEVEL_ONLY 1: NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: NETR_TRUST_ATTRIBUTE_WITHIN_FOREST 0: NETR_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL sid : * sid : S-1-5-21-1803833563-1315966708-355810188 guid : 00000000-0000-0000-0000-000000000000 array: struct netr_DomainTrust netbios_name : * netbios_name : 'SDOMAIN' dns_name : NULL trust_flags : 0x00000022 (34) 0: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND parent_index : 0x00000000 (0) trust_type : NETR_TRUST_TYPE_DOWNLEVEL (1) trust_attributes : 0x00000004 (4) 0: NETR_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_UPLEVEL_ONLY 1: NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: NETR_TRUST_ATTRIBUTE_WITHIN_FOREST 0: NETR_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL sid : * sid : S-1-5-21-2100367721-831330134-1706709998 guid : 00000000-0000-0000-0000-000000000000 array: struct netr_DomainTrust netbios_name : * netbios_name : 'MEC' dns_name : NULL trust_flags : 0x00000022 (34) 0: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND parent_index : 0x00000000 (0) trust_type : NETR_TRUST_TYPE_DOWNLEVEL (1) trust_attributes : 0x00000004 (4) 0: NETR_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_UPLEVEL_ONLY 1: NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: NETR_TRUST_ATTRIBUTE_WITHIN_FOREST 0: NETR_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL sid : * sid : S-1-5-21-1702257101-1623065054-1714775081 guid : 00000000-0000-0000-0000-000000000000 array: struct netr_DomainTrust netbios_name : * netbios_name : 'KID' dns_name : * dns_name : 'kid.rdomain.prv' trust_flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND parent_index : 0x00000005 (5) trust_type : NETR_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000020 (32) 0: NETR_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 1: NETR_TRUST_ATTRIBUTE_WITHIN_FOREST 0: NETR_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL sid : * sid : S-1-5-21-29899443-2986348974-2400605501 guid : 5e4eeaf2-76ed-4295-89dc-59eb027a3d03 array: struct netr_DomainTrust netbios_name : * netbios_name : 'RDOMAINPRV' dns_name : * dns_name : 'rdomain.prv' trust_flags : 0x0000001d (29) 1: NETR_TRUST_FLAG_IN_FOREST 0: NETR_TRUST_FLAG_OUTBOUND 1: NETR_TRUST_FLAG_TREEROOT 1: NETR_TRUST_FLAG_PRIMARY 1: NETR_TRUST_FLAG_NATIVE 0: NETR_TRUST_FLAG_INBOUND parent_index : 0x00000000 (0) trust_type : NETR_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000000 (0) 0: NETR_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: NETR_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: NETR_TRUST_ATTRIBUTE_WITHIN_FOREST 0: NETR_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL sid : * sid : S-1-5-21-807755311-932547689-390315301 guid : 4565fe06-c79d-4b08-94f0-d671452eb6aa result : WERR_OK [2010/03/30 11:10:11, 5] winbindd/winbindd_cm.c:set_dc_type_and_flags_trustinfo(1715) set_dc_type_and_flags_trustinfo: domain KID is NOT in native mode. [2010/03/30 11:10:11, 5] winbindd/winbindd_cm.c:set_dc_type_and_flags_trustinfo(1719) set_dc_type_and_flags_trustinfo: domain KID is running active directory. [2010/03/30 11:10:11, 10] winbindd/winbindd_cache.c:wcache_tdc_fetch_domain(3863) wcache_tdc_fetch_domain: Searching for domain KID [2010/03/30 11:10:11, 10] winbindd/winbindd_cache.c:wcache_tdc_fetch_domain(3878) wcache_tdc_fetch_domain: Found domain KID [2010/03/30 11:10:11, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:10:11, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999822 [2010/03/30 11:10:11, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:10:11, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:10:11, 10] winbindd/winbindd_dual.c:fork_domain_child(1001) fork_domain_child called for domain 'KID' [2010/03/30 11:10:11, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:10:11, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999832 [2010/03/30 11:10:13, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:10:13, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23902 [2010/03/30 11:10:13, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:10:13, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999967 [2010/03/30 11:10:13, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:10:13, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:10:13, 5] winbindd/winbindd_idmap.c:winbindd_sid2uid_recv(289) sid2uid returned an error [2010/03/30 11:10:13, 5] winbindd/winbindd_user.c:getpwsid_sid2uid_recv(293) Could not query uid for user KID\testuser [2010/03/30 11:10:43, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:10:43, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999922 [2010/03/30 11:10:43, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:10:43, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:10:43, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:11:13, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:11:13, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999913 [2010/03/30 11:11:13, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:11:13, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:11:13, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:11:43, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:11:43, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999913 [2010/03/30 11:11:43, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:11:43, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:11:43, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:12:13, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:12:13, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999914 [2010/03/30 11:12:13, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:12:13, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:12:13, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:12:43, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:12:43, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999893 [2010/03/30 11:12:43, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:12:43, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:12:43, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:12:47, 6] winbindd/winbindd.c:new_connection(717) accepted socket 19 [2010/03/30 11:12:47, 10] winbindd/winbindd.c:process_request(402) process_request: request fn INTERFACE_VERSION [2010/03/30 11:12:47, 3] winbindd/winbindd_misc.c:winbindd_interface_version(757) [ 2783]: request interface version [2010/03/30 11:12:47, 10] winbindd/winbindd.c:process_request(402) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2010/03/30 11:12:47, 3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790) [ 2783]: request location of privileged pipe [2010/03/30 11:12:47, 6] winbindd/winbindd.c:new_connection(717) accepted socket 20 [2010/03/30 11:12:47, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:12:47, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:12:47, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:12:47, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:12:47, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999925 [2010/03/30 11:12:47, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:12:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:12:47, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:12:47, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:12:47, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:12:47, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:12:47, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 11:12:47, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:12:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:13:17, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:13:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999896 [2010/03/30 11:13:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:13:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:13:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:13:47, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:13:47, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999885 [2010/03/30 11:13:47, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:13:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:13:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:14:17, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:14:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999894 [2010/03/30 11:14:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:14:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:14:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:14:47, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:14:47, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999845 [2010/03/30 11:14:47, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:14:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:14:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:15:17, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:15:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999882 [2010/03/30 11:15:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:15:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:15:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:15:47, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:15:47, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999899 [2010/03/30 11:15:47, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:15:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:15:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:16:17, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:16:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999878 [2010/03/30 11:16:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:16:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:16:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:16:47, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:16:47, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999887 [2010/03/30 11:16:47, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:16:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:16:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:17:17, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:17:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999871 [2010/03/30 11:17:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:17:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:17:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:17:45, 6] winbindd/winbindd.c:new_connection(717) accepted socket 19 [2010/03/30 11:17:45, 10] winbindd/winbindd.c:process_request(402) process_request: request fn INTERFACE_VERSION [2010/03/30 11:17:45, 3] winbindd/winbindd_misc.c:winbindd_interface_version(757) [ 2487]: request interface version [2010/03/30 11:17:45, 10] winbindd/winbindd.c:process_request(402) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2010/03/30 11:17:45, 3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790) [ 2487]: request location of privileged pipe [2010/03/30 11:17:45, 6] winbindd/winbindd.c:new_connection(717) accepted socket 24 [2010/03/30 11:17:45, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETPWNAM [2010/03/30 11:17:45, 3] winbindd/winbindd_user.c:winbindd_getpwnam(373) [ 2487]: getpwnam eweech [2010/03/30 11:17:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:17:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999964 [2010/03/30 11:17:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:17:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:17:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:17:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:17:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:17:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:17:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:17:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:17:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:17:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:17:45, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-513 to a gid [2010/03/30 11:17:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:17:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:17:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:17:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:17:45, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:18:05, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:18:05, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:18:05, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:18:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:18:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:18:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:18:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:18:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:18:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:18:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999965 [2010/03/30 11:18:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:18:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:18:05, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:18:05, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:18:05, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:18:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:18:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999974 [2010/03/30 11:18:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:18:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:18:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:18:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:18:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:18:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:18:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:19:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:19:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999889 [2010/03/30 11:19:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:19:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:19:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:19:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:19:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999881 [2010/03/30 11:19:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:19:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:19:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:20:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:20:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999893 [2010/03/30 11:20:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:20:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:20:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:20:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:20:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999882 [2010/03/30 11:20:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:20:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:20:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:21:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:21:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999894 [2010/03/30 11:21:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:21:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:21:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:21:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:21:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999887 [2010/03/30 11:21:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:21:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:21:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:21:50, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETGROUPS [2010/03/30 11:21:50, 3] winbindd/winbindd_group.c:winbindd_getgroups(1384) [ 2487]: getgroups eweech [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999967 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=628 [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=226 [2010/03/30 11:21:50, 10] winbindd/winbindd_async.c:gettoken_recvaliases(1057) Expanding our own local groups [2010/03/30 11:21:50, 10] winbindd/winbindd_dual.c:fork_domain_child(1001) fork_domain_child called for domain 'CORMAILTEST01' [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999841 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23922 [2010/03/30 11:21:50, 10] winbindd/winbindd_async.c:getsidaliases_recv(777) getsidaliases return 0 SIDs [2010/03/30 11:21:50, 10] winbindd/winbindd_async.c:gettoken_recvaliases(1067) Expanding our own BUILTIN groups [2010/03/30 11:21:50, 10] winbindd/winbindd_dual.c:fork_domain_child(1001) fork_domain_child called for domain 'BUILTIN' [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999720 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23923 [2010/03/30 11:21:50, 10] winbindd/winbindd_async.c:getsidaliases_recv(777) getsidaliases return 0 SIDs [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-513 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30408 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-17997 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-47467 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30407 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999966 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30401 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30477 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30359 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-2164 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30495 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999964 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-36971 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30329 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97e040 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97e040 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-58365 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30471 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a7240 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a7240 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30329 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-58365 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999973 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30471 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97e040 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999973 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97e040 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-36971 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:21:50, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30495 to a gid [2010/03/30 11:21:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a7240 [2010/03/30 11:21:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999974 [2010/03/30 11:21:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a7240 "async_request_timeout" [2010/03/30 11:21:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:21:50, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:22:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:22:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999926 [2010/03/30 11:22:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:22:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:22:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:22:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:22:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999934 [2010/03/30 11:22:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:22:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:22:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:23:17, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:23:17, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:23:17, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:23:17, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:23:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999963 [2010/03/30 11:23:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:23:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:23:17, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:23:17, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:23:17, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:23:17, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:23:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:23:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:23:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:23:47, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:23:47, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999858 [2010/03/30 11:23:47, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:23:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:23:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:24:17, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:24:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999898 [2010/03/30 11:24:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:24:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:24:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:24:47, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:24:47, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999876 [2010/03/30 11:24:47, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:24:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:24:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:25:17, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:25:17, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999843 [2010/03/30 11:25:17, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:25:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:25:17, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:25:47, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:25:47, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999901 [2010/03/30 11:25:47, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:25:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:25:47, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:25:50, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETGROUPS [2010/03/30 11:25:50, 3] winbindd/winbindd_group.c:winbindd_getgroups(1384) [ 2487]: getgroups amavis [2010/03/30 11:25:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:25:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999966 [2010/03/30 11:25:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:25:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:25:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:25:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:25:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:25:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:25:50, 5] winbindd/winbindd_async.c:lookupname_recv2(296) lookup_name returned an error [2010/03/30 11:25:50, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETGROUPS [2010/03/30 11:25:50, 3] winbindd/winbindd_group.c:winbindd_getgroups(1384) [ 2487]: getgroups man [2010/03/30 11:25:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:25:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:25:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:25:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:25:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:25:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:25:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:25:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:25:50, 5] winbindd/winbindd_async.c:lookupname_recv2(296) lookup_name returned an error [2010/03/30 11:26:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:26:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999935 [2010/03/30 11:26:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:26:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:26:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:26:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:26:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999882 [2010/03/30 11:26:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:26:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:26:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:27:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:27:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999668 [2010/03/30 11:27:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:27:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:27:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:27:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:27:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999928 [2010/03/30 11:27:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:27:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:27:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:28:00, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETPWNAM [2010/03/30 11:28:00, 3] winbindd/winbindd_user.c:winbindd_getpwnam(373) [ 2487]: getpwnam eweech [2010/03/30 11:28:00, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:28:00, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999969 [2010/03/30 11:28:00, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:28:00, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:28:00, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:28:00, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:28:00, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:28:00, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:28:00, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:28:00, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:28:00, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:28:00, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:28:00, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-513 to a gid [2010/03/30 11:28:00, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:28:00, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:28:00, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:28:00, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:28:00, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:28:25, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:28:25, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:28:25, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:28:25, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:28:25, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:28:25, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:28:25, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:28:25, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:28:25, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:28:25, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:28:25, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:28:25, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:28:25, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:28:25, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:28:25, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:28:25, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:28:25, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:28:25, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:28:25, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:28:55, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:28:55, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999900 [2010/03/30 11:28:55, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:28:55, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:28:55, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:29:25, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:29:25, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999894 [2010/03/30 11:29:25, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:29:25, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:29:25, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:29:35, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETGROUPS [2010/03/30 11:29:35, 3] winbindd/winbindd_group.c:winbindd_getgroups(1384) [ 2487]: getgroups plauss [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999969 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=538 [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999942 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=226 [2010/03/30 11:29:35, 10] winbindd/winbindd_async.c:gettoken_recvaliases(1057) Expanding our own local groups [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999969 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23922 [2010/03/30 11:29:35, 10] winbindd/winbindd_async.c:getsidaliases_recv(777) getsidaliases return 0 SIDs [2010/03/30 11:29:35, 10] winbindd/winbindd_async.c:gettoken_recvaliases(1067) Expanding our own BUILTIN groups [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23923 [2010/03/30 11:29:35, 10] winbindd/winbindd_async.c:getsidaliases_recv(777) getsidaliases return 0 SIDs [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-513 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999963 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-37062 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-50627 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999953 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-17997 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30401 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30477 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-2164 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999973 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30495 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-36971 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30329 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-58365 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30471 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97e040 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97e040 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30329 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-58365 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a7240 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a7240 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30471 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-36971 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:29:35, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-30495 to a gid [2010/03/30 11:29:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97e040 [2010/03/30 11:29:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999974 [2010/03/30 11:29:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97e040 "async_request_timeout" [2010/03/30 11:29:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:29:35, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:30:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:30:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999911 [2010/03/30 11:30:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:30:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:30:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:30:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:30:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999865 [2010/03/30 11:30:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:30:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:30:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:31:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:31:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999937 [2010/03/30 11:31:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:31:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:31:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:31:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:31:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999898 [2010/03/30 11:31:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:31:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:31:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:32:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:32:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999808 [2010/03/30 11:32:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:32:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:32:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:32:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:32:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999916 [2010/03/30 11:32:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:32:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:32:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:33:05, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:33:05, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999939 [2010/03/30 11:33:05, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:33:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:33:05, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:33:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:33:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999896 [2010/03/30 11:33:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:33:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:33:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:33:40, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:33:40, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:33:40, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:33:40, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:33:40, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999961 [2010/03/30 11:33:40, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:33:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:33:40, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:33:40, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:33:40, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:33:40, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:33:40, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999969 [2010/03/30 11:33:40, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:33:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:34:10, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:34:10, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999872 [2010/03/30 11:34:10, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:34:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:34:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:34:40, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:34:40, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999897 [2010/03/30 11:34:40, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:34:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:34:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:35:10, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:35:10, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999902 [2010/03/30 11:35:10, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:35:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:35:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:35:40, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:35:40, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999885 [2010/03/30 11:35:40, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:35:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:35:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:36:10, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:36:10, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999886 [2010/03/30 11:36:10, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:36:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:36:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:36:40, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:36:40, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999910 [2010/03/30 11:36:40, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:36:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:36:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:37:10, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:37:10, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999950 [2010/03/30 11:37:10, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:37:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:37:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:37:40, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:37:40, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999881 [2010/03/30 11:37:40, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:37:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:37:40, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:38:10, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:38:10, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999872 [2010/03/30 11:38:10, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:38:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:38:10, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:38:15, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETPWNAM [2010/03/30 11:38:15, 3] winbindd/winbindd_user.c:winbindd_getpwnam(373) [ 2487]: getpwnam eweech [2010/03/30 11:38:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:38:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999969 [2010/03/30 11:38:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:38:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:38:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:38:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:38:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:38:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:38:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:38:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:38:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:38:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:38:15, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-513 to a gid [2010/03/30 11:38:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:38:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999967 [2010/03/30 11:38:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:38:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:38:15, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:38:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:38:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999895 [2010/03/30 11:38:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:38:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:38:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:38:49, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:38:49, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:38:49, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:38:49, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:38:49, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999962 [2010/03/30 11:38:49, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:38:49, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:38:49, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:38:49, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:38:49, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:38:49, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:38:49, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:38:49, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:38:49, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:39:19, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:39:19, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999876 [2010/03/30 11:39:19, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:39:19, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:39:19, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:39:35, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETGROUPS [2010/03/30 11:39:35, 3] winbindd/winbindd_group.c:winbindd_getgroups(1384) [ 2487]: getgroups root [2010/03/30 11:39:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:39:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 11:39:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:39:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:39:35, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:39:35, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:39:35, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:39:35, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:39:35, 5] winbindd/winbindd_async.c:lookupname_recv2(296) lookup_name returned an error [2010/03/30 11:39:50, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETGROUPS [2010/03/30 11:39:50, 3] winbindd/winbindd_group.c:winbindd_getgroups(1384) [ 2487]: getgroups www-data [2010/03/30 11:39:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:39:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999967 [2010/03/30 11:39:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:39:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:39:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:39:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:39:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:39:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:39:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:39:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:39:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999969 [2010/03/30 11:39:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:39:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:39:50, 5] winbindd/winbindd_async.c:lookupname_recv2(296) lookup_name returned an error [2010/03/30 11:40:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:40:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999906 [2010/03/30 11:40:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:40:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:40:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:40:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:40:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999899 [2010/03/30 11:40:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:40:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:40:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:41:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:41:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999904 [2010/03/30 11:41:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:41:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:41:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:41:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:41:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999911 [2010/03/30 11:41:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:41:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:41:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:42:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:42:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999892 [2010/03/30 11:42:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:42:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:42:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:42:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:42:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999883 [2010/03/30 11:42:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:42:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:42:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:43:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:43:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999883 [2010/03/30 11:43:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:43:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:43:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:43:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:43:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999909 [2010/03/30 11:43:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:43:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:43:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:44:04, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:44:04, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:44:04, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:44:04, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:44:04, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999967 [2010/03/30 11:44:04, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:44:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:44:04, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:44:04, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:44:04, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:44:04, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:44:04, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 11:44:04, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:44:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:44:34, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:44:34, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999884 [2010/03/30 11:44:34, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:44:34, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:44:34, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:45:04, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:45:04, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999896 [2010/03/30 11:45:04, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:45:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:45:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:45:34, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:45:34, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999886 [2010/03/30 11:45:34, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:45:34, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:45:34, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:46:04, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:46:04, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999894 [2010/03/30 11:46:04, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:46:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:46:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:46:34, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:46:34, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999899 [2010/03/30 11:46:34, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:46:34, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:46:34, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:47:04, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:47:04, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999890 [2010/03/30 11:47:04, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:47:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:47:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:47:34, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:47:34, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999875 [2010/03/30 11:47:34, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:47:34, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:47:34, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:48:04, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:48:04, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999898 [2010/03/30 11:48:04, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:48:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:48:04, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:48:30, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETPWNAM [2010/03/30 11:48:30, 3] winbindd/winbindd_user.c:winbindd_getpwnam(373) [ 2487]: getpwnam eweech [2010/03/30 11:48:30, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:48:30, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999961 [2010/03/30 11:48:30, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:48:30, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:48:30, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:48:30, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:48:30, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:48:30, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:48:30, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:48:30, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:48:30, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:48:30, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:48:30, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-513 to a gid [2010/03/30 11:48:30, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:48:30, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999973 [2010/03/30 11:48:30, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:48:30, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:48:30, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:49:00, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:49:00, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999886 [2010/03/30 11:49:00, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:49:00, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:49:00, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:49:21, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:49:21, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:49:21, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:49:21, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:49:21, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 11:49:21, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:49:21, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:49:21, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:49:21, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:49:21, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:49:21, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:49:21, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:49:21, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:49:21, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:49:51, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:49:51, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999894 [2010/03/30 11:49:51, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:49:51, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:49:51, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:50:21, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:50:21, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999872 [2010/03/30 11:50:21, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:50:21, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:50:21, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:50:51, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:50:51, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999896 [2010/03/30 11:50:51, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:50:51, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:50:51, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:51:21, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:51:21, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999898 [2010/03/30 11:51:22, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:51:22, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:51:22, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:51:51, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:51:51, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999885 [2010/03/30 11:51:52, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:51:52, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:51:52, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:52:22, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:52:22, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999883 [2010/03/30 11:52:22, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:52:22, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:52:22, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:52:52, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:52:52, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999888 [2010/03/30 11:52:52, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:52:52, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:52:52, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:53:22, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:53:22, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999899 [2010/03/30 11:53:22, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:53:22, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:53:22, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:53:52, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:53:52, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999896 [2010/03/30 11:53:52, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:53:52, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:53:52, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:54:22, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:54:22, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999898 [2010/03/30 11:54:22, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:54:22, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:54:22, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:54:37, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:54:37, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:54:37, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:54:37, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:54:37, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:54:37, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:54:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:54:37, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:54:37, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:54:37, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:54:37, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:54:37, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:54:37, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:54:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:55:07, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:55:07, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999937 [2010/03/30 11:55:07, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:55:07, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:55:07, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:55:37, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:55:37, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999919 [2010/03/30 11:55:37, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:55:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:55:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:56:07, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:56:07, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999900 [2010/03/30 11:56:07, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:56:07, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:56:07, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:56:37, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:56:37, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999925 [2010/03/30 11:56:37, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:56:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:56:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:57:07, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:57:07, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999894 [2010/03/30 11:57:07, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:57:07, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:57:07, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:57:37, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:57:37, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999881 [2010/03/30 11:57:37, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:57:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:57:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:58:07, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:58:07, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999909 [2010/03/30 11:58:07, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:58:07, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:58:07, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:58:37, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:58:37, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999899 [2010/03/30 11:58:37, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:58:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:58:37, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:58:45, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETPWNAM [2010/03/30 11:58:45, 3] winbindd/winbindd_user.c:winbindd_getpwnam(373) [ 2487]: getpwnam eweech [2010/03/30 11:58:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:58:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 11:58:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:58:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:58:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:58:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 11:58:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:58:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:58:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:58:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999965 [2010/03/30 11:58:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:58:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:58:45, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-513 to a gid [2010/03/30 11:58:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:58:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999973 [2010/03/30 11:58:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:58:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 11:58:45, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 11:59:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:59:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999898 [2010/03/30 11:59:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:59:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:59:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:59:45, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 11:59:45, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999888 [2010/03/30 11:59:45, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 11:59:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:59:45, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 11:59:50, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:59:50, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:59:50, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:59:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 11:59:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999957 [2010/03/30 11:59:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 11:59:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 11:59:50, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 11:59:50, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 11:59:50, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 11:59:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 11:59:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 300/0 [2010/03/30 11:59:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 11:59:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:00:01, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETGROUPS [2010/03/30 12:00:01, 3] winbindd/winbindd_group.c:winbindd_getgroups(1384) [ 2487]: getgroups list [2010/03/30 12:00:01, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:00:01, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999964 [2010/03/30 12:00:01, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:00:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:00:01, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:00:01, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 12:00:01, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:00:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:00:01, 5] winbindd/winbindd_async.c:lookupname_recv2(296) lookup_name returned an error [2010/03/30 12:00:31, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:00:31, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999881 [2010/03/30 12:00:31, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:00:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:00:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:01:01, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:01:01, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999878 [2010/03/30 12:01:01, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:01:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:01:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:01:31, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:01:31, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999902 [2010/03/30 12:01:31, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:01:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:01:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:02:01, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:02:01, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999882 [2010/03/30 12:02:01, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:02:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:02:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:02:31, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:02:31, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999895 [2010/03/30 12:02:31, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:02:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:02:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:03:01, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:03:01, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999898 [2010/03/30 12:03:01, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:03:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:03:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:03:31, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:03:31, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999883 [2010/03/30 12:03:31, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:03:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:03:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:04:01, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:04:01, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999891 [2010/03/30 12:04:01, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:04:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:04:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:04:31, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:04:31, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999881 [2010/03/30 12:04:31, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:04:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:04:31, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:05:01, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:05:01, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999899 [2010/03/30 12:05:01, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:05:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:05:01, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:05:03, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 12:05:03, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 12:05:03, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 12:05:03, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:05:03, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 12:05:03, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:05:03, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:05:03, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 12:05:03, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 12:05:03, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 12:05:03, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:05:03, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999939 [2010/03/30 12:05:03, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:05:03, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:05:33, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:05:33, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999889 [2010/03/30 12:05:33, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:05:33, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:05:33, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:06:03, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:06:03, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999896 [2010/03/30 12:06:03, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:06:03, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:06:03, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:06:33, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:06:33, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999877 [2010/03/30 12:06:33, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:06:33, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:06:33, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:07:03, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:07:03, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999891 [2010/03/30 12:07:03, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:07:03, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:07:03, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:07:33, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:07:33, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999903 [2010/03/30 12:07:33, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:07:33, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:07:33, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:08:03, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:08:03, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999909 [2010/03/30 12:08:03, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:08:03, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:08:03, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:08:20, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETGROUPS [2010/03/30 12:08:20, 3] winbindd/winbindd_group.c:winbindd_getgroups(1384) [ 2487]: getgroups postfix [2010/03/30 12:08:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:08:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999970 [2010/03/30 12:08:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:08:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:08:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:08:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 12:08:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:08:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:08:20, 5] winbindd/winbindd_async.c:lookupname_recv2(296) lookup_name returned an error [2010/03/30 12:08:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:08:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999868 [2010/03/30 12:08:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:08:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:08:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:09:20, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:09:20, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999893 [2010/03/30 12:09:20, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:09:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:09:20, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:09:50, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETGROUPS [2010/03/30 12:09:50, 3] winbindd/winbindd_group.c:winbindd_getgroups(1384) [ 2487]: getgroups nobody [2010/03/30 12:09:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:09:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999963 [2010/03/30 12:09:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:09:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:09:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2485) Retrieving extra data length=367 [2010/03/30 12:09:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:09:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 12:09:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:09:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:09:50, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:09:50, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999973 [2010/03/30 12:09:50, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:09:50, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:09:50, 5] winbindd/winbindd_async.c:lookupname_recv2(296) lookup_name returned an error [2010/03/30 12:10:15, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 12:10:15, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 12:10:15, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 12:10:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:10:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999968 [2010/03/30 12:10:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:10:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:10:15, 10] winbindd/winbindd.c:process_request(402) process_request: request fn GETPWNAM [2010/03/30 12:10:15, 3] winbindd/winbindd_user.c:winbindd_getpwnam(373) [ 2487]: getpwnam eweech [2010/03/30 12:10:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:10:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999967 [2010/03/30 12:10:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:10:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:10:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:10:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 12:10:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:10:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898 [2010/03/30 12:10:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a5570 [2010/03/30 12:10:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999962 [2010/03/30 12:10:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a5570 "async_request_timeout" [2010/03/30 12:10:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 12:10:15, 7] winbindd/winbindd_idmap.c:winbindd_sid2gid_async(363) winbindd_sid2gid_async: Resolving S-1-5-21-807755311-932547689-390315301-513 to a gid [2010/03/30 12:10:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 9a6ee0 [2010/03/30 12:10:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999972 [2010/03/30 12:10:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 9a6ee0 "async_request_timeout" [2010/03/30 12:10:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23900 [2010/03/30 12:10:15, 5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(345) sid2gid returned an error [2010/03/30 12:10:15, 10] winbindd/winbindd.c:process_request(402) process_request: request fn AUTH_CRAP [2010/03/30 12:10:15, 3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754) [ 2783]: pam auth crap domain: [] user: eweech [2010/03/30 12:10:15, 8] lib/util.c:is_myname(2098) is_myname("RDOMAINPRV") returns 0 [2010/03/30 12:10:15, 10] lib/events.c:event_add_timed(128) Added timed event "async_request_timeout": 97a4a0 [2010/03/30 12:10:15, 10] lib/events.c:get_timed_events_timeout(318) timed_events_timeout: 299/999971 [2010/03/30 12:10:15, 10] lib/events.c:timed_event_destructor(65) Destroying timed event 97a4a0 "async_request_timeout" [2010/03/30 12:10:15, 10] winbindd/winbindd_cache.c:cache_retrieve_response(2463) Retrieving response for pid 23898