[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] param/loadparm.c:lp_file_list_changed(2998)
  lp_file_list_changed()
  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Wed Apr  7 16:45:32 2010
  
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/reply.c:reply_special(543)
  init msg_type=0x81 msg_flags=0x0
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] param/loadparm.c:lp_file_list_changed(2998)
  lp_file_list_changed()
  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Wed Apr  7 16:45:32 2010
  
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/reply.c:reply_special(543)
  init msg_type=0x81 msg_flags=0x0
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 0, effective(0, 0), real(0, 0)] lib/util_sock.c:read_data(534)
  read_data: read failure for 4 bytes to client 10.3.28.7. Error = Connection reset by peer
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_sock.c:receive_smb_raw(672)
  receive_smb_raw: length < 0!
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:timeout_processing(1365)
  timeout_processing: receive_smb error (Connection reset by peer) Exiting
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/gencache.c:gencache_shutdown(94)
  Closing cache file
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] libsmb/namecache.c:namecache_shutdown(79)
  namecache_shutdown: netbios namecache closed successfully.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/connection.c:yield_connection(69)
  Yielding connection to 
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/connection.c:yield_connection(76)
  yield_connection: tdb_delete for name  failed with error Record does not exist.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/server.c:exit_server_common(675)
  Server exit (normal exit)
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 133
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x85
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1110)
  Transaction 1 of length 137
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=133
  smb_com=0x72
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51283
  smb_tid=0
  smb_pid=65279
  smb_uid=0
  smb_mid=0
  smt_wct=0
  smb_bcc=98
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 02 50 43 20 4E 45 54 57  4F 52 4B 20 50 52 4F 47  .PC NETW ORK PROG
  [010] 52 41 4D 20 31 2E 30 00  02 4C 41 4E 4D 41 4E 31  RAM 1.0. .LANMAN1
  [020] 2E 30 00 02 57 69 6E 64  6F 77 73 20 66 6F 72 20  .0..Wind ows for 
  [030] 57 6F 72 6B 67 72 6F 75  70 73 20 33 2E 31 61 00  Workgrou ps 3.1a.
  [040] 02 4C 4D 31 2E 32 58 30  30 32 00 02 4C 41 4E 4D  .LM1.2X0 02..LANM
  [050] 41 4E 32 2E 31 00 02 4E  54 20 4C 4D 20 30 2E 31  AN2.1..N T LM 0.1
  [060] 32 00                                             2. 
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:switch_message(914)
  switch message SMBnegprot (pid 7157) conn 0x0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/negprot.c:reply_negprot(487)
  Requested protocol [PC NETWORK PROGRAM 1.0]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/negprot.c:reply_negprot(487)
  Requested protocol [LANMAN1.0]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/negprot.c:reply_negprot(487)
  Requested protocol [Windows for Workgroups 3.1a]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/negprot.c:reply_negprot(487)
  Requested protocol [LM1.2X002]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/negprot.c:reply_negprot(487)
  Requested protocol [LANMAN2.1]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/negprot.c:reply_negprot(487)
  Requested protocol [NT LM 0.12]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:set_remote_arch(2197)
  set_remote_arch: Client arch is 'Win2K'
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] param/loadparm.c:lp_file_list_changed(2998)
  lp_file_list_changed()
  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Wed Apr  7 16:45:32 2010
  
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/connection.c:claim_connection(170)
  claiming  0
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] param/loadparm.c:lp_file_list_changed(2998)
  lp_file_list_changed()
  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Wed Apr  7 16:45:32 2010
  
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/negprot.c:reply_nt1(357)
  using SPNEGO
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/negprot.c:reply_negprot(580)
  Selected protocol NT LM 0.12
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/negprot.c:reply_negprot(586)
  negprot index=5
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=127
  smb_com=0x72
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=0
  smb_pid=65279
  smb_uid=0
  smb_mid=0
  smt_wct=17
  smb_vwv[ 0]=    5 (0x5)
  smb_vwv[ 1]=12803 (0x3203)
  smb_vwv[ 2]=  256 (0x100)
  smb_vwv[ 3]= 1024 (0x400)
  smb_vwv[ 4]=   65 (0x41)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=  256 (0x100)
  smb_vwv[ 7]=62720 (0xF500)
  smb_vwv[ 8]=   27 (0x1B)
  smb_vwv[ 9]=64768 (0xFD00)
  smb_vwv[10]=33011 (0x80F3)
  smb_vwv[11]=  128 (0x80)
  smb_vwv[12]=40400 (0x9DD0)
  smb_vwv[13]=25218 (0x6282)
  smb_vwv[14]=51926 (0xCAD6)
  smb_vwv[15]=34817 (0x8801)
  smb_vwv[16]=  255 (0xFF)
  smb_bcc=58
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 62 2D 66 73 00 00 00 00  00 00 00 00 00 00 00 00  b-fs.... ........
  [010] 60 28 06 06 2B 06 01 05  05 02 A0 1E 30 1C A0 0E  `(..+... ....0...
  [020] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A3 0A  0...+... ..7.....
  [030] 30 08 A0 06 1B 04 4E 4F  4E 45                    0.....NO NE
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 236
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0xec
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1110)
  Transaction 2 of length 240
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=236
  smb_com=0x73
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=0
  smb_pid=65279
  smb_uid=0
  smb_mid=64
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=  236 (0xEC)
  smb_vwv[ 2]=16644 (0x4104)
  smb_vwv[ 3]=   50 (0x32)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=   74 (0x4A)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=  212 (0xD4)
  smb_vwv[11]=40960 (0xA000)
  smb_bcc=177
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 60 48 06 06 2B 06 01 05  05 02 A0 3E 30 3C A0 0E  `H..+... ...>0<..
  [010] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A2 2A  0...+... ..7....*
  [020] 04 28 4E 54 4C 4D 53 53  50 00 01 00 00 00 07 82  .(NTLMSS P.......
  [030] 08 A2 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
  [040] 00 00 05 01 28 0A 00 00  00 0F 00 57 00 69 00 6E  ....(... ...W.i.n
  [050] 00 64 00 6F 00 77 00 73  00 20 00 32 00 30 00 30  .d.o.w.s . .2.0.0
  [060] 00 32 00 20 00 53 00 65  00 72 00 76 00 69 00 63  .2. .S.e .r.v.i.c
  [070] 00 65 00 20 00 50 00 61  00 63 00 6B 00 20 00 33  .e. .P.a .c.k. .3
  [080] 00 20 00 32 00 36 00 30  00 30 00 00 00 57 00 69  . .2.6.0 .0...W.i
  [090] 00 6E 00 64 00 6F 00 77  00 73 00 20 00 32 00 30  .n.d.o.w .s. .2.0
  [0A0] 00 30 00 32 00 20 00 35  00 2E 00 31 00 00 00 00  .0.2. .5 ...1....
  [0B0] 00                                                . 
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:switch_message(914)
  switch message SMBsesssetupX (pid 7157) conn 0x0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X(849)
  wct=12 flg2=0xc807
[2010/04/07 16:56:32, 2, effective(0, 0), real(0, 0)] smbd/sesssetup.c:setup_new_vc_session(799)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(660)
  Doing spnego session setup
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(691)
  NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:set_remote_arch(2197)
  set_remote_arch: Client arch is 'WinXP'
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(186)
  register_vuid: allocated vuid = 100
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_spnego_negotiate(551)
  Got OID 1 3 6 1 4 1 311 2 2 10
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_spnego_negotiate(554)
  Got secblob of size 40
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:make_auth_context_subsystem(484)
  Making default auth method list for DC, security=user, encrypt passwords = yes
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(47)
  Attempting to register auth backend sam
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(59)
  Successfully added auth method 'sam'
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(47)
  Attempting to register auth backend sam_ignoredomain
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(59)
  Successfully added auth method 'sam_ignoredomain'
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(47)
  Attempting to register auth backend unix
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(59)
  Successfully added auth method 'unix'
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(47)
  Attempting to register auth backend winbind
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(59)
  Successfully added auth method 'winbind'
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(47)
  Attempting to register auth backend smbserver
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(59)
  Successfully added auth method 'smbserver'
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(47)
  Attempting to register auth backend trustdomain
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(59)
  Successfully added auth method 'trustdomain'
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(47)
  Attempting to register auth backend ntdomain
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(59)
  Successfully added auth method 'ntdomain'
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(47)
  Attempting to register auth backend guest
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:smb_register_auth(59)
  Successfully added auth method 'guest'
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match guest
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method guest has a valid init
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match sam
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method sam has a valid init
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match winbind:trustdomain
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match trustdomain
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method trustdomain has a valid init
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method winbind has a valid init
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
  Got NTLMSSP neg_flags=0xa2088207
    NTLMSSP_NEGOTIATE_UNICODE
    NTLMSSP_NEGOTIATE_OEM
    NTLMSSP_REQUEST_TARGET
    NTLMSSP_NEGOTIATE_NTLM
    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
    NTLMSSP_NEGOTIATE_NTLM2
    NTLMSSP_NEGOTIATE_128
    NTLMSSP_NEGOTIATE_56
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(97)
  auth_get_challenge: module guest did not want to specify a challenge
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(97)
  auth_get_challenge: module sam did not want to specify a challenge
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(97)
  auth_get_challenge: module winbind did not want to specify a challenge
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(137)
  auth_context challenge created by random
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(138)
  challenge is: 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 54 D3 42 82 78 58 F7 0B                           T.B.xX.. 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=264
  smb_com=0x73
  smb_rcls=22
  smb_reh=0
  smb_err=49152
  smb_flg=136
  smb_flg2=51201
  smb_tid=0
  smb_pid=65279
  smb_uid=100
  smb_mid=64
  smt_wct=4
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=  132 (0x84)
  smb_bcc=221
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] A1 81 81 30 7F A0 03 0A  01 01 A1 0C 06 0A 2B 06  ...0.... ......+.
  [010] 01 04 01 82 37 02 02 0A  A2 6A 04 68 4E 54 4C 4D  ....7... .j.hNTLM
  [020] 53 53 50 00 02 00 00 00  0A 00 0A 00 30 00 00 00  SSP..... ....0...
  [030] 05 82 89 A2 54 D3 42 82  78 58 F7 0B 00 00 00 00  ....T.B. xX......
  [040] 00 00 00 00 2E 00 2E 00  3A 00 00 00 4D 00 41 00  ........ :...M.A.
  [050] 52 00 43 00 4F 00 02 00  0A 00 4D 00 41 00 52 00  R.C.O... ..M.A.R.
  [060] 43 00 4F 00 01 00 08 00  42 00 2D 00 46 00 53 00  C.O..... B.-.F.S.
  [070] 04 00 00 00 03 00 08 00  62 00 2D 00 66 00 73 00  ........ b.-.f.s.
  [080] 00 00 00 00 00 55 00 6E  00 69 00 78 00 00 00 53  .....U.n .i.x...S
  [090] 00 61 00 6D 00 62 00 61  00 20 00 33 00 2E 00 30  .a.m.b.a . .3...0
  [0A0] 00 2E 00 32 00 33 00 64  00 2D 00 36 00 2D 00 31  ...2.3.d .-.6.-.1
  [0B0] 00 30 00 38 00 33 00 2D  00 53 00 55 00 53 00 45  .0.8.3.- .S.U.S.E
  [0C0] 00 2D 00 53 00 4C 00 31  00 30 00 2E 00 32 00 00  .-.S.L.1 .0...2..
  [0D0] 00 4D 00 41 00 52 00 43  00 4F 00 00 00           .M.A.R.C .O...
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 250
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0xfa
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1110)
  Transaction 3 of length 254
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=250
  smb_com=0x73
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=0
  smb_pid=65279
  smb_uid=100
  smb_mid=128
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=  250 (0xFA)
  smb_vwv[ 2]=16644 (0x4104)
  smb_vwv[ 3]=   50 (0x32)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=   89 (0x59)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=  212 (0xD4)
  smb_vwv[11]=40960 (0xA000)
  smb_bcc=191
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] A1 57 30 55 A2 53 04 51  4E 54 4C 4D 53 53 50 00  .W0U.S.Q NTLMSSP.
  [010] 03 00 00 00 01 00 01 00  50 00 00 00 00 00 00 00  ........ P.......
  [020] 51 00 00 00 00 00 00 00  48 00 00 00 00 00 00 00  Q....... H.......
  [030] 48 00 00 00 08 00 08 00  48 00 00 00 00 00 00 00  H....... H.......
  [040] 51 00 00 00 05 8A 88 A2  05 01 28 0A 00 00 00 0F  Q....... ..(.....
  [050] 42 00 2D 00 58 00 50 00  00 57 00 69 00 6E 00 64  B.-.X.P. .W.i.n.d
  [060] 00 6F 00 77 00 73 00 20  00 32 00 30 00 30 00 32  .o.w.s.  .2.0.0.2
  [070] 00 20 00 53 00 65 00 72  00 76 00 69 00 63 00 65  . .S.e.r .v.i.c.e
  [080] 00 20 00 50 00 61 00 63  00 6B 00 20 00 33 00 20  . .P.a.c .k. .3. 
  [090] 00 32 00 36 00 30 00 30  00 00 00 57 00 69 00 6E  .2.6.0.0 ...W.i.n
  [0A0] 00 64 00 6F 00 77 00 73  00 20 00 32 00 30 00 30  .d.o.w.s . .2.0.0
  [0B0] 00 32 00 20 00 35 00 2E  00 31 00 00 00 00 00     .2. .5.. .1.....
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:switch_message(914)
  switch message SMBsesssetupX (pid 7157) conn 0x0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X(849)
  wct=12 flg2=0xc807
[2010/04/07 16:56:32, 2, effective(0, 0), real(0, 0)] smbd/sesssetup.c:setup_new_vc_session(799)
  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(660)
  Doing spnego session setup
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(691)
  NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] libsmb/ntlmssp.c:ntlmssp_server_auth(739)
  Got user=[] domain=[] workstation=[B-XP] len1=1 len2=0
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] param/loadparm.c:lp_file_list_changed(2998)
  lp_file_list_changed()
  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Wed Apr  7 16:45:32 2010
  
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info_map(161)
  make_user_info_map: Mapping user []\[] from workstation [B-XP]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:is_trusted_domain(2020)
  is_trusted_domain: Checking for domain trust with [MARCO]
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] passdb/secrets.c:secrets_fetch_trusted_domain_password(340)
  secrets_fetch failed!
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/gencache.c:gencache_get(329)
  Cache entry with key = TDOM/MARCO couldn't be found
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] libsmb/trustdom_cache.c:trustdom_cache_fetch(184)
  no entry for trusted domain MARCO found.
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info(75)
  attempting to make a user_info for  ()
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info(85)
  making strings for 's user_info struct
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info(117)
  making blobs for 's user_info struct
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info(135)
  made an encrypted user_info for  ()
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(221)
  check_ntlm_password:  Checking password for unmapped user []\[]@[B-XP] with the new password interface
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(224)
  check_ntlm_password:  mapped user is: [MARCO]\[]@[B-XP]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(233)
  check_ntlm_password: auth_context challenge created by random
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(235)
  challenge is: 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 54 D3 42 82 78 58 F7 0B                           T.B.xX.. 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=65534))], scope => [2]
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_close(1080)
  The connection to the LDAP server was closed
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smb_ldap_setup_conn(632)
  smb_ldap_setup_connection: ldap://10.3.1.3
[2010/04/07 16:56:32, 2, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open_connection(788)
  smbldap_open_connection: connection opened
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_connect_system(947)
  ldap_connect_system: Binding to ldap server ldap://10.3.1.3 as "cn=Administrator,dc=marco,dc=de"
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_connect_system(992)
  ldap_connect_system: succesful connection to the LDAP server
  ldap_connect_system: LDAP server does support paged results
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1060)
  The LDAP server is succesfully connected
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 3: DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 1: DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 4: DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 2: DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 5 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 6 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 7 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 8 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 9 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 10 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 21 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_username(534)
  pdb_set_username: setting username nobody, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 12 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_domain(557)
  pdb_set_domain: setting domain MARCO, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 14 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_nt_username(580)
  pdb_set_nt_username: setting nt username , was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 15 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_fullname(603)
  pdb_set_full_name: setting full name nobody, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 13 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_homedir(696)
  pdb_set_homedir: setting home dir \\b-fs\nobody, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 1 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_dir_drive(672)
  pdb_set_dir_drive: setting dir drive H:, was NULL
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 3 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_logon_script(626)
  pdb_set_logon_script: setting logon script logon.bat, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 4 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_profile_path(649)
  pdb_set_profile_path: setting profile path \\b-fs\nobody\.ntprofile, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 2 -> now DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 23 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_workstations(739)
  pdb_set_workstations: setting workstations , was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 24 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 26 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 34 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_user_sid(463)
  pdb_set_user_sid: setting user sid S-1-5-21-2611814498-2282654866-1273439328-501
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 18 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73)
  pdb_set_user_sid_from_rid:
  	setting user sid S-1-5-21-2611814498-2282654866-1273439328-501 from rid 501
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] passdb/pdb_interface.c:lookup_global_sam_rid(1480)
  lookup_global_sam_rid: looking up RID 513.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [dc=marco,dc=de], filter => [(&(sambaSID=S-1-5-21-2611814498-2282654866-1273439328-513)(objectclass=sambaSamAccount))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getsampwsid(1491)
  ldapsam_getsampwsid: Unable to locate SID [S-1-5-21-2611814498-2282654866-1273439328-513] count=0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-21-2611814498-2282654866-1273439328-513))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 2, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:init_group_from_ldap(2140)
  init_group_from_ldap: Entry found for group: 52
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/lookup_sid.c:sid_to_gid(1336)
  sid_to_gid: S-1-5-21-2611814498-2282654866-1273439328-513 -> 52
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] passdb/lookup_sid.c:store_gid_sid_cache(1071)
  store_gid_sid_cache: gid 52 in cache -> S-1-5-21-2611814498-2282654866-1273439328-513
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_group_sid(521)
  pdb_set_group_sid: setting group sid S-1-5-21-2611814498-2282654866-1273439328-513
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 19 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100)
  pdb_set_group_sid_from_rid:
  	setting group sid S-1-5-21-2611814498-2282654866-1273439328-513 from rid 513
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 16 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 29 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 30 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 31 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 20 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 17 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 27 -> now SET
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(270)
  check_ntlm_password: guest authentication for user [] succeeded
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(309)
  check_ntlm_password:  guest authentication for user [] -> [] -> [nobody] succeeded
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:free_user_info(1867)
  attempting to free (and zero) a user_info structure
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:free_user_info(1871)
  structure was created for 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-32-544))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-32-545))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(|(objectclass=sambaGroupMapping)(sambaGroupType=4))(|(sambaSIDList=S-1-5-21-2611814498-2282654866-1273439328-501)(sambaSIDList=S-1-1-0)(sambaSIDList=S-1-5-2)(sambaSIDList=S-1-5-32-546)))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(|(objectclass=sambaGroupMapping)(sambaGroupType=4))(|(sambaSIDList=S-1-5-21-2611814498-2282654866-1273439328-501)(sambaSIDList=S-1-1-0)(sambaSIDList=S-1-5-2)(sambaSIDList=S-1-5-32-546)))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/privileges.c:get_privileges(261)
  get_privileges: No privileges assigned to SID [S-1-5-21-2611814498-2282654866-1273439328-501]
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/privileges.c:get_privileges_for_sids(459)
  get_privileges_for_sids: sid = S-1-1-0
  Privilege set:
  SE_PRIV  0x0 0x0 0x0 0x0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/privileges.c:get_privileges(261)
  get_privileges: No privileges assigned to SID [S-1-5-2]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/privileges.c:get_privileges(261)
  get_privileges: No privileges assigned to SID [S-1-5-32-546]
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-1-0))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:create_local_token(1023)
  Could not convert SID S-1-1-0 to gid, ignoring it
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-2))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:create_local_token(1023)
  Could not convert SID S-1-5-2 to gid, ignoring it
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-32-546))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:create_local_token(1023)
  Could not convert SID S-1-5-32-546 to gid, ignoring it
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(454)
  NT user token of user S-1-5-21-2611814498-2282654866-1273439328-501
  contains 4 SIDs
  SID[  0]: S-1-5-21-2611814498-2282654866-1273439328-501
  SID[  1]: S-1-1-0
  SID[  2]: S-1-5-2
  SID[  3]: S-1-5-32-546
  SE_PRIV  0x0 0x0 0x0 0x0
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(133)
  Got NT session key of length 16
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(140)
  Got LM session key of length 16
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] libsmb/ntlmssp.c:ntlmssp_server_auth(841)
  ntlmssp_server_auth: Using unmodified nt session key.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(338)
  NTLMSSP Sign/Seal - Initialising with flags:
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
  Got NTLMSSP neg_flags=0xa2088205
    NTLMSSP_NEGOTIATE_UNICODE
    NTLMSSP_REQUEST_TARGET
    NTLMSSP_NEGOTIATE_NTLM
    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
    NTLMSSP_NEGOTIATE_NTLM2
    NTLMSSP_NEGOTIATE_128
    NTLMSSP_NEGOTIATE_56
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(186)
  register_vuid: allocated vuid = 101
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 22: DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_pw.c:getpwnam_alloc(76)
  Got nobody from pwnam_cache
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(277)
  register_vuid: (65534,65534) nobody  MARCO guest=1
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(280)
  User name: nobody	Real name: nobody
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(301)
  UNIX uid 65534 is UNIX user nobody, and will be vuid 101
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] param/loadparm.c:lp_file_list_changed(2998)
  lp_file_list_changed()
  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Wed Apr  7 16:45:32 2010
  
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=140
  smb_com=0x73
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=0
  smb_pid=65279
  smb_uid=101
  smb_mid=128
  smt_wct=4
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    9 (0x9)
  smb_bcc=97
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] A1 07 30 05 A0 03 0A 01  00 55 00 6E 00 69 00 78  ..0..... .U.n.i.x
  [010] 00 00 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  ...S.a.m .b.a. .3
  [020] 00 2E 00 30 00 2E 00 32  00 33 00 64 00 2D 00 36  ...0...2 .3.d.-.6
  [030] 00 2D 00 31 00 30 00 38  00 33 00 2D 00 53 00 55  .-.1.0.8 .3.-.S.U
  [040] 00 53 00 45 00 2D 00 53  00 4C 00 31 00 30 00 2E  .S.E.-.S .L.1.0..
  [050] 00 32 00 00 00 4D 00 41  00 52 00 43 00 4F 00 00  .2...M.A .R.C.O..
  [060] 00                                                . 
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 74
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x4a
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1110)
  Transaction 4 of length 78
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=74
  smb_com=0x75
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=0
  smb_pid=65279
  smb_uid=101
  smb_mid=192
  smt_wct=4
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=   74 (0x4A)
  smb_vwv[ 2]=    8 (0x8)
  smb_vwv[ 3]=    1 (0x1)
  smb_bcc=31
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 00 5C 00 5C 00 42 00 2D  00 46 00 53 00 5C 00 49  .\.\.B.- .F.S.\.I
  [010] 00 50 00 43 00 24 00 00  00 3F 3F 3F 3F 3F 00     .P.C.$.. .?????.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:switch_message(914)
  switch message SMBtconX (pid 7157) conn 0x0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] smbd/reply.c:reply_tcon_and_X(668)
  Client requested device type [?????] for share [IPC$]
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/service.c:make_connection(1125)
  making a connection to 'normal' service ipc$
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_alloc(131)
  Finding user nobody
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_internals(75)
  Trying _Get_Pwnam(), username as lowercase is nobody
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_pw.c:getpwnam_alloc(76)
  Got nobody from pwnam_cache
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_internals(108)
  Get_Pwnam_internals did find user [nobody]!
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/service.c:set_conn_connectpath(122)
  set_conn_connectpath: service IPC$, connectpath = /var/tmp
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/service.c:make_connection_snum(761)
  Connect path is '/var/tmp' for service [IPC$]
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] lib/sharesec.c:get_share_security(130)
  get_share_security: using default secdesc for IPC$
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_map_generic(176)
  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(233)
  se_access_check: requested access 0x00000002, for NT token with 4 entries and first sid S-1-5-21-2611814498-2282654866-1273439328-501.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(250)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(251)
  se_access_check: user sid is S-1-5-21-2611814498-2282654866-1273439328-501
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(308)
  se_access_check: access (2) granted.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/vfs.c:vfs_init_default(219)
  Initialising default vfs hooks
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/connection.c:claim_connection(170)
  claiming IPC$ 0
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/share_access.c:user_ok_token(229)
  user_ok_token: share IPC$ is ok for unix user nobody
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/share_access.c:is_share_read_only_for_token(271)
  is_share_read_only_for_user: share IPC$ is read-only for unix user nobody
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] lib/sharesec.c:get_share_security(130)
  get_share_security: using default secdesc for IPC$
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_map_generic(176)
  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(233)
  se_access_check: requested access 0x00000001, for NT token with 4 entries and first sid S-1-5-21-2611814498-2282654866-1273439328-501.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(250)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(251)
  se_access_check: user sid is S-1-5-21-2611814498-2282654866-1273439328-501
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(308)
  se_access_check: access (1) granted.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(454)
  NT user token of user S-1-5-21-2611814498-2282654866-1273439328-501
  contains 4 SIDs
  SID[  0]: S-1-5-21-2611814498-2282654866-1273439328-501
  SID[  1]: S-1-1-0
  SID[  2]: S-1-5-2
  SID[  3]: S-1-5-32-546
  SE_PRIV  0x0 0x0 0x0 0x0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 65534
  Primary group is 65534 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(260)
  change_to_user uid=(65534,65534) gid=(0,65534)
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/service.c:make_connection_snum(950)
  b-xp (10.3.1.6) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 7157)
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 2, effective(0, 0), real(0, 0)] smbd/reply.c:reply_tcon_and_X(711)
  Serving IPC$ as a Dfs root
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/reply.c:reply_tcon_and_X(716)
  tconX service=IPC$ 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=48
  smb_com=0x75
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=192
  smt_wct=3
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    3 (0x3)
  smb_bcc=7
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 49 50 43 00 00 00 00                              IPC.... 
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 104
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x68
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1110)
  Transaction 5 of length 108
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=104
  smb_com=0xa2
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=944
  smb_uid=101
  smb_mid=256
  smt_wct=24
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]= 4608 (0x1200)
  smb_vwv[ 3]= 5632 (0x1600)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=40704 (0x9F00)
  smb_vwv[ 8]=  513 (0x201)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_vwv[14]=    0 (0x0)
  smb_vwv[15]=  768 (0x300)
  smb_vwv[16]=    0 (0x0)
  smb_vwv[17]=  256 (0x100)
  smb_vwv[18]=    0 (0x0)
  smb_vwv[19]=16384 (0x4000)
  smb_vwv[20]=16384 (0x4000)
  smb_vwv[21]=  512 (0x200)
  smb_vwv[22]=    0 (0x0)
  smb_vwv[23]=  256 (0x100)
  smb_bcc=21
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 00 5C 00 4E 00 45 00 54  00 4C 00 4F 00 47 00 4F  .\.N.E.T .L.O.G.O
  [010] 00 4E 00 00 00                                    .N... 
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:switch_message(914)
  switch message SMBntcreateX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(454)
  NT user token of user S-1-5-21-2611814498-2282654866-1273439328-501
  contains 4 SIDs
  SID[  0]: S-1-5-21-2611814498-2282654866-1273439328-501
  SID[  1]: S-1-1-0
  SID[  2]: S-1-5-2
  SID[  3]: S-1-5-32-546
  SE_PRIV  0x0 0x0 0x0 0x0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 65534
  Primary group is 65534 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(260)
  change_to_user uid=(65534,65534) gid=(0,65534)
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/vfs.c:vfs_ChDir(741)
  vfs_ChDir to /var/tmp
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:reply_ntcreate_and_X(501)
  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:nt_open_pipe(325)
  nt_open_pipe: Opening pipe \NETLOGON.
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:nt_open_pipe(346)
  nt_open_pipe: Known pipe NETLOGON opening.
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180)
  Open pipe requested NETLOGON (pipes_open=0)
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285)
  Create pipe requested NETLOGON
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
  init_pipe_handles: created handle list for pipe NETLOGON
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
  init_pipe_handles: pipe_handles ref count = 1 for pipe NETLOGON
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366)
  Created internal pipe NETLOGON (pipes_open=0)
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
  Opened pipe NETLOGON with handle 76d5 (pipes_open=1)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269)
  open pipes: name NETLOGON pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:do_ntcreate_pipe_open(395)
  do_ntcreate_pipe_open: open pipe = \NETLOGON
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=103
  smb_com=0xa2
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=944
  smb_uid=101
  smb_mid=256
  smt_wct=34
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=54528 (0xD500)
  smb_vwv[ 3]=  374 (0x176)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_vwv[14]=    0 (0x0)
  smb_vwv[15]=    0 (0x0)
  smb_vwv[16]=    0 (0x0)
  smb_vwv[17]=    0 (0x0)
  smb_vwv[18]=    0 (0x0)
  smb_vwv[19]=    0 (0x0)
  smb_vwv[20]=    0 (0x0)
  smb_vwv[21]=32768 (0x8000)
  smb_vwv[22]=    0 (0x0)
  smb_vwv[23]=    0 (0x0)
  smb_vwv[24]=    0 (0x0)
  smb_vwv[25]=    0 (0x0)
  smb_vwv[26]=    0 (0x0)
  smb_vwv[27]=    0 (0x0)
  smb_vwv[28]=    0 (0x0)
  smb_vwv[29]=    0 (0x0)
  smb_vwv[30]=    0 (0x0)
  smb_vwv[31]=  512 (0x200)
  smb_vwv[32]=65280 (0xFF00)
  smb_vwv[33]=    5 (0x5)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 136
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x88
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 6 of length 140
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=136
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=320
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30421 (0x76D5)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=   72 (0x48)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=   72 (0x48)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=73
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
  [020] 00 78 56 34 12 34 12 CD  AB EF 00 01 23 45 67 CF  .xV4.4.. ....#Eg.
  [030] FB 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=1)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d5 name: NETLOGON open: Yes len: 72
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 72
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 56
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 0b
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0048
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000001
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 11, flags = 3
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 56
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 11
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_bind_req(1523)
  api_pipe_bind_req: decode request. 1523
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_bind_req(1534)
  api_pipe_bind_req: \PIPE\NETLOGON -> \PIPE\lsass
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_rb 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_rpc_hdr_bba 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0000 max_tsize: 10b8
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0002 max_rsize: 10b8
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 assoc_gid: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0008 num_contexts: 01
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000c context_id  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      000e num_transfer_syntaxes: 01
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      00000f smb_io_rpc_iface 
[2010/04/07 16:56:32, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000010 smb_io_uuid uuid
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0010 data   : 12345678
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0014 data   : 1234
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0016 data   : abcd
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              0018 data   : ef 00 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              001a data   : 01 23 45 67 cf fb 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0020 version: 00000001
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000024 smb_io_rpc_iface 
[2010/04/07 16:56:32, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000024 smb_io_uuid uuid
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0024 data   : 8a885d04
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0028 data   : 1ceb
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              002a data   : 11c9
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              002c data   : 9f e8 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              002e data   : 08 00 2b 10 48 60 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0034 version: 00000002
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_bind_req(1576)
  api_pipe_bind_req: make response. 1576
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(985)
  check_bind_req for \PIPE\NETLOGON
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(990)
  checking \PIPE\lsarpc
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(990)
  checking \PIPE\lsarpc
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(990)
  checking \PIPE\samr
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(990)
  checking \PIPE\NETLOGON
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_ba 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_rpc_hdr_bba 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0000 max_tsize: 10b8
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0002 max_rsize: 10b8
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 assoc_gid: 000053f0
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000008 smb_io_rpc_addr_str 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0008 len: 000c
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          000a str: \PIPE\lsass.
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000016 smb_io_rpc_results 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
          0018 num_results: 01
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          001c result     : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          001e reason     : 0000
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000020 smb_io_rpc_iface 
[2010/04/07 16:56:32, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000020 smb_io_uuid uuid
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0020 data   : 8a885d04
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0024 data   : 1ceb
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0026 data   : 11c9
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              0028 data   : 9f e8 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              002a data   : 08 00 2b 10 48 60 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0030 version: 00000002
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 0c
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0044
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000001
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 56
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d5 nwritten=72
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=320
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=   72 (0x48)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 7 of length 63
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=384
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30421 (0x76D5)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=1)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d5 name: NETLOGON len: 1024
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054)
  read_from_pipe: NETLOGON: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d5 min=1024 max=1024 nread=68
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=127
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=384
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   68 (0x44)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=68
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
  [010] B8 10 B8 10 F0 53 00 00  0C 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
  [020] 6C 73 61 73 73 00 00 00  01 00 00 00 00 00 00 00  lsass... ........
  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
  [040] 02 00 00 00                                       .... 
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 150
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x96
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 8 of length 154
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=150
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=448
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30421 (0x76D5)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=   86 (0x56)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=   86 (0x56)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=87
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 00 03 10 00 00  00 56 00 00 00 01 00 00  ........ .V......
  [010] 00 3E 00 00 00 00 00 04  00 00 00 02 00 07 00 00  .>...... ........
  [020] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 42 00 2D  ........ .\.\.B.-
  [030] 00 46 00 53 00 00 00 88  8A 05 00 00 00 00 00 00  .F.S.... ........
  [040] 00 05 00 00 00 42 00 2D  00 58 00 50 00 00 00 B3  .....B.- .X.P....
  [050] 2D B7 57 86 01 23 AC                              -.W..#. 
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=1)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d5 name: NETLOGON open: Yes len: 86
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 86
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 86
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 86, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 70
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 70
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0056
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000001
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 0, flags = 3
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 70
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 70, incoming data = 70
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_req req
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 alloc_hint: 0000003e
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0004 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0006 opnum     : 0004
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 73
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_request(2223)
  Requested \PIPE\NETLOGON
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2258)
  api_rpcTNP: NETLOGON op 0x4 - api_rpcTNP: rpc command: NET_REQCHAL
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2284)
  api_rpc_cmds[0].fn == 0x80115d70
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 net_io_q_req_chal 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 undoc_buffer: 00020000
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000004 smb_io_unistr2 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 uni_max_len: 00000007
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0008 offset     : 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          000c uni_str_len: 00000007
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
          0010 buffer     : \.\.B.-.F.S...
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      00001e smb_io_unistr2 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0020 uni_max_len: 00000005
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0024 offset     : 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0028 uni_str_len: 00000005
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
          002c buffer     : B.-.X.P...
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000036 smb_io_chal 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          0036 data: b3 2d b7 57 86 01 23 ac 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_netlog_nt.c:init_net_r_req_chal(41)
  init_net_r_req_chal: 41
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 net_io_r_req_chal 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_chal 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          0000 data: 2d 4f aa 5a 9e 78 f9 2a 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_ntstatus(763)
      0008 status: NT_STATUS_OK
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2305)
  api_rpcTNP: called NETLOGON successfully
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 24
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 70
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d5 nwritten=86
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=448
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=   86 (0x56)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 9 of length 63
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=512
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30421 (0x76D5)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=1)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d5 name: NETLOGON len: 1024
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068)
  read_from_pipe: NETLOGON: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 12.
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr hdr
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 02
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0024
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000001
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000010 smb_io_rpc_hdr_resp resp
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0010 alloc_hint: 0000000c
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0014 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0016 cancel_ct : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0017 reserved  : 00
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d5 min=1024 max=1024 nread=36
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=95
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=512
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   36 (0x24)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=36
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 02 03 10 00 00 00  24 00 00 00 01 00 00 00  ........ $.......
  [010] 0C 00 00 00 00 00 00 00  2D 4F AA 5A 9E 78 F9 2A  ........ -O.Z.x.*
  [020] 00 00 00 00                                       .... 
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 184
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0xb8
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 10 of length 188
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=184
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=576
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30421 (0x76D5)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=  120 (0x78)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=  120 (0x78)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=121
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 00 03 10 00 00  00 78 00 00 00 02 00 00  ........ .x......
  [010] 00 60 00 00 00 00 00 1A  00 00 00 02 00 07 00 00  .`...... ........
  [020] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 42 00 2D  ........ .\.\.B.-
  [030] 00 46 00 53 00 00 00 88  8A 06 00 00 00 00 00 00  .F.S.... ........
  [040] 00 06 00 00 00 42 00 2D  00 58 00 50 00 24 00 00  .....B.- .X.P.$..
  [050] 00 02 00 86 01 05 00 00  00 00 00 00 00 05 00 00  ........ ........
  [060] 00 42 00 2D 00 58 00 50  00 00 00 D7 61 6B DD 39  .B.-.X.P ....ak.9
  [070] 9D 56 CD 00 00 FF BF 0F  60                       .V...... `
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=1)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d5 name: NETLOGON open: Yes len: 120
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 120
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 120
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 120, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 104
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 104
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0078
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000002
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 0, flags = 3
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 104
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 104, incoming data = 104
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_req req
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 alloc_hint: 00000060
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0004 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0006 opnum     : 001a
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_request(2223)
  Requested \PIPE\NETLOGON
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2258)
  api_rpcTNP: NETLOGON op 0x1a - unknown
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 23
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0020
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000002
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000010 smb_io_rpc_hdr_resp resp
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0010 alloc_hint: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0014 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0016 cancel_ct : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0017 reserved  : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000018 smb_io_rpc_hdr_fault fault
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_dcerpc_status(793)
      0018 status  : DCERPC_FAULT_OP_RNG_ERROR
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      001c reserved: 00000000
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 104
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d5 nwritten=120
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=576
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=  120 (0x78)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 11 of length 63
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=640
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30421 (0x76D5)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=1)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d5 name: NETLOGON len: 1024
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054)
  read_from_pipe: NETLOGON: current_pdu_len = 32, current_pdu_sent = 0 returning 32 bytes.
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d5 min=1024 max=1024 nread=32
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=91
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=640
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   32 (0x20)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=32
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 03 23 10 00 00 00  20 00 00 00 02 00 00 00  ...#....  .......
  [010] 00 00 00 00 00 00 00 00  02 00 01 1C 00 00 00 00  ........ ........
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 184
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0xb8
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 12 of length 188
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=184
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=704
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30421 (0x76D5)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=  120 (0x78)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=  120 (0x78)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=121
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 00 03 10 00 00  00 78 00 00 00 03 00 00  ........ .x......
  [010] 00 60 00 00 00 00 00 0F  00 00 00 02 00 07 00 00  .`...... ........
  [020] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 42 00 2D  ........ .\.\.B.-
  [030] 00 46 00 53 00 00 00 88  8A 06 00 00 00 00 00 00  .F.S.... ........
  [040] 00 06 00 00 00 42 00 2D  00 58 00 50 00 24 00 00  .....B.- .X.P.$..
  [050] 00 02 00 86 01 05 00 00  00 00 00 00 00 05 00 00  ........ ........
  [060] 00 42 00 2D 00 58 00 50  00 00 00 D7 61 6B DD 39  .B.-.X.P ....ak.9
  [070] 9D 56 CD 00 00 FF BF 0F  60                       .V...... `
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=1)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d5 name: NETLOGON open: Yes len: 120
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 120
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 120
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 120, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 104
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 104
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0078
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000003
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 0, flags = 3
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 104
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 104, incoming data = 104
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_req req
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 alloc_hint: 00000060
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0004 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0006 opnum     : 000f
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_request(2223)
  Requested \PIPE\NETLOGON
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2258)
  api_rpcTNP: NETLOGON op 0xf - api_rpcTNP: rpc command: NET_AUTH2
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2284)
  api_rpc_cmds[2].fn == 0x801160e0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 net_io_q_auth_2 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_log_info 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0000 undoc_buffer: 00020000
[2010/04/07 16:56:32, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000004 smb_io_unistr2 unistr2
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0004 uni_max_len: 00000007
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0008 offset     : 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              000c uni_str_len: 00000007
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
              0010 buffer     : \.\.B.-.F.S...
[2010/04/07 16:56:32, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          00001e smb_io_unistr2 unistr2
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0020 uni_max_len: 00000006
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0024 offset     : 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0028 uni_str_len: 00000006
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
              002c buffer     : B.-.X.P.$...
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0038 sec_chan: 0002
[2010/04/07 16:56:32, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          00003a smb_io_unistr2 unistr2
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              003c uni_max_len: 00000005
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0040 offset     : 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0044 uni_str_len: 00000005
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
              0048 buffer     : B.-.X.P...
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000052 smb_io_chal 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          0052 data: d7 61 6b dd 39 9d 56 cd 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      00005a net_io_neg_flags 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          005c neg_flags: 600fbfff
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [dc=marco,dc=de], filter => [(&(uid=B-XP$)(objectclass=sambaSamAccount))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 2, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:init_sam_from_ldap(541)
  init_sam_from_ldap: Entry found for user: B-XP$
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_username(534)
  pdb_set_username: setting username B-XP$, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 12 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_domain(557)
  pdb_set_domain: setting domain MARCO, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 14 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_nt_username(580)
  pdb_set_nt_username: setting nt username B-XP$, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 15 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(476)
  pdb_set_user_sid_from_string: setting user sid S-1-5-21-2611814498-2282654866-1273439328-1023
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_user_sid(463)
  pdb_set_user_sid: setting user sid S-1-5-21-2611814498-2282654866-1273439328-1023
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 18 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 18: SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 21 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaLogonTime] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaLogoffTime] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaKickoffTime] = [<does not exist>]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 9 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 10 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_fullname(603)
  pdb_set_full_name: setting full name B-XP$, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 13 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaHomeDrive] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_dir_drive(672)
  pdb_set_dir_drive: setting dir drive H:, was NULL
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 3 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaHomePath] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_homedir(696)
  pdb_set_homedir: setting home dir \\b-fs\b-xp_, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 1 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaLogonScript] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_logon_script(626)
  pdb_set_logon_script: setting logon script logon.bat, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 4 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaProfilePath] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_profile_path(649)
  pdb_set_profile_path: setting profile path \\b-fs\b-xp_\.ntprofile, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 2 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [description] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaUserWorkstations] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaMungedDial] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaLMPassword] = [<does not exist>]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 33 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 20 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 16 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 17 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaBadPasswordCount] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaBadPasswordTime] = [<does not exist>]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaLogonHours] = [<does not exist>]
[2010/04/07 16:56:32, 7, effective(0, 0), real(0, 0)] passdb/login_cache.c:login_cache_read(87)
  Looking up login cache for user B-XP$
[2010/04/07 16:56:32, 7, effective(0, 0), real(0, 0)] passdb/login_cache.c:login_cache_read(101)
  No cache entry found
[2010/04/07 16:56:32, 9, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:init_sam_from_ldap(898)
  No cache entry, bad count = 0, bad time = 0
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(425)
  element 35 -> now CHANGED
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 21: SET
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_alloc(131)
  Finding user B-XP$
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_internals(75)
  Trying _Get_Pwnam(), username as lowercase is b-xp$
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_internals(108)
  Get_Pwnam_internals did find user [B-XP$]!
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=100))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 3: DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 1: DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 4: DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 2: DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 5 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 6 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 7 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 8 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 9 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 10 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 21 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_username(534)
  pdb_set_username: setting username B-XP$, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 12 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_domain(557)
  pdb_set_domain: setting domain MARCO, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 14 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_nt_username(580)
  pdb_set_nt_username: setting nt username B-XP$, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 15 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_fullname(603)
  pdb_set_full_name: setting full name B-XP$, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 13 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_homedir(696)
  pdb_set_homedir: setting home dir \\b-fs\b-xp_, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 1 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_dir_drive(672)
  pdb_set_dir_drive: setting dir drive H:, was NULL
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 3 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_logon_script(626)
  pdb_set_logon_script: setting logon script logon.bat, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 4 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_profile_path(649)
  pdb_set_profile_path: setting profile path \\b-fs\b-xp_\.ntprofile, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 2 -> now DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 23 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_workstations(739)
  pdb_set_workstations: setting workstations , was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 24 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 26 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 33 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 34 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_user_sid(463)
  pdb_set_user_sid: setting user sid S-1-5-21-2611814498-2282654866-1273439328-1023
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 18 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73)
  pdb_set_user_sid_from_rid:
  	setting user sid S-1-5-21-2611814498-2282654866-1273439328-1023 from rid 1023
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] passdb/lookup_sid.c:fetch_gid_from_cache(1027)
  fetch gid from cache 52 -> S-1-5-21-2611814498-2282654866-1273439328-513
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_group_sid(521)
  pdb_set_group_sid: setting group sid S-1-5-21-2611814498-2282654866-1273439328-513
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 19 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100)
  pdb_set_group_sid_from_rid:
  	setting group sid S-1-5-21-2611814498-2282654866-1273439328-513 from rid 513
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 16 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 29 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 30 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 31 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 20 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 17 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 27 -> now SET
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] FF 5B 15 B3 FF 84 F4 75  03 A0 53 54 95 A2 9C 2E  .[.....u ..ST....
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_server_init(182)
  creds_server_init: neg_flags : 600fbfff
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_server_init(183)
  creds_server_init: client chal : B32DB757860123AC
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_server_init(184)
  creds_server_init: server chal : 2D4FAA5A9E78F92A
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_init_64(117)
  creds_init_64
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_init_64(118)
  	clnt_chal_in: B32DB757860123AC
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_init_64(119)
  	srv_chal_in : 2D4FAA5A9E78F92A
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_init_64(120)
  	clnt+srv : E07C61B2247A1CD7
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_init_64(121)
  	sess_key_out : BE0D463757EA1496
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_server_init(202)
  creds_server_init: clnt : D7616BDD399D56CD
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_server_init(203)
  creds_server_init: server : 88385EEAF4545AAF
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_server_init(204)
  creds_server_init: seed : D7616BDD399D56CD
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_server_check(221)
  creds_server_check: credentials check OK.
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] passdb/secrets.c:secrets_store_schannel_session_info(995)
  secrets_store_schannel_session_info: stored schannel info with key SECRETS/SCHANNEL/B-XP
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 net_io_r_auth_2 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_chal 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          0000 data: 88 38 5e ea f4 54 5a af 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000008 net_io_neg_flags 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0008 neg_flags: 400001ff
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_ntstatus(763)
      000c status: NT_STATUS_OK
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2305)
  api_rpcTNP: called NETLOGON successfully
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 36
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 104
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d5 nwritten=120
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=704
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=  120 (0x78)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 13 of length 63
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=768
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30421 (0x76D5)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=1)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d5 name: NETLOGON len: 1024
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068)
  read_from_pipe: NETLOGON: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 16.
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr hdr
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 02
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0028
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000003
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000010 smb_io_rpc_hdr_resp resp
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0010 alloc_hint: 00000010
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0014 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0016 cancel_ct : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0017 reserved  : 00
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d5 min=1024 max=1024 nread=40
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=99
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=768
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   40 (0x28)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=40
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 02 03 10 00 00 00  28 00 00 00 03 00 00 00  ........ (.......
  [010] 10 00 00 00 00 00 00 00  88 38 5E EA F4 54 5A AF  ........ .8^..TZ.
  [020] FF 01 00 40 00 00 00 00                           ...@.... 
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 236
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0xec
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 14 of length 240
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=236
  smb_com=0x73
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=0
  smb_pid=65279
  smb_uid=0
  smb_mid=832
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=  236 (0xEC)
  smb_vwv[ 2]=16644 (0x4104)
  smb_vwv[ 3]=   50 (0x32)
  smb_vwv[ 4]=    1 (0x1)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=   74 (0x4A)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=  212 (0xD4)
  smb_vwv[11]=40960 (0xA000)
  smb_bcc=177
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 60 48 06 06 2B 06 01 05  05 02 A0 3E 30 3C A0 0E  `H..+... ...>0<..
  [010] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A2 2A  0...+... ..7....*
  [020] 04 28 4E 54 4C 4D 53 53  50 00 01 00 00 00 07 82  .(NTLMSS P.......
  [030] 08 A2 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
  [040] 00 00 05 01 28 0A 00 00  00 0F 00 57 00 69 00 6E  ....(... ...W.i.n
  [050] 00 64 00 6F 00 77 00 73  00 20 00 32 00 30 00 30  .d.o.w.s . .2.0.0
  [060] 00 32 00 20 00 53 00 65  00 72 00 76 00 69 00 63  .2. .S.e .r.v.i.c
  [070] 00 65 00 20 00 50 00 61  00 63 00 6B 00 20 00 33  .e. .P.a .c.k. .3
  [080] 00 20 00 32 00 36 00 30  00 30 00 00 00 57 00 69  . .2.6.0 .0...W.i
  [090] 00 6E 00 64 00 6F 00 77  00 73 00 20 00 32 00 30  .n.d.o.w .s. .2.0
  [0A0] 00 30 00 32 00 20 00 35  00 2E 00 31 00 00 00 00  .0.2. .5 ...1....
  [0B0] 00                                                . 
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBsesssetupX (pid 7157) conn 0x0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X(849)
  wct=12 flg2=0xc807
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(660)
  Doing spnego session setup
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(691)
  NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(186)
  register_vuid: allocated vuid = 102
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_spnego_negotiate(551)
  Got OID 1 3 6 1 4 1 311 2 2 10
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_spnego_negotiate(554)
  Got secblob of size 40
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:make_auth_context_subsystem(484)
  Making default auth method list for DC, security=user, encrypt passwords = yes
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match guest
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method guest has a valid init
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match sam
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method sam has a valid init
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match winbind:trustdomain
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match trustdomain
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method trustdomain has a valid init
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method winbind has a valid init
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
  Got NTLMSSP neg_flags=0xa2088207
    NTLMSSP_NEGOTIATE_UNICODE
    NTLMSSP_NEGOTIATE_OEM
    NTLMSSP_REQUEST_TARGET
    NTLMSSP_NEGOTIATE_NTLM
    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
    NTLMSSP_NEGOTIATE_NTLM2
    NTLMSSP_NEGOTIATE_128
    NTLMSSP_NEGOTIATE_56
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(97)
  auth_get_challenge: module guest did not want to specify a challenge
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(97)
  auth_get_challenge: module sam did not want to specify a challenge
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(97)
  auth_get_challenge: module winbind did not want to specify a challenge
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(137)
  auth_context challenge created by random
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:get_ntlm_challenge(138)
  challenge is: 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 25 5D D1 62 98 EA DB 65                           %].b...e 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=264
  smb_com=0x73
  smb_rcls=22
  smb_reh=0
  smb_err=49152
  smb_flg=136
  smb_flg2=51201
  smb_tid=0
  smb_pid=65279
  smb_uid=102
  smb_mid=832
  smt_wct=4
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=  132 (0x84)
  smb_bcc=221
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] A1 81 81 30 7F A0 03 0A  01 01 A1 0C 06 0A 2B 06  ...0.... ......+.
  [010] 01 04 01 82 37 02 02 0A  A2 6A 04 68 4E 54 4C 4D  ....7... .j.hNTLM
  [020] 53 53 50 00 02 00 00 00  0A 00 0A 00 30 00 00 00  SSP..... ....0...
  [030] 05 82 89 A2 25 5D D1 62  98 EA DB 65 00 00 00 00  ....%].b ...e....
  [040] 00 00 00 00 2E 00 2E 00  3A 00 00 00 4D 00 41 00  ........ :...M.A.
  [050] 52 00 43 00 4F 00 02 00  0A 00 4D 00 41 00 52 00  R.C.O... ..M.A.R.
  [060] 43 00 4F 00 01 00 08 00  42 00 2D 00 46 00 53 00  C.O..... B.-.F.S.
  [070] 04 00 00 00 03 00 08 00  62 00 2D 00 66 00 73 00  ........ b.-.f.s.
  [080] 00 00 00 00 00 55 00 6E  00 69 00 78 00 00 00 53  .....U.n .i.x...S
  [090] 00 61 00 6D 00 62 00 61  00 20 00 33 00 2E 00 30  .a.m.b.a . .3...0
  [0A0] 00 2E 00 32 00 33 00 64  00 2D 00 36 00 2D 00 31  ...2.3.d .-.6.-.1
  [0B0] 00 30 00 38 00 33 00 2D  00 53 00 55 00 53 00 45  .0.8.3.- .S.U.S.E
  [0C0] 00 2D 00 53 00 4C 00 31  00 30 00 2E 00 32 00 00  .-.S.L.1 .0...2..
  [0D0] 00 4D 00 41 00 52 00 43  00 4F 00 00 00           .M.A.R.C .O...
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 250
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0xfa
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1110)
  Transaction 15 of length 254
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=250
  smb_com=0x73
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=0
  smb_pid=65279
  smb_uid=102
  smb_mid=896
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=  250 (0xFA)
  smb_vwv[ 2]=16644 (0x4104)
  smb_vwv[ 3]=   50 (0x32)
  smb_vwv[ 4]=    1 (0x1)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=   89 (0x59)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=  212 (0xD4)
  smb_vwv[11]=40960 (0xA000)
  smb_bcc=191
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] A1 57 30 55 A2 53 04 51  4E 54 4C 4D 53 53 50 00  .W0U.S.Q NTLMSSP.
  [010] 03 00 00 00 01 00 01 00  50 00 00 00 00 00 00 00  ........ P.......
  [020] 51 00 00 00 00 00 00 00  48 00 00 00 00 00 00 00  Q....... H.......
  [030] 48 00 00 00 08 00 08 00  48 00 00 00 00 00 00 00  H....... H.......
  [040] 51 00 00 00 05 8A 88 A2  05 01 28 0A 00 00 00 0F  Q....... ..(.....
  [050] 42 00 2D 00 58 00 50 00  00 57 00 69 00 6E 00 64  B.-.X.P. .W.i.n.d
  [060] 00 6F 00 77 00 73 00 20  00 32 00 30 00 30 00 32  .o.w.s.  .2.0.0.2
  [070] 00 20 00 53 00 65 00 72  00 76 00 69 00 63 00 65  . .S.e.r .v.i.c.e
  [080] 00 20 00 50 00 61 00 63  00 6B 00 20 00 33 00 20  . .P.a.c .k. .3. 
  [090] 00 32 00 36 00 30 00 30  00 00 00 57 00 69 00 6E  .2.6.0.0 ...W.i.n
  [0A0] 00 64 00 6F 00 77 00 73  00 20 00 32 00 30 00 30  .d.o.w.s . .2.0.0
  [0B0] 00 32 00 20 00 35 00 2E  00 31 00 00 00 00 00     .2. .5.. .1.....
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:switch_message(914)
  switch message SMBsesssetupX (pid 7157) conn 0x0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X(849)
  wct=12 flg2=0xc807
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(660)
  Doing spnego session setup
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(691)
  NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] libsmb/ntlmssp.c:ntlmssp_server_auth(739)
  Got user=[] domain=[] workstation=[B-XP] len1=1 len2=0
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] param/loadparm.c:lp_file_list_changed(2998)
  lp_file_list_changed()
  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Wed Apr  7 16:45:32 2010
  
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info_map(161)
  make_user_info_map: Mapping user []\[] from workstation [B-XP]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:is_trusted_domain(2020)
  is_trusted_domain: Checking for domain trust with [MARCO]
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] passdb/secrets.c:secrets_fetch_trusted_domain_password(340)
  secrets_fetch failed!
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/gencache.c:gencache_get(329)
  Cache entry with key = TDOM/MARCO couldn't be found
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] libsmb/trustdom_cache.c:trustdom_cache_fetch(184)
  no entry for trusted domain MARCO found.
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info(75)
  attempting to make a user_info for  ()
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info(85)
  making strings for 's user_info struct
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info(117)
  making blobs for 's user_info struct
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:make_user_info(135)
  made an encrypted user_info for  ()
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(221)
  check_ntlm_password:  Checking password for unmapped user []\[]@[B-XP] with the new password interface
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(224)
  check_ntlm_password:  mapped user is: [MARCO]\[]@[B-XP]
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(233)
  check_ntlm_password: auth_context challenge created by random
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(235)
  challenge is: 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 25 5D D1 62 98 EA DB 65                           %].b...e 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 3: DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 1: DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 4: DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 2: DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 5 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 6 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 7 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 8 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 9 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 10 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 21 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_username(534)
  pdb_set_username: setting username nobody, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 12 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_domain(557)
  pdb_set_domain: setting domain MARCO, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 14 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_nt_username(580)
  pdb_set_nt_username: setting nt username , was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 15 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_fullname(603)
  pdb_set_full_name: setting full name nobody, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 13 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_homedir(696)
  pdb_set_homedir: setting home dir \\b-fs\nobody, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 1 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_dir_drive(672)
  pdb_set_dir_drive: setting dir drive H:, was NULL
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 3 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_logon_script(626)
  pdb_set_logon_script: setting logon script logon.bat, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 4 -> now DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_profile_path(649)
  pdb_set_profile_path: setting profile path \\b-fs\nobody\.ntprofile, was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 2 -> now DEFAULT
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 23 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_workstations(739)
  pdb_set_workstations: setting workstations , was 
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 24 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 26 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 34 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_user_sid(463)
  pdb_set_user_sid: setting user sid S-1-5-21-2611814498-2282654866-1273439328-501
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 18 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73)
  pdb_set_user_sid_from_rid:
  	setting user sid S-1-5-21-2611814498-2282654866-1273439328-501 from rid 501
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] passdb/lookup_sid.c:fetch_gid_from_cache(1027)
  fetch gid from cache 52 -> S-1-5-21-2611814498-2282654866-1273439328-513
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_group_sid(521)
  pdb_set_group_sid: setting group sid S-1-5-21-2611814498-2282654866-1273439328-513
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 19 -> now SET
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100)
  pdb_set_group_sid_from_rid:
  	setting group sid S-1-5-21-2611814498-2282654866-1273439328-513 from rid 513
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 16 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 29 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 30 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 31 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 20 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 17 -> now SET
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 27 -> now SET
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(270)
  check_ntlm_password: guest authentication for user [] succeeded
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth.c:check_ntlm_password(309)
  check_ntlm_password:  guest authentication for user [] -> [] -> [nobody] succeeded
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:free_user_info(1867)
  attempting to free (and zero) a user_info structure
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:free_user_info(1871)
  structure was created for 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-32-544))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-32-545))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(|(objectclass=sambaGroupMapping)(sambaGroupType=4))(|(sambaSIDList=S-1-5-21-2611814498-2282654866-1273439328-501)(sambaSIDList=S-1-1-0)(sambaSIDList=S-1-5-2)(sambaSIDList=S-1-5-32-546)))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(|(objectclass=sambaGroupMapping)(sambaGroupType=4))(|(sambaSIDList=S-1-5-21-2611814498-2282654866-1273439328-501)(sambaSIDList=S-1-1-0)(sambaSIDList=S-1-5-2)(sambaSIDList=S-1-5-32-546)))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/privileges.c:get_privileges(261)
  get_privileges: No privileges assigned to SID [S-1-5-21-2611814498-2282654866-1273439328-501]
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/privileges.c:get_privileges_for_sids(459)
  get_privileges_for_sids: sid = S-1-1-0
  Privilege set:
  SE_PRIV  0x0 0x0 0x0 0x0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/privileges.c:get_privileges(261)
  get_privileges: No privileges assigned to SID [S-1-5-2]
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/privileges.c:get_privileges(261)
  get_privileges: No privileges assigned to SID [S-1-5-32-546]
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-1-0))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:create_local_token(1023)
  Could not convert SID S-1-1-0 to gid, ignoring it
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-2))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:create_local_token(1023)
  Could not convert SID S-1-5-2 to gid, ignoring it
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-32-546))], scope => [2]
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getgroup(2217)
  ldapsam_getgroup: Did not find group
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:create_local_token(1023)
  Could not convert SID S-1-5-32-546 to gid, ignoring it
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(454)
  NT user token of user S-1-5-21-2611814498-2282654866-1273439328-501
  contains 4 SIDs
  SID[  0]: S-1-5-21-2611814498-2282654866-1273439328-501
  SID[  1]: S-1-1-0
  SID[  2]: S-1-5-2
  SID[  3]: S-1-5-32-546
  SE_PRIV  0x0 0x0 0x0 0x0
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(133)
  Got NT session key of length 16
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(140)
  Got LM session key of length 16
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] libsmb/ntlmssp.c:ntlmssp_server_auth(841)
  ntlmssp_server_auth: Using unmodified nt session key.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(338)
  NTLMSSP Sign/Seal - Initialising with flags:
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
  Got NTLMSSP neg_flags=0xa2088205
    NTLMSSP_NEGOTIATE_UNICODE
    NTLMSSP_REQUEST_TARGET
    NTLMSSP_NEGOTIATE_NTLM
    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
    NTLMSSP_NEGOTIATE_NTLM2
    NTLMSSP_NEGOTIATE_128
    NTLMSSP_NEGOTIATE_56
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(186)
  register_vuid: allocated vuid = 103
[2010/04/07 16:56:32, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 22: DEFAULT
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_pw.c:getpwnam_alloc(76)
  Got nobody from pwnam_cache
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(277)
  register_vuid: (65534,65534) nobody  MARCO guest=1
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(280)
  User name: nobody	Real name: nobody
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/password.c:register_vuid(301)
  UNIX uid 65534 is UNIX user nobody, and will be vuid 103
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] param/loadparm.c:lp_file_list_changed(2998)
  lp_file_list_changed()
  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Wed Apr  7 16:45:32 2010
  
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=140
  smb_com=0x73
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=0
  smb_pid=65279
  smb_uid=103
  smb_mid=896
  smt_wct=4
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    9 (0x9)
  smb_bcc=97
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] A1 07 30 05 A0 03 0A 01  00 55 00 6E 00 69 00 78  ..0..... .U.n.i.x
  [010] 00 00 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  ...S.a.m .b.a. .3
  [020] 00 2E 00 30 00 2E 00 32  00 33 00 64 00 2D 00 36  ...0...2 .3.d.-.6
  [030] 00 2D 00 31 00 30 00 38  00 33 00 2D 00 53 00 55  .-.1.0.8 .3.-.S.U
  [040] 00 53 00 45 00 2D 00 53  00 4C 00 31 00 30 00 2E  .S.E.-.S .L.1.0..
  [050] 00 32 00 00 00 4D 00 41  00 52 00 43 00 4F 00 00  .2...M.A .R.C.O..
  [060] 00                                                . 
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 74
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x4a
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1110)
  Transaction 16 of length 78
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=74
  smb_com=0x75
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=0
  smb_pid=65279
  smb_uid=103
  smb_mid=960
  smt_wct=4
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=   74 (0x4A)
  smb_vwv[ 2]=    8 (0x8)
  smb_vwv[ 3]=    1 (0x1)
  smb_bcc=31
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 00 5C 00 5C 00 42 00 2D  00 46 00 53 00 5C 00 49  .\.\.B.- .F.S.\.I
  [010] 00 50 00 43 00 24 00 00  00 3F 3F 3F 3F 3F 00     .P.C.$.. .?????.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:switch_message(914)
  switch message SMBtconX (pid 7157) conn 0x0
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] smbd/reply.c:reply_tcon_and_X(668)
  Client requested device type [?????] for share [IPC$]
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/service.c:make_connection(1125)
  making a connection to 'normal' service ipc$
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_alloc(131)
  Finding user nobody
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_internals(75)
  Trying _Get_Pwnam(), username as lowercase is nobody
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_pw.c:getpwnam_alloc(76)
  Got nobody from pwnam_cache
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_internals(108)
  Get_Pwnam_internals did find user [nobody]!
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/service.c:set_conn_connectpath(122)
  set_conn_connectpath: service IPC$, connectpath = /var/tmp
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/service.c:make_connection_snum(761)
  Connect path is '/var/tmp' for service [IPC$]
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] lib/sharesec.c:get_share_security(130)
  get_share_security: using default secdesc for IPC$
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_map_generic(176)
  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(233)
  se_access_check: requested access 0x00000002, for NT token with 4 entries and first sid S-1-5-21-2611814498-2282654866-1273439328-501.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(250)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(251)
  se_access_check: user sid is S-1-5-21-2611814498-2282654866-1273439328-501
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(308)
  se_access_check: access (2) granted.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/vfs.c:vfs_init_default(219)
  Initialising default vfs hooks
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/connection.c:claim_connection(170)
  claiming IPC$ 0
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/share_access.c:user_ok_token(229)
  user_ok_token: share IPC$ is ok for unix user nobody
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/share_access.c:is_share_read_only_for_token(271)
  is_share_read_only_for_user: share IPC$ is read-only for unix user nobody
[2010/04/07 16:56:32, 4, effective(0, 0), real(0, 0)] lib/sharesec.c:get_share_security(130)
  get_share_security: using default secdesc for IPC$
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_map_generic(176)
  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(233)
  se_access_check: requested access 0x00000001, for NT token with 4 entries and first sid S-1-5-21-2611814498-2282654866-1273439328-501.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(250)
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(251)
  se_access_check: user sid is S-1-5-21-2611814498-2282654866-1273439328-501
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util_seaccess.c:se_access_check(308)
  se_access_check: access (1) granted.
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(454)
  NT user token of user S-1-5-21-2611814498-2282654866-1273439328-501
  contains 4 SIDs
  SID[  0]: S-1-5-21-2611814498-2282654866-1273439328-501
  SID[  1]: S-1-1-0
  SID[  2]: S-1-5-2
  SID[  3]: S-1-5-32-546
  SE_PRIV  0x0 0x0 0x0 0x0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 65534
  Primary group is 65534 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(260)
  change_to_user uid=(65534,65534) gid=(0,65534)
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/service.c:make_connection_snum(950)
  b-xp (10.3.1.6) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 7157)
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] smbd/uid.c:change_to_root_user(275)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2010/04/07 16:56:32, 2, effective(0, 0), real(0, 0)] smbd/reply.c:reply_tcon_and_X(711)
  Serving IPC$ as a Dfs root
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/reply.c:reply_tcon_and_X(716)
  tconX service=IPC$ 
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=48
  smb_com=0x75
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=960
  smt_wct=3
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    3 (0x3)
  smb_bcc=7
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 49 50 43 00 00 00 00                              IPC.... 
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 100
[2010/04/07 16:56:32, 6, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x64
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:process_smb(1110)
  Transaction 17 of length 104
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] lib/util.c:show_msg(495)
  size=100
  smb_com=0xa2
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=944
  smb_uid=103
  smb_mid=1024
  smt_wct=24
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]= 3584 (0xE00)
  smb_vwv[ 3]= 5632 (0x1600)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=40704 (0x9F00)
  smb_vwv[ 8]=  513 (0x201)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_vwv[14]=    0 (0x0)
  smb_vwv[15]=  768 (0x300)
  smb_vwv[16]=    0 (0x0)
  smb_vwv[17]=  256 (0x100)
  smb_vwv[18]=    0 (0x0)
  smb_vwv[19]=16384 (0x4000)
  smb_vwv[20]=    0 (0x0)
  smb_vwv[21]=  512 (0x200)
  smb_vwv[22]=    0 (0x0)
  smb_vwv[23]=  768 (0x300)
  smb_bcc=17
[2010/04/07 16:56:32, 10, effective(0, 0), real(0, 0)] lib/util.c:dump_data(2222)
  [000] 00 5C 00 6C 00 73 00 61  00 72 00 70 00 63 00 00  .\.l.s.a .r.p.c..
  [010] 00                                                . 
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/process.c:switch_message(914)
  switch message SMBntcreateX (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(454)
  NT user token of user S-1-5-21-2611814498-2282654866-1273439328-501
  contains 4 SIDs
  SID[  0]: S-1-5-21-2611814498-2282654866-1273439328-501
  SID[  1]: S-1-1-0
  SID[  2]: S-1-5-2
  SID[  3]: S-1-5-32-546
  SE_PRIV  0x0 0x0 0x0 0x0
[2010/04/07 16:56:32, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 65534
  Primary group is 65534 and contains 0 supplementary groups
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(260)
  change_to_user uid=(65534,65534) gid=(0,65534)
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:reply_ntcreate_and_X(501)
  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:nt_open_pipe(325)
  nt_open_pipe: Opening pipe \lsarpc.
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:nt_open_pipe(346)
  nt_open_pipe: Known pipe lsarpc opening.
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180)
  Open pipe requested lsarpc (pipes_open=1)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(210)
  open_rpc_pipe_p: name NETLOGON pnum=76d5
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285)
  Create pipe requested lsarpc
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
  init_pipe_handles: created handle list for pipe lsarpc
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
  init_pipe_handles: pipe_handles ref count = 1 for pipe lsarpc
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366)
  Created internal pipe lsarpc (pipes_open=1)
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
  Opened pipe lsarpc with handle 76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269)
  open pipes: name lsarpc pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269)
  open pipes: name NETLOGON pnum=76d5
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:do_ntcreate_pipe_open(395)
  do_ntcreate_pipe_open: open pipe = \lsarpc
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=103
  smb_com=0xa2
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=944
  smb_uid=103
  smb_mid=1024
  smt_wct=34
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=54784 (0xD600)
  smb_vwv[ 3]=  374 (0x176)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_vwv[14]=    0 (0x0)
  smb_vwv[15]=    0 (0x0)
  smb_vwv[16]=    0 (0x0)
  smb_vwv[17]=    0 (0x0)
  smb_vwv[18]=    0 (0x0)
  smb_vwv[19]=    0 (0x0)
  smb_vwv[20]=    0 (0x0)
  smb_vwv[21]=32768 (0x8000)
  smb_vwv[22]=    0 (0x0)
  smb_vwv[23]=    0 (0x0)
  smb_vwv[24]=    0 (0x0)
  smb_vwv[25]=    0 (0x0)
  smb_vwv[26]=    0 (0x0)
  smb_vwv[27]=    0 (0x0)
  smb_vwv[28]=    0 (0x0)
  smb_vwv[29]=    0 (0x0)
  smb_vwv[30]=    0 (0x0)
  smb_vwv[31]=  512 (0x200)
  smb_vwv[32]=65280 (0xFF00)
  smb_vwv[33]=    5 (0x5)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 136
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x88
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 18 of length 140
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=136
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1088
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30422 (0x76D6)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=   72 (0x48)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=   72 (0x48)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=73
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
  [010] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
  [020] 00 78 57 34 12 34 12 CD  AB EF 00 01 23 45 67 89  .xW4.4.. ....#Eg.
  [030] AB 00 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
  [040] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name lsarpc pnum=76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d6 name: lsarpc open: Yes len: 72
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 72
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 56
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 0b
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0048
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000001
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 11, flags = 3
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 56
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 11
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_bind_req(1523)
  api_pipe_bind_req: decode request. 1523
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_bind_req(1534)
  api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_rb 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_rpc_hdr_bba 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0000 max_tsize: 10b8
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0002 max_rsize: 10b8
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 assoc_gid: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0008 num_contexts: 01
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000c context_id  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      000e num_transfer_syntaxes: 01
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      00000f smb_io_rpc_iface 
[2010/04/07 16:56:32, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000010 smb_io_uuid uuid
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0010 data   : 12345778
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0014 data   : 1234
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0016 data   : abcd
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              0018 data   : ef 00 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              001a data   : 01 23 45 67 89 ab 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0020 version: 00000000
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000024 smb_io_rpc_iface 
[2010/04/07 16:56:32, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000024 smb_io_uuid uuid
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0024 data   : 8a885d04
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0028 data   : 1ceb
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              002a data   : 11c9
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              002c data   : 9f e8 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              002e data   : 08 00 2b 10 48 60 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0034 version: 00000002
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_bind_req(1576)
  api_pipe_bind_req: make response. 1576
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(985)
  check_bind_req for \PIPE\lsarpc
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(990)
  checking \PIPE\lsarpc
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_ba 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_rpc_hdr_bba 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0000 max_tsize: 10b8
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0002 max_rsize: 10b8
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 assoc_gid: 000053f0
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000008 smb_io_rpc_addr_str 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0008 len: 000c
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          000a str: \PIPE\lsass.
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000016 smb_io_rpc_results 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
          0018 num_results: 01
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          001c result     : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          001e reason     : 0000
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000020 smb_io_rpc_iface 
[2010/04/07 16:56:32, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000020 smb_io_uuid uuid
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0020 data   : 8a885d04
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0024 data   : 1ceb
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0026 data   : 11c9
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              0028 data   : 9f e8 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              002a data   : 08 00 2b 10 48 60 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0030 version: 00000002
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 0c
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0044
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000001
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 56
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d6 nwritten=72
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1088
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=   72 (0x48)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 19 of length 63
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1152
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30422 (0x76D6)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name lsarpc pnum=76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d6 name: lsarpc len: 1024
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054)
  read_from_pipe: lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d6 min=1024 max=1024 nread=68
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=127
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1152
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   68 (0x44)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=68
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 0C 03 10 00 00 00  44 00 00 00 01 00 00 00  ........ D.......
  [010] B8 10 B8 10 F0 53 00 00  0C 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
  [020] 6C 73 61 73 73 00 00 00  01 00 00 00 00 00 00 00  lsass... ........
  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
  [040] 02 00 00 00                                       .... 
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 148
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x94
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 20 of length 152
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=148
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1217
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30422 (0x76D6)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=   84 (0x54)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=   84 (0x54)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=85
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 00 03 10 00 00  00 54 00 00 00 01 00 00  ........ .T......
  [010] 00 3C 00 00 00 00 00 2C  00 00 00 02 00 07 00 00  .<....., ........
  [020] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 42 00 2D  ........ .\.\.B.-
  [030] 00 46 00 53 00 00 00 88  8A 18 00 00 00 00 00 00  .F.S.... ........
  [040] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
  [050] 00 01 00 00 00                                    ..... 
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name lsarpc pnum=76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d6 name: lsarpc open: Yes len: 84
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 84
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 84
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 84, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 68
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 68
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0054
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000001
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 0, flags = 3
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 68
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 68, incoming data = 68
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_req req
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 alloc_hint: 0000003c
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0004 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0006 opnum     : 002c
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 71
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_request(2223)
  Requested \PIPE\lsarpc
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2258)
  api_rpcTNP: lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2284)
  api_rpc_cmds[0].fn == 0x800ffdc0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 lsa_io_q_open_pol2 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 ptr       : 00020000
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000004 smb_io_unistr2 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 uni_max_len: 00000007
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0008 offset     : 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          000c uni_str_len: 00000007
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
          0010 buffer     : \.\.B.-.F.S...
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      00001e lsa_io_obj_attr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0020 len         : 00000018
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0024 ptr_root_dir: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0028 ptr_obj_name: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          002c attributes  : 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0030 ptr_sec_desc: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0034 ptr_sec_qos : 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0038 des_access: 00000001
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_seaccess.c:se_access_check(233)
  se_access_check: requested access 0x00000001, for NT token with 4 entries and first sid S-1-5-21-2611814498-2282654866-1273439328-501.
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] lib/util_seaccess.c:se_access_check(250)
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] lib/util_seaccess.c:se_access_check(251)
  se_access_check: user sid is S-1-5-21-2611814498-2282654866-1273439328-501
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 20801, current desired = 1
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util_seaccess.c:se_access_check(308)
  se_access_check: access (1) granted.
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
  Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00  00 00 00 00 20 9D BC 4B  ........ .... ..K
  [010] F5 1B 00 00                                       .... 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 lsa_io_r_open_pol2 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_pol_hnd 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0000 data1: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 data2: 00000001
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0008 data3: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          000a data4: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          000c data5: 20 9d bc 4b f5 1b 00 00 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_ntstatus(763)
      0014 status: NT_STATUS_OK
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2305)
  api_rpcTNP: called lsarpc successfully
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 814
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 68
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d6 nwritten=84
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1217
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=   84 (0x54)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 21 of length 63
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1281
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30422 (0x76D6)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name lsarpc pnum=76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d6 name: lsarpc len: 1024
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068)
  read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr hdr
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 02
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0030
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000001
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000010 smb_io_rpc_hdr_resp resp
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0010 alloc_hint: 00000018
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0014 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0016 cancel_ct : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0017 reserved  : 00
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d6 min=1024 max=1024 nread=48
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=107
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1281
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   48 (0x30)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=48
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 02 03 10 00 00 00  30 00 00 00 01 00 00 00  ........ 0.......
  [010] 18 00 00 00 00 00 00 00  00 00 00 00 01 00 00 00  ........ ........
  [020] 00 00 00 00 20 9D BC 4B  F5 1B 00 00 00 00 00 00  .... ..K ........
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 116
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x74
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 22 of length 120
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=116
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1345
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30422 (0x76D6)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=   52 (0x34)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=   52 (0x34)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=53
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 00 03 10 00 00  00 34 00 00 00 02 00 00  ........ .4......
  [010] 00 1C 00 00 00 00 00 0D  00 00 00 00 00 01 00 00  ........ ........
  [020] 00 00 00 00 00 20 9D BC  4B F5 1B 00 00 00 00 00  ..... .. K.......
  [030] 00 FF FF FF FF                                    ..... 
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name lsarpc pnum=76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d6 name: lsarpc open: Yes len: 52
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 52
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 52
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 52, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 36
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 36
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0034
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000002
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 0, flags = 3
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 36
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 36, incoming data = 36
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_req req
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 alloc_hint: 0000001c
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0004 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0006 opnum     : 000d
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_request(2223)
  Requested \PIPE\lsarpc
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2258)
  api_rpcTNP: lsarpc op 0xd - api_rpcTNP: rpc command: LSA_ENUMTRUSTDOM
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2284)
  api_rpc_cmds[3].fn == 0x80100140
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 lsa_io_q_enum_trust_dom 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_pol_hnd 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0000 data1: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 data2: 00000001
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0008 data3: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          000a data4: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          000c data5: 20 9d bc 4b f5 1b 00 00 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0014 enum_context : 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0018 preferred_len: ffffffff
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 20 9D BC 4B  ........ .... ..K
  [010] F5 1B 00 00                                       .... 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] passdb/secrets.c:secrets_trusted_domains(757)
  secrets_get_trusted_domains: got 0 domains
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_lsa.c:init_r_enum_trust_dom(560)
  init_r_enum_trust_dom
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 lsa_io_r_enum_trust_dom 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 enum_context: ffffffff
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0004 count: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0008 ptr: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_ntstatus(763)
      000c status: NT_STATUS_NO_MORE_ENTRIES
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2305)
  api_rpcTNP: called lsarpc successfully
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 24
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 36
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d6 nwritten=52
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1345
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=   52 (0x34)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 23 of length 63
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1409
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30422 (0x76D6)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name lsarpc pnum=76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d6 name: lsarpc len: 1024
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068)
  read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 16.
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr hdr
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 02
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0028
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000002
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000010 smb_io_rpc_hdr_resp resp
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0010 alloc_hint: 00000010
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0014 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0016 cancel_ct : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0017 reserved  : 00
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d6 min=1024 max=1024 nread=40
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=99
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1409
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   40 (0x28)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=40
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 02 03 10 00 00 00  28 00 00 00 02 00 00 00  ........ (.......
  [010] 10 00 00 00 00 00 00 00  FF FF FF FF 00 00 00 00  ........ ........
  [020] 00 00 00 00 1A 00 00 80                           ........ 
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 108
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x6c
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 24 of length 112
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=108
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1473
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30422 (0x76D6)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=   44 (0x2C)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=   44 (0x2C)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=45
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 00 03 10 00 00  00 2C 00 00 00 03 00 00  ........ .,......
  [010] 00 14 00 00 00 00 00 00  00 00 00 00 00 01 00 00  ........ ........
  [020] 00 00 00 00 00 20 9D BC  4B F5 1B 00 00           ..... .. K....
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name lsarpc pnum=76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d6 name: lsarpc open: Yes len: 44
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 44
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 28
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 002c
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000003
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 0, flags = 3
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 28
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_req req
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 alloc_hint: 00000014
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0004 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0006 opnum     : 0000
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_request(2223)
  Requested \PIPE\lsarpc
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2258)
  api_rpcTNP: lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2284)
  api_rpc_cmds[4].fn == 0x801007a0
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 lsa_io_q_close 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_pol_hnd 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0000 data1: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 data2: 00000001
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0008 data3: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          000a data4: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          000c data5: 20 9d bc 4b f5 1b 00 00 
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 20 9D BC 4B  ........ .... ..K
  [010] F5 1B 00 00                                       .... 
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 20 9D BC 4B  ........ .... ..K
  [010] F5 1B 00 00                                       .... 
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
  Closed policy
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 lsa_io_r_close 
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_pol_hnd 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0000 data1: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 data2: 00000000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0008 data3: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          000a data4: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          000c data5: 00 00 00 00 00 00 00 00 
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_ntstatus(763)
      0014 status: NT_STATUS_OK
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2305)
  api_rpcTNP: called lsarpc successfully
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 28
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d6 nwritten=44
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1473
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=   44 (0x2C)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 25 of length 63
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1537
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30422 (0x76D6)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name lsarpc pnum=76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d6 name: lsarpc len: 1024
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068)
  read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr hdr
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 02
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0030
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000003
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000010 smb_io_rpc_hdr_resp resp
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0010 alloc_hint: 00000018
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0014 context_id: 0000
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0016 cancel_ct : 00
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0017 reserved  : 00
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d6 min=1024 max=1024 nread=48
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=107
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1537
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   48 (0x30)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=48
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 02 03 10 00 00 00  30 00 00 00 03 00 00 00  ........ 0.......
  [010] 18 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
  [020] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 41
[2010/04/07 16:56:32, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x29
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 26 of length 45
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=41
  smb_com=0x4
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1601
  smt_wct=3
  smb_vwv[ 0]=30422 (0x76D6)
  smb_vwv[ 1]=65535 (0xFFFF)
  smb_vwv[ 2]=65535 (0xFFFF)
  smb_bcc=0
[2010/04/07 16:56:32, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBclose (pid 7157) conn 0x804352e8
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d6
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name lsarpc pnum=76d6 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_close(282)
  reply_pipe_close: pnum:76d6
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
  close_policy_by_pipe: deleted handle list for pipe lsarpc
[2010/04/07 16:56:32, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1169)
  closed pipe name lsarpc pnum=76d6 (pipes_open=1)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:32, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=35
  smb_com=0x4
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=2
  smb_pid=65279
  smb_uid=103
  smb_mid=1601
  smt_wct=0
  smb_bcc=0
[2010/04/07 16:56:32, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 104
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x68
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 27 of length 108
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=104
  smb_com=0xa2
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=944
  smb_uid=101
  smb_mid=1665
  smt_wct=24
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]= 4608 (0x1200)
  smb_vwv[ 3]= 5632 (0x1600)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=40704 (0x9F00)
  smb_vwv[ 8]=  513 (0x201)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_vwv[14]=    0 (0x0)
  smb_vwv[15]=  768 (0x300)
  smb_vwv[16]=    0 (0x0)
  smb_vwv[17]=  256 (0x100)
  smb_vwv[18]=    0 (0x0)
  smb_vwv[19]=16384 (0x4000)
  smb_vwv[20]=16384 (0x4000)
  smb_vwv[21]=  512 (0x200)
  smb_vwv[22]=    0 (0x0)
  smb_vwv[23]=  256 (0x100)
  smb_bcc=21
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 00 5C 00 4E 00 45 00 54  00 4C 00 4F 00 47 00 4F  .\.N.E.T .L.O.G.O
  [010] 00 4E 00 00 00                                    .N... 
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBntcreateX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(454)
  NT user token of user S-1-5-21-2611814498-2282654866-1273439328-501
  contains 4 SIDs
  SID[  0]: S-1-5-21-2611814498-2282654866-1273439328-501
  SID[  1]: S-1-1-0
  SID[  2]: S-1-5-2
  SID[  3]: S-1-5-32-546
  SE_PRIV  0x0 0x0 0x0 0x0
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 65534
  Primary group is 65534 and contains 0 supplementary groups
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(260)
  change_to_user uid=(65534,65534) gid=(0,65534)
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:reply_ntcreate_and_X(501)
  reply_ntcreateX: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:nt_open_pipe(325)
  nt_open_pipe: Opening pipe \NETLOGON.
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:nt_open_pipe(346)
  nt_open_pipe: Known pipe NETLOGON opening.
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180)
  Open pipe requested NETLOGON (pipes_open=1)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(210)
  open_rpc_pipe_p: name NETLOGON pnum=76d5
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285)
  Create pipe requested NETLOGON
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
  init_pipe_handles: pipe_handles ref count = 2 for pipe NETLOGON
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366)
  Created internal pipe NETLOGON (pipes_open=1)
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
  Opened pipe NETLOGON with handle 76d7 (pipes_open=2)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269)
  open pipes: name NETLOGON pnum=76d7
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269)
  open pipes: name NETLOGON pnum=76d5
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] smbd/nttrans.c:do_ntcreate_pipe_open(395)
  do_ntcreate_pipe_open: open pipe = \NETLOGON
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=103
  smb_com=0xa2
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=944
  smb_uid=101
  smb_mid=1665
  smt_wct=34
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=55040 (0xD700)
  smb_vwv[ 3]=  374 (0x176)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_vwv[ 6]=    0 (0x0)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_vwv[14]=    0 (0x0)
  smb_vwv[15]=    0 (0x0)
  smb_vwv[16]=    0 (0x0)
  smb_vwv[17]=    0 (0x0)
  smb_vwv[18]=    0 (0x0)
  smb_vwv[19]=    0 (0x0)
  smb_vwv[20]=    0 (0x0)
  smb_vwv[21]=32768 (0x8000)
  smb_vwv[22]=    0 (0x0)
  smb_vwv[23]=    0 (0x0)
  smb_vwv[24]=    0 (0x0)
  smb_vwv[25]=    0 (0x0)
  smb_vwv[26]=    0 (0x0)
  smb_vwv[27]=    0 (0x0)
  smb_vwv[28]=    0 (0x0)
  smb_vwv[29]=    0 (0x0)
  smb_vwv[30]=    0 (0x0)
  smb_vwv[31]=  512 (0x200)
  smb_vwv[32]=65280 (0xFF00)
  smb_vwv[33]=    5 (0x5)
  smb_bcc=0
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 169
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0xa9
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 28 of length 173
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=169
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=1729
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30423 (0x76D7)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=  105 (0x69)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=  105 (0x69)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=106
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 0B 07 10 00 00  00 69 00 19 00 04 00 00  ........ .i......
  [010] 00 B8 10 B8 10 F0 53 00  00 01 00 00 00 00 00 01  ......S. ........
  [020] 00 78 56 34 12 34 12 CD  AB EF 00 01 23 45 67 CF  .xV4.4.. ....#Eg.
  [030] FB 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
  [040] 00 2B 10 48 60 02 00 00  00 44 06 00 00 B0 90 0C  .+.H`... .D......
  [050] 00 00 00 00 00 13 00 00  00 4D 41 52 43 4F 00 42  ........ .MARCO.B
  [060] 2D 58 50 00 04 42 2D 58  50 00                    -XP..B-X P.
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d7
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d7 (pipes_open=2)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d7 name: NETLOGON open: Yes len: 105
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 105
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 105
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 105, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 89
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 89
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 0b
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 07
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0069
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0019
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000004
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 11, flags = 7
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 89
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 89, incoming data = 89
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 11
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_bind_req(1523)
  api_pipe_bind_req: decode request. 1523
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_bind_req(1534)
  api_pipe_bind_req: \PIPE\NETLOGON -> \PIPE\lsass
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_rb 
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_rpc_hdr_bba 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0000 max_tsize: 10b8
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0002 max_rsize: 10b8
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 assoc_gid: 000053f0
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0008 num_contexts: 01
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000c context_id  : 0000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      000e num_transfer_syntaxes: 01
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      00000f smb_io_rpc_iface 
[2010/04/07 16:56:33, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000010 smb_io_uuid uuid
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0010 data   : 12345678
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0014 data   : 1234
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0016 data   : abcd
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              0018 data   : ef 00 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              001a data   : 01 23 45 67 cf fb 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0020 version: 00000001
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000024 smb_io_rpc_iface 
[2010/04/07 16:56:33, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000024 smb_io_uuid uuid
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0024 data   : 8a885d04
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0028 data   : 1ceb
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              002a data   : 11c9
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              002c data   : 9f e8 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              002e data   : 08 00 2b 10 48 60 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0034 version: 00000002
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_bind_req(1576)
  api_pipe_bind_req: make response. 1576
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000038 smb_io_rpc_hdr_auth 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0038 auth_type    : 44
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0039 auth_level   : 06
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      003a auth_pad_len : 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      003b auth_reserved: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      003c auth_context_id: 000c90b0
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000040 smb_io_rpc_auth_schannel_neg 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0040 type1: 00000000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0044 type2: 00000013
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 4D 41 52 43 4F                                    MARCO 
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 42 2D 58 50                                       B-XP 
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:33, 3, effective(0, 0), real(0, 0)] passdb/secrets.c:secrets_restore_schannel_session_info(1089)
  secrets_restore_schannel_session_info: restored schannel info key SECRETS/SCHANNEL/B-XP
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_auth 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 auth_type    : 44
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 auth_level   : 06
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 auth_pad_len : 08
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 auth_reserved: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0004 auth_context_id: 00000001
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000008 smb_io_rpc_schannel_verifier 
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 01                                                . 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000a msg_type : 00000000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
  0010 flags : 00000005
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:pipe_schannel_auth_bind(1379)
  pipe_schannel_auth_bind: schannel auth: domain [MARCO] myname [B-XP]
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(985)
  check_bind_req for \PIPE\NETLOGON
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(990)
  checking \PIPE\lsarpc
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(990)
  checking \PIPE\lsarpc
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(990)
  checking \PIPE\samr
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:check_bind_req(990)
  checking \PIPE\NETLOGON
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_ba 
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_rpc_hdr_bba 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0000 max_tsize: 10b8
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0002 max_rsize: 10b8
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0004 assoc_gid: 000053f0
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000008 smb_io_rpc_addr_str 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          0008 len: 000c
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
          000a str: \PIPE\lsass.
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000016 smb_io_rpc_results 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
          0018 num_results: 01
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          001c result     : 0000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          001e reason     : 0000
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000020 smb_io_rpc_iface 
[2010/04/07 16:56:33, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000020 smb_io_uuid uuid
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              0020 data   : 8a885d04
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0024 data   : 1ceb
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              0026 data   : 11c9
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              0028 data   : 9f e8 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              002a data   : 08 00 2b 10 48 60 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0030 version: 00000002
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 0c
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0058
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 000c
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000004
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 89
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d7 nwritten=105
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=1729
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=  105 (0x69)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 29 of length 63
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=1793
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30423 (0x76D7)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d7
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d7 (pipes_open=2)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d7 name: NETLOGON len: 1024
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1054)
  read_from_pipe: NETLOGON: current_pdu_len = 88, current_pdu_sent = 0 returning 88 bytes.
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d7 min=1024 max=1024 nread=88
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=147
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=1793
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   88 (0x58)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=88
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 0C 03 10 00 00 00  58 00 0C 00 04 00 00 00  ........ X.......
  [010] B8 10 B8 10 F0 53 00 00  0C 00 5C 50 49 50 45 5C  .....S.. ..\PIPE\
  [020] 6C 73 61 73 73 00 00 00  01 00 00 00 00 00 00 00  lsass... ........
  [030] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
  [040] 02 00 00 00 44 06 08 00  01 00 00 00 01 00 00 00  ....D... ........
  [050] 00 00 00 00 05 00 00 00                           ........ 
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 400
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x190
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 30 of length 404
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=400
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=1857
  smt_wct=14
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30423 (0x76D7)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=65535 (0xFFFF)
  smb_vwv[ 6]=65535 (0xFFFF)
  smb_vwv[ 7]=    8 (0x8)
  smb_vwv[ 8]=  336 (0x150)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=  336 (0x150)
  smb_vwv[11]=   64 (0x40)
  smb_vwv[12]=    0 (0x0)
  smb_vwv[13]=    0 (0x0)
  smb_bcc=337
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] EE 05 00 00 03 10 00 00  00 50 01 20 00 04 00 00  ........ .P. ....
  [010] 00 04 01 00 00 00 00 02  00 C3 2B 1F 1E CB 72 69  ........ ..+...ri
  [020] 4E C7 87 F2 EA 38 E4 74  A5 E9 95 BC 43 4E E8 B2  N....8.t ....CN..
  [030] 2B 7B 30 03 40 AA 74 B1  75 09 F0 A2 B6 45 66 86  +{0.@.t. u....Ef.
  [040] 4B AE DA E0 92 60 C6 D5  E4 9B 02 E5 8E 9F 96 E4  K....`.. ........
  [050] 39 58 41 E7 0E 48 51 AD  FE 31 99 BD 27 E4 E2 19  9XA..HQ. .1..'...
  [060] A0 4A A0 7B 57 12 97 9D  3C 45 AE D3 D5 18 DD 7D  .J.{W... <E.....}
  [070] 61 16 D7 D4 72 EA 9C 07  8E 31 DE 96 49 70 7C 12  a...r... .1..Ip|.
  [080] A5 99 76 97 CB AB 89 57  DC 71 A6 90 F9 12 73 B8  ..v....W .q....s.
  [090] DC 89 C1 84 75 75 AA B5  3C 67 78 1C 53 CE 0E AB  ....uu.. <gx.S...
  [0A0] 8C 5E B1 98 73 FC CF 8C  DC 57 CE BD 87 1B 40 1A  .^..s... .W....@.
  [0B0] 7E 7A 16 5E 60 11 03 98  C0 42 5F C2 E3 24 73 AF  ~z.^`... .B_..$s.
  [0C0] C1 CA D6 83 B9 29 40 22  AD 65 0B 7A 95 56 32 CB  .....)@" .e.z.V2.
  [0D0] 5F 98 F2 B2 C0 00 EF A0  56 8C F9 3B 3A 3D 75 5D  _....... V..;:=u]
  [0E0] 35 60 39 D6 69 29 E9 9F  D2 81 8A DE 7C 5A EF F1  5`9.i).. ....|Z..
  [0F0] 18 B6 67 44 C5 AD AF F3  40 28 AD D6 C9 63 89 A3  ..gD.... @(...c..
  [100] 9B 16 CE 97 30 46 99 20  34 B1 78 32 77 25 49 D1  ....0F.  4.x2w%I.
  [110] 54 0A B2 7E 46 67 CB 7A  FB DB 49 2B 17 A4 B6 F5  T..~Fg.z ..I+....
  [120] B8 6E FF 83 3A 26 88 9E  38 44 06 0C 00 B0 90 0C  .n..:&.. 8D......
  [130] 00 77 00 7A 00 FF FF 00  00 C5 DF 15 A2 E4 C3 13  .w.z.... ........
  [140] 6F BC CB 01 26 7F DB 29  EB C9 5D CA 36 B6 12 B9  o...&..) ..].6...
  [150] 90                                                . 
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBwriteX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d7
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d7 (pipes_open=2)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_pipe(937)
  write_to_pipe: 76d7 name: NETLOGON open: Yes len: 336
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 336
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 336
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395)
  fill_rpc_header: data_to_copy = 336, len_needed_to_complete_hdr = 16, receive_len = 0
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 16
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 320
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 320
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0150
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0020
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000004
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482)
  unmarshall_rpc_header: using little-endian RPC
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511)
  unmarshall_rpc_header: type = 0, flags = 3
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 0
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(959)
  write_to_pipe: data_left = 320
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_incoming_data(852)
  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 320, incoming data = 320
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719)
  process_complete_pdu: processing packet type 0
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr_req req
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 alloc_hint: 00000104
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0004 context_id: 0000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0006 opnum     : 0002
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_schannel_process(2086)
  data 272 auth 32
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000118 smb_io_rpc_hdr_auth hdr_auth
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0118 auth_type    : 44
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0119 auth_level   : 06
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      011a auth_pad_len : 0c
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      011b auth_reserved: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      011c auth_context_id: 000c90b0
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000120 smb_io_rpc_auth_schannel_chk 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
      0120 sig  : 77 00 7a 00 ff ff 00 00 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
      0128 seq_num: c5 df 15 a2 e4 c3 13 6f 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
      0130 packet_digest: bc cb 01 26 7f db 29 eb 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
      0138 confounder: c9 5d ca 36 b6 12 b9 90 
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:schannel_decode(1710)
  SCHANNEL: schannel_decode seq_num=0 data_len=272
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:schannel_decode(1730)
  SCHANNEL: schannel_decode seq_num=0 data_len=272
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 73
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_pipe_request(2223)
  Requested \PIPE\NETLOGON
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2258)
  api_rpcTNP: NETLOGON op 0x2 - api_rpcTNP: rpc command: NET_SAMLOGON
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2284)
  api_rpc_cmds[4].fn == 0x80116660
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 net_io_q_sam_logon 
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000000 smb_io_sam_info 
[2010/04/07 16:56:33, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000000 smb_io_clnt_info2 
[2010/04/07 16:56:33, 8, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
              000000 smb_io_clnt_srv 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                  0000 undoc_buffer : 00020000
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000004 smb_io_unistr2 unistr2
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      0004 uni_max_len: 00000007
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      0008 offset     : 00000000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      000c uni_str_len: 00000007
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
                      0010 buffer     : \.\.B.-.F.S...
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                  0020 undoc_buffer2: 00020004
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000024 smb_io_unistr2 unistr2
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      0024 uni_max_len: 00000005
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      0028 offset     : 00000000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      002c uni_str_len: 00000005
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
                      0030 buffer     : B.-.X.P...
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              003c ptr_cred: 00020008
[2010/04/07 16:56:33, 8, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
              000040 smb_io_cred 
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000040 smb_io_chal 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
                      0040 data: 3f ea 84 55 9b 84 1d ab 
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000048 smb_io_utime 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      0048 time: 4bbc9d21
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          004c ptr_rtn_cred : 0002000c
[2010/04/07 16:56:33, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000050 smb_io_cred 
[2010/04/07 16:56:33, 8, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
              000050 smb_io_chal 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
                  0050 data: ac 04 92 7c 00 00 09 00 
[2010/04/07 16:56:33, 8, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
              000058 smb_io_utime 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                  0058 time: 00000000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
          005c logon_level  : 0001
[2010/04/07 16:56:33, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          00005e smb_io_sam_info_ctr logon_info
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
              005e switch_value : 0001
[2010/04/07 16:56:33, 8, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
              000060 net_io_id_info1 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                  0060 ptr_id_info1: 00020010
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000064 smb_io_unihdr unihdr
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
                      0064 uni_str_len: 000a
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
                      0066 uni_max_len: 000a
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      0068 buffer     : 00020014
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                  006c param_ctrl: 00000000
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000070 smb_io_logon_id 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      0070 low : 000c37da
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      0074 high: 00000000
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000078 smb_io_unihdr unihdr
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
                      0078 uni_str_len: 000e
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
                      007a uni_max_len: 000e
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      007c buffer     : 00020018
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000080 smb_io_unihdr unihdr
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
                      0080 uni_str_len: 0008
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
                      0082 uni_max_len: 000a
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      0084 buffer     : 0002001c
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000088 smb_io_owf_info 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
                      0088 data: 21 bc 2f 11 c1 b2 ad 1b 89 ee 71 7d 93 b4 cb 0e 
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  000098 smb_io_owf_info 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
                      0098 data: fd 49 5e 03 8f 68 cb 42 38 83 ce 5b 96 e5 52 6d 
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  0000a8 smb_io_unistr2 unistr2
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      00a8 uni_max_len: 00000005
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      00ac offset     : 00000000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      00b0 uni_str_len: 00000005
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
                      00b4 buffer     : M.A.R.C.O.
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  0000be smb_io_unistr2 unistr2
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      00c0 uni_max_len: 00000007
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      00c4 offset     : 00000000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      00c8 uni_str_len: 00000007
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
                      00cc buffer     : h.j.a.n.z.e.r.
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
                  0000da smb_io_unistr2 unistr2
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      00dc uni_max_len: 00000005
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      00e0 offset     : 00000000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
                      00e4 uni_str_len: 00000004
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:dbg_rw_punival(936)
                      00e8 buffer     : B.-.X.P.
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      00f0 validation_level: 0003
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:33, 3, effective(0, 0), real(0, 0)] passdb/secrets.c:secrets_restore_schannel_session_info(1089)
  secrets_restore_schannel_session_info: restored schannel info key SECRETS/SCHANNEL/B-XP
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_step(148)
  	sequence = 0x4bbc9d21
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_step(150)
  	seed:        D7616BDD399D56CD
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_step(155)
  	seed+seq   F8FE2729399D56CD
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_step(159)
  	CLIENT      3FEA84559B841DAB
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_step(164)
  	seed+seq+1   F9FE2729399D56CD
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_step(168)
  	SERVER      90AE0C2B4DA17D67
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_reseed(238)
  cred_reseed: seed F9FE2729399D56CD
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] libsmb/credentials.c:creds_server_check(221)
  creds_server_check: credentials check OK.
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:33, 3, effective(0, 0), real(0, 0)] passdb/secrets.c:secrets_store_schannel_session_info(995)
  secrets_store_schannel_session_info: stored schannel info with key SECRETS/SCHANNEL/B-XP
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_netlog_nt.c:_net_sam_logon_internal(840)
  SAM Logon (Interactive). Domain:[MARCO].  User:[hjanzer@B-XP] Requested Domain:[MARCO]
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_netlog_nt.c:_net_sam_logon_internal(862)
  Attempting validation level 1 for unmapped username hjanzer.
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:make_auth_context_subsystem(484)
  Making default auth method list for DC, security=user, encrypt passwords = yes
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match guest
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method guest has a valid init
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match sam
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method sam has a valid init
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match winbind:trustdomain
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:load_auth_module(391)
  load_auth_module: Attempting to find an auth method to match trustdomain
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method trustdomain has a valid init
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:load_auth_module(416)
  load_auth_module: auth method winbind has a valid init
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:get_ntlm_challenge(97)
  auth_get_challenge: module guest did not want to specify a challenge
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:get_ntlm_challenge(97)
  auth_get_challenge: module sam did not want to specify a challenge
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:get_ntlm_challenge(97)
  auth_get_challenge: module winbind did not want to specify a challenge
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:get_ntlm_challenge(137)
  auth_context challenge created by random
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:get_ntlm_challenge(138)
  challenge is: 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 29 04 44 AC 7B 05 D6 79                           ).D.{..y 
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] smbd/map_username.c:map_username(111)
  Scanning username map /etc/samba/smb-user-map
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] smbd/password.c:user_in_list(464)
  user_in_list: checking user hjanzer in list
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] smbd/password.c:user_in_list(469)
  user_in_list: checking user |hjanzer| against |Administrator|
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:make_user_info_map(161)
  make_user_info_map: Mapping user [MARCO]\[hjanzer] from workstation [B-XP]
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:is_trusted_domain(2020)
  is_trusted_domain: Checking for domain trust with [MARCO]
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] passdb/secrets.c:secrets_fetch_trusted_domain_password(340)
  secrets_fetch failed!
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/gencache.c:gencache_get(329)
  Cache entry with key = TDOM/MARCO couldn't be found
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] libsmb/trustdom_cache.c:trustdom_cache_fetch(184)
  no entry for trusted domain MARCO found.
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:make_user_info(75)
  attempting to make a user_info for hjanzer (hjanzer)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:make_user_info(85)
  making strings for hjanzer's user_info struct
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:make_user_info(117)
  making blobs for hjanzer's user_info struct
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:make_user_info(135)
  made an encrypted user_info for hjanzer (hjanzer)
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] auth/auth.c:check_ntlm_password(221)
  check_ntlm_password:  Checking password for unmapped user [MARCO]\[hjanzer]@[B-XP] with the new password interface
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] auth/auth.c:check_ntlm_password(224)
  check_ntlm_password:  mapped user is: [MARCO]\[hjanzer]@[B-XP]
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] auth/auth.c:check_ntlm_password(233)
  check_ntlm_password: auth_context challenge created by random
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] auth/auth.c:check_ntlm_password(235)
  challenge is: 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 29 04 44 AC 7B 05 D6 79                           ).D.{..y 
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] auth/auth.c:check_ntlm_password(261)
  check_ntlm_password: guest had nothing to say
[2010/04/07 16:56:33, 8, effective(65534, 65534), real(65534, 0)] lib/util.c:is_myname(2043)
  is_myname("MARCO") returns 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [dc=marco,dc=de], filter => [(&(uid=hjanzer)(objectclass=sambaSamAccount))], scope => [2]
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:33, 2, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:init_sam_from_ldap(541)
  init_sam_from_ldap: Entry found for user: hjanzer
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_username(534)
  pdb_set_username: setting username hjanzer, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 12 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_domain(557)
  pdb_set_domain: setting domain MARCO, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 14 -> now DEFAULT
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_nt_username(580)
  pdb_set_nt_username: setting nt username hjanzer, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 15 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(476)
  pdb_set_user_sid_from_string: setting user sid S-1-5-21-2611814498-2282654866-1273439328-6020
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_user_sid(463)
  pdb_set_user_sid: setting user sid S-1-5-21-2611814498-2282654866-1273439328-6020
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 18 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 18: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 21 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 5 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 6 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 7 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 9 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 10 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [displayName] = [<does not exist>]
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_fullname(603)
  pdb_set_full_name: setting full name Holger Janzer, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 13 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_dir_drive(672)
  pdb_set_dir_drive: setting dir drive H:, was NULL
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 3 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_homedir(696)
  pdb_set_homedir: setting home dir \\homedirs\hjanzer, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 1 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaLogonScript] = [<does not exist>]
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_logon_script(626)
  pdb_set_logon_script: setting logon script logon.bat, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 4 -> now DEFAULT
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_profile_path(649)
  pdb_set_profile_path: setting profile path \\homedirs\hjanzer\.ntprofile, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 2 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [description] = [<does not exist>]
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaUserWorkstations] = [<does not exist>]
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaMungedDial] = [<does not exist>]
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaLMPassword] = [<does not exist>]
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaNTPassword] = [<does not exist>]
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 20 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 16 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 17 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaBadPasswordCount] = [<does not exist>]
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaBadPasswordTime] = [<does not exist>]
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_get_single_attribute(276)
  smbldap_get_single_attribute: [sambaLogonHours] = [<does not exist>]
[2010/04/07 16:56:33, 7, effective(0, 0), real(0, 0)] passdb/login_cache.c:login_cache_read(87)
  Looking up login cache for user hjanzer
[2010/04/07 16:56:33, 7, effective(0, 0), real(0, 0)] passdb/login_cache.c:login_cache_read(101)
  No cache entry found
[2010/04/07 16:56:33, 9, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:init_sam_from_ldap(898)
  No cache entry, bad count = 0, bad time = 0
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(425)
  element 35 -> now CHANGED
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 21: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 32: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 33: DEFAULT
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_alloc(131)
  Finding user hjanzer
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_internals(75)
  Trying _Get_Pwnam(), username as lowercase is hjanzer
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] lib/username.c:Get_Pwnam_internals(108)
  Get_Pwnam_internals did find user [hjanzer]!
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=52))], scope => [2]
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:33, 2, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:init_group_from_ldap(2140)
  init_group_from_ldap: Entry found for group: 52
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/lookup_sid.c:check_dom_sid_to_level(625)
  Accepting SID S-1-5-21-2611814498-2282654866-1273439328 in level 1
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] passdb/pdb_interface.c:lookup_global_sam_rid(1480)
  lookup_global_sam_rid: looking up RID 513.
[2010/04/07 16:56:33, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2010/04/07 16:56:33, 3, effective(0, 0), real(0, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [dc=marco,dc=de], filter => [(&(sambaSID=S-1-5-21-2611814498-2282654866-1273439328-513)(objectclass=sambaSamAccount))], scope => [2]
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:33, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_getsampwsid(1491)
  ldapsam_getsampwsid: Unable to locate SID [S-1-5-21-2611814498-2282654866-1273439328-513] count=0
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_search_ext(1179)
  smbldap_search_ext: base => [ou=group,dc=marco,dc=de], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-21-2611814498-2282654866-1273439328-513))], scope => [2]
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] lib/smbldap.c:smbldap_open(1043)
  smbldap_open: already connected to the LDAP server
[2010/04/07 16:56:33, 2, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:init_group_from_ldap(2140)
  init_group_from_ldap: Entry found for group: 52
[2010/04/07 16:56:33, 3, effective(0, 0), real(0, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 5, effective(0, 0), real(0, 0)] passdb/pdb_interface.c:pdb_default_lookup_rids(1601)
  lookup_rids: Domain Users:2
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/lookup_sid.c:lookup_sid(879)
  Sid S-1-5-21-2611814498-2282654866-1273439328-513 -> MARCO\Domain Users(2)
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 3: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 1: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 4: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 2: SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 5 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 6 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 7 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 8 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 9 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 10 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 21 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_username(534)
  pdb_set_username: setting username hjanzer, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 12 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_domain(557)
  pdb_set_domain: setting domain MARCO, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 14 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_nt_username(580)
  pdb_set_nt_username: setting nt username hjanzer, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 15 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_fullname(603)
  pdb_set_full_name: setting full name Holger Janzer, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 13 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_homedir(696)
  pdb_set_homedir: setting home dir \\homedirs\hjanzer, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 1 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_dir_drive(672)
  pdb_set_dir_drive: setting dir drive H:, was NULL
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 3 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_logon_script(626)
  pdb_set_logon_script: setting logon script logon.bat, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(448)
  element 4 -> now DEFAULT
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_profile_path(649)
  pdb_set_profile_path: setting profile path \\homedirs\hjanzer\.ntprofile, was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 2 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 23 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_workstations(739)
  pdb_set_workstations: setting workstations , was 
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 24 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 26 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: password history, val: 0
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 34 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_user_sid(463)
  pdb_set_user_sid: setting user sid S-1-5-21-2611814498-2282654866-1273439328-6020
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 18 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73)
  pdb_set_user_sid_from_rid:
  	setting user sid S-1-5-21-2611814498-2282654866-1273439328-6020 from rid 6020
[2010/04/07 16:56:33, 3, effective(0, 0), real(0, 0)] passdb/lookup_sid.c:fetch_gid_from_cache(1027)
  fetch gid from cache 52 -> S-1-5-21-2611814498-2282654866-1273439328-513
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_group_sid(521)
  pdb_set_group_sid: setting group sid S-1-5-21-2611814498-2282654866-1273439328-513
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 19 -> now SET
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100)
  pdb_set_group_sid_from_rid:
  	setting group sid S-1-5-21-2611814498-2282654866-1273439328-513 from rid 513
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 16 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 29 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 30 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 31 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 20 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 17 -> now SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_set_init_flags(436)
  element 27 -> now SET
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] passdb/passdb.c:pdb_update_autolock_flag(1413)
  pdb_update_autolock_flag: Account hjanzer not autolocked, no check needed
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] libsmb/ntlm_check.c:ntlm_password_check(189)
  ntlm_password_check: NO NT password stored for user hjanzer.
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] libsmb/ntlm_check.c:ntlm_password_check(371)
  ntlm_password_check: NO LanMan password set for user hjanzer (and no NT password supplied)
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] libsmb/ntlm_check.c:ntlm_password_check(392)
  ntlm_password_check: LM password check failed for user, no NT password hjanzer
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:33, 10, effective(0, 0), real(0, 0)] lib/account_pol.c:account_policy_get(340)
  account_policy_get: name: bad lockout attempt, val: 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 9, effective(65534, 65534), real(65534, 0)] passdb/passdb.c:pdb_increment_bad_password_count(1474)
  No lockout policy, don't track bad passwords
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:push_sec_ctx(208)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/uid.c:push_conn_ctx(345)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:set_sec_ctx(241)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_nt_user_token(448)
  NT user token: (NULL)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:debug_unix_user_token(474)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2010/04/07 16:56:33, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_update_sam_account(1777)
  ldapsam_update_sam_account: user hjanzer to be modified has dn: uid=hjanzer,ou=People,dc=marco,dc=de
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 12: SET
[2010/04/07 16:56:33, 2, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:init_ldap_from_sam(965)
  init_ldap_from_sam: Setting entry for user: hjanzer
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 18: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 19: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 13: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 23: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 24: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 26: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 1: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 3: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 4: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 2: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 5: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 6: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 7: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 9: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 10: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 32: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 33: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 34: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 21: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 27: DEFAULT
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(217)
  element 20: SET
[2010/04/07 16:56:33, 11, effective(0, 0), real(0, 0)] passdb/pdb_get_set.c:pdb_get_init_flags(227)
  element 29: DEFAULT
[2010/04/07 16:56:33, 4, effective(0, 0), real(0, 0)] passdb/pdb_ldap.c:ldapsam_update_sam_account(1790)
  ldapsam_update_sam_account: mods is empty: nothing to update for user: hjanzer
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/sec_ctx.c:pop_sec_ctx(339)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth.c:check_ntlm_password(273)
  check_ntlm_password: sam authentication for user [hjanzer] FAILED with error NT_STATUS_WRONG_PASSWORD
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] auth/auth_winbind.c:check_winbind_security(80)
  check_winbind_security: Not using winbind, requested domain [MARCO] was for this SAM.
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] auth/auth.c:check_ntlm_password(261)
  check_ntlm_password: winbind had nothing to say
[2010/04/07 16:56:33, 2, effective(65534, 65534), real(65534, 0)] auth/auth.c:check_ntlm_password(319)
  check_ntlm_password:  Authentication for user [hjanzer] -> [hjanzer] FAILED with error NT_STATUS_WRONG_PASSWORD
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:free_user_info(1867)
  attempting to free (and zero) a user_info structure
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] auth/auth_util.c:free_user_info(1871)
  structure was created for hjanzer
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_netlog_nt.c:_net_sam_logon_internal(934)
  _net_sam_logon: check_password returned status NT_STATUS_WRONG_PASSWORD
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 net_io_r_sam_logon 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0000 buffer_creds: 00000001
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000004 smb_io_cred 
[2010/04/07 16:56:33, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          000004 smb_io_chal 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
              0004 data: 90 ae 0c 2b 4d a1 7d 67 
[2010/04/07 16:56:33, 7, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
          00000c smb_io_utime 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
              000c time: 4bbc9d22
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0010 switch_value: 0003
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
      000014 net_io_user_info3 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
          0014 ptr_user_info : 00000000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0018 auth_resp   : 00000001
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_ntstatus(763)
      001c status      : NT_STATUS_WRONG_PASSWORD
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2305)
  api_rpcTNP: called NETLOGON successfully
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe.c:api_rpcTNP(2314)
  api_rpcTNP: rpc input buffer underflow (parse error?)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
  00f2 : 00 00 8a e3 13 71 02 f4 36 71 01 40 04 00 01 00 00 00 
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:free_pipe_context(529)
  free_pipe_context: destroying talloc pool of size 642
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(963)
  write_to_pipe: data_used = 320
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_write_and_X(217)
  writeX-IPC pnum=76d7 nwritten=336
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=47
  smb_com=0x2f
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=1857
  smt_wct=6
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=  336 (0x150)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util_sock.c:read_smb_length_return_keepalive(623)
  got smb length of 59
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1109)
  got message type 0x0 of len 0x3b
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:process_smb(1110)
  Transaction 31 of length 63
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=59
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=24
  smb_flg2=51207
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=1921
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=57054 (0xDEDE)
  smb_vwv[ 2]=30423 (0x76D7)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]= 1024 (0x400)
  smb_vwv[ 6]= 1024 (0x400)
  smb_vwv[ 7]=65535 (0xFFFF)
  smb_vwv[ 8]=65535 (0xFFFF)
  smb_vwv[ 9]= 1024 (0x400)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=0
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/process.c:switch_message(914)
  switch message SMBreadX (pid 7157) conn 0x803fb1f8
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] smbd/uid.c:change_to_user(176)
  change_to_user: Skipping user change - already user
[2010/04/07 16:56:33, 4, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1264)
  search for pipe pnum=76d7
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d7 (pipes_open=2)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1268)
  pipe name NETLOGON pnum=76d5 (pipes_open=2)
[2010/04/07 16:56:33, 6, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_pipe(995)
  read_from_pipe: 76d7 name: NETLOGON len: 1024
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(1068)
  read_from_pipe: NETLOGON: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 32.
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000000 smb_io_rpc_hdr hdr
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0000 major     : 05
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0001 minor     : 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0002 pkt_type  : 02
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0003 flags     : 03
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0004 pack_type0: 10
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0005 pack_type1: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0006 pack_type2: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0007 pack_type3: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0008 frag_len  : 0060
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      000a auth_len  : 0020
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      000c call_id   : 00000004
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000010 smb_io_rpc_hdr_resp resp
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      0010 alloc_hint: 00000020
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint16(675)
      0014 context_id: 0000
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0016 cancel_ct : 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0017 reserved  : 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000038 smb_io_rpc_hdr_auth hdr_auth
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0038 auth_type    : 44
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      0039 auth_level   : 06
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      003a auth_pad_len : 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8(615)
      003b auth_reserved: 00
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint32(704)
      003c auth_context_id: 00000001
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:schannel_encode(1633)
  SCHANNEL: schannel_encode seq_num=1 data_len=32
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_debug(84)
  000040 smb_io_rpc_auth_schannel_chk 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
      0040 sig  : 77 00 7a 00 ff ff 00 00 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
      0048 seq_num: c5 19 49 3e b0 66 8b dd 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
      0050 packet_digest: 65 45 11 a2 77 88 de 47 
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] rpc_parse/parse_prs.c:prs_uint8s(851)
      0058 confounder: 53 f0 75 80 ac 2b f4 65 
[2010/04/07 16:56:33, 3, effective(65534, 65534), real(65534, 0)] smbd/pipes.c:reply_pipe_read_and_X(262)
  readX-IPC pnum=76d7 min=1024 max=1024 nread=96
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(485)
[2010/04/07 16:56:33, 5, effective(65534, 65534), real(65534, 0)] lib/util.c:show_msg(495)
  size=155
  smb_com=0x2e
  smb_rcls=0
  smb_reh=0
  smb_err=0
  smb_flg=136
  smb_flg2=51201
  smb_tid=1
  smb_pid=65279
  smb_uid=101
  smb_mid=1921
  smt_wct=12
  smb_vwv[ 0]=  255 (0xFF)
  smb_vwv[ 1]=    0 (0x0)
  smb_vwv[ 2]=    0 (0x0)
  smb_vwv[ 3]=    0 (0x0)
  smb_vwv[ 4]=    0 (0x0)
  smb_vwv[ 5]=   96 (0x60)
  smb_vwv[ 6]=   59 (0x3B)
  smb_vwv[ 7]=    0 (0x0)
  smb_vwv[ 8]=    0 (0x0)
  smb_vwv[ 9]=    0 (0x0)
  smb_vwv[10]=    0 (0x0)
  smb_vwv[11]=    0 (0x0)
  smb_bcc=96
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] lib/util.c:dump_data(2222)
  [000] 05 00 02 03 10 00 00 00  60 00 20 00 04 00 00 00  ........ `. .....
  [010] 20 00 00 00 00 00 00 00  93 D2 5F D9 D2 B8 6C 6A   ....... .._...lj
  [020] B4 08 9C 49 69 A6 2E 94  9D 31 97 CC 21 44 27 EC  ...Ii... .1..!D'.
  [030] 69 0C 40 DC E4 79 BF F6  44 06 00 00 01 00 00 00  i.@..y.. D.......
  [040] 77 00 7A 00 FF FF 00 00  C5 19 49 3E B0 66 8B DD  w.z..... ..I>.f..
  [050] 65 45 11 A2 77 88 DE 47  53 F0 75 80 AC 2B F4 65  eE..w..G S.u..+.e
[2010/04/07 16:56:33, 10, effective(65534, 65534), real(65534, 0)] smbd/process.c:setup_select_timeout(1284)
  change_notify_timeout: -1
