[Samba] usrmgr: group not found.

Thu Oct 20 16:38:25 GMT 2005

I bet you have a group called "Administrators" or "Users", or some other
group name which is typically associated with local/builtin groups.

On 10/20/2005 6:26 AM, Asbjørn Morell wrote:
> Hello.
>  usrmgr gives me this error, if I try to create or modify a user:
> The group name could not be found.
> I can create and modify groups with no errors!. This is my smb.conf:
> 
> [global]
> addsharecommand = /etc/samba/scripts/modify_samba_config.pl
> netbiosname = Spider-Man
> deletesharecommand = /etc/samba/scripts/modify_samba_config.pl
> usernamemap = /etc/samba/smbusers
> maxlogsize = 50
> addprintercommand = /etc/samba/scripts/smbaddprinter.pl
> addmachinescript = /usr/sbin/useradd -d /dev/null -g machines -c 'Machine
> Account' -s /bin/false -M '%u'
> deleteuserscript = /usr/sbin/userdel -r '%s'
> domainlogons = yes
> printcapname = cups
> hideunreadable = yes
> logfile = /var/log/samba/log.%m
> preferredmaster = yes
> printing = cups
> socketoptions = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
> delprintercommand = /etc/samba/scripts/smbdelprinter.pl
> addusertogroupscript = /usr/bin/gpasswd -a '%u' '%g'
> workgroup = Marvel
> useclientdriver = no
> security = user
> smbpasswdfile = /etc/samba/private/smbpasswd
> domainmaster = yes
> addgroupscript = /usr/sbin/groupadd %g && getent group '%g'|awk -F: '{print
> $3}'
> deleteuserfromgroupscript = /usr/bin/gpasswd -d '%u' '%g'
> loglevel = 5
> adduserscript = /usr/sbin/useradd -m -s /bin/false '%u'
> dnsproxy = no
> hidedotfiles = yes
> setprimarygroupscript = /usr/sbin/usermod -g '%g' '%u'
> deletegroupscript = /usr/sbin/groupdel '%g'
> loadprinters = yes
> cupsoptions = "raw"
> nullpasswords = no
> logonpath = \\%L\Profiles\%U <file://%25L/Profiles/%25U>
> changesharecommand = /etc/samba/scripts/modify_samba_config.pl
> serverstring = Samba Server %v
> encryptpasswords = yes
> 
> ## Section - [printers]
> [printers]
> createmode = 0700
> browseable = no
> printable = yes
> writable = no
> path = /var/spool/samba
> guestok = no
> comment = All Printers
> printcommand = lpr-cups -P %p -o raw %s -r # using client side printer
> drivers.
> 
> ## Section - [Profiles]
> [Profiles]
> rootpreexec = PROFILE=/var/lib/samba/profiles/%u; if [ ! -e $PROFILE ]; \
> browseable = no
> writable = yes
> path = /home/profiles
> guestok = yes
> 
> ## Section - [das]
> [das]
> comment = das
> path = /tmp
> 
> ## Section - [print$]
> [print$]
> readonly = yes
> browseable = yes
> path = /var/lib/samba/printers
> guestok = no
> writelist = @adm root
> 
> ## Section - [homes]
> [homes]
> browseable = no
> comment = Home Directories
> writable = yes
> 
> #
> # end of generated smb.conf
> #
> I am logged in as root in the domain.
> 
> This is the log.client "error":
> 
> [2005/10/20 12:24:38, 6] smbd/process.c:process_smb(1113)
> got message type 0x0 of len 0x88
> [2005/10/20 12:24:38, 3] smbd/process.c:process_smb(1114)
> Transaction 422 of length 140
> [2005/10/20 12:24:38, 5] lib/util.c:show_msg(454)
> [2005/10/20 12:24:38, 5] lib/util.c:show_msg(464)
> size=136
> smb_com=0x25
> smb_rcls=0
> smb_reh=0
> smb_err=0
> smb_flg=24
> smb_flg2=51207
> smb_tid=2
> smb_pid=928
> smb_uid=101
> smb_mid=6656
> smt_wct=16
> smb_vwv[ 0]= 0 (0x0)
> smb_vwv[ 1]= 52 (0x34)
> smb_vwv[ 2]= 0 (0x0)
> smb_vwv[ 3]= 1024 (0x400)
> smb_vwv[ 4]= 0 (0x0)
> smb_vwv[ 5]= 0 (0x0)
> smb_vwv[ 6]= 0 (0x0)
> smb_vwv[ 7]= 0 (0x0)
> smb_vwv[ 8]= 0 (0x0)
> smb_vwv[ 9]= 0 (0x0)
> smb_vwv[10]= 84 (0x54)
> smb_vwv[11]= 52 (0x34)
> smb_vwv[12]= 84 (0x54)
> smb_vwv[13]= 2 (0x2)
> smb_vwv[14]= 38 (0x26)
> smb_vwv[15]=30312 (0x7668)
> smb_bcc=69
> [2005/10/20 12:24:38, 3] smbd/process.c:switch_message(900)
> switch message SMBtrans (pid 6588) conn 0x80360f00
> [2005/10/20 12:24:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
> [2005/10/20 12:24:38, 5] auth/auth_util.c:debug_nt_user_token(457)
> NT user token of user S-1-5-21-3000185186-3909684444-328561933-1000
> contains 15 SIDs
> SID[ 0]: S-1-5-21-3000185186-3909684444-328561933-1000
> SID[ 1]: S-1-5-21-3000185186-3909684444-328561933-1001
> SID[ 2]: S-1-1-0
> SID[ 3]: S-1-5-2
> SID[ 4]: S-1-5-11
> SID[ 5]: S-1-5-21-3000185186-3909684444-328561933-1003
> SID[ 6]: S-1-5-21-3000185186-3909684444-328561933-1005
> SID[ 7]: S-1-5-21-3000185186-3909684444-328561933-1007
> SID[ 8]: S-1-5-21-3000185186-3909684444-328561933-1009
> SID[ 9]: S-1-5-21-3000185186-3909684444-328561933-1013
> SID[ 10]: S-1-5-21-3000185186-3909684444-328561933-1021
> SID[ 11]: S-1-5-21-3000185186-3909684444-328561933-1023
> SID[ 12]: S-1-5-21-3000185186-3909684444-328561933-1041
> SID[ 13]: S-1-5-21-3000185186-3909684444-328561933-1053
> SID[ 14]: S-1-5-21-3000185186-3909684444-328561933-1055
> SE_PRIV 0x0 0x0 0x0 0x0
> [2005/10/20 12:24:38, 5] auth/auth_util.c:debug_unix_user_token(473)
> UNIX token of user 0
> Primary group is 0 and contains 11 supplementary groups
> Group[ 0]: 0
> Group[ 1]: 1
> Group[ 2]: 2
> Group[ 3]: 3
> Group[ 4]: 4
> Group[ 5]: 6
> Group[ 6]: 10
> Group[ 7]: 11
> Group[ 8]: 20
> Group[ 9]: 26
> Group[ 10]: 27
> [2005/10/20 12:24:38, 5] smbd/uid.c:change_to_user(304)
> change_to_user uid=(0,0) gid=(0,0)
> [2005/10/20 12:24:38, 3] smbd/ipc.c:reply_trans(539)
> trans <\PIPE\> data=52 params=0 setup=2
> [2005/10/20 12:24:38, 5] smbd/ipc.c:reply_trans(560)
> calling named_pipe
> [2005/10/20 12:24:38, 3] smbd/ipc.c:named_pipe(334)
> named pipe command on <> name
> [2005/10/20 12:24:38, 5] smbd/ipc.c:api_fd_reply(265)
> api_fd_reply
> [2005/10/20 12:24:38, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1169)
> search for pipe pnum=7668
> [2005/10/20 12:24:38, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1173)
> pipe name lsarpc pnum=7669 (pipes_open=2)
> [2005/10/20 12:24:38, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1173)
> pipe name samr pnum=7668 (pipes_open=2)
> [2005/10/20 12:24:38, 3] smbd/ipc.c:api_fd_reply(294)
> Got API command 0x26 on pipe "samr" (pnum 7668)
> [2005/10/20 12:24:38, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(853)
> write_to_pipe: 7668 name: samr open: Yes len: 52
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 smb_io_rpc_hdr
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0000 major : 05
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0001 minor : 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0002 pkt_type : 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0003 flags : 03
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0004 pack_type0: 10
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0005 pack_type1: 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0006 pack_type2: 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0007 pack_type3: 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0008 frag_len : 0034
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 000a auth_len : 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 000c call_id : 0000015e
> [2005/10/20 12:24:38, 5]
> rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
> unmarshall_rpc_header: using little-endian RPC
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 smb_io_rpc_hdr_req req
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0000 alloc_hint: 0000001c
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0004 context_id: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0006 opnum : 0022
> [2005/10/20 12:24:38, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(543)
> free_pipe_context: destroying talloc pool of size 0
> [2005/10/20 12:24:38, 5] rpc_server/srv_pipe.c:api_pipe_request(1509)
> Requested \PIPE\samr
> [2005/10/20 12:24:38, 4] rpc_server/srv_pipe.c:api_rpcTNP(1543)
> api_rpcTNP: samr op 0x22 - api_rpcTNP: rpc command: SAMR_OPEN_USER
> [2005/10/20 12:24:38, 6] rpc_server/srv_pipe.c:api_rpcTNP(1569)
> api_rpc_cmds[20].fn == 0x8011982b
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 samr_io_q_open_user
> [2005/10/20 12:24:38, 6] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 smb_io_pol_hnd domain_pol
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0000 data1: 00000000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0004 data2: 00000010
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0008 data3: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 000a data4: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8s(758)
> 000c data5: e0 6f 57 43 bc 19 00 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0014 access_mask: 000601bf
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0018 user_rid : 00000bcc
> [2005/10/20 12:24:38, 4]
> rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
> Found policy hnd[0] [000] 00 00 00 00 10 00 00 00 00 00 00 00 E0 6F 57 43
> ........ .....oWC
> [010] BC 19 00 00 ....
> [2005/10/20 12:24:38, 5]
> rpc_server/srv_samr_nt.c:access_check_samr_function(194)
> _samr_open_user: access check ((granted: 0x000f07fb; required: 0x00000200)
> [2005/10/20 12:24:38, 3] lib/util_seaccess.c:se_access_check(250)
> [2005/10/20 12:24:38, 3] lib/util_seaccess.c:se_access_check(251)
> se_access_check: user sid is S-1-5-21-3000185186-3909684444-328561933-1000
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1001
> se_access_check: also S-1-1-0
> se_access_check: also S-1-5-2
> se_access_check: also S-1-5-11
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1003
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1005
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1007
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1009
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1013
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1021
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1023
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1041
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1053
> se_access_check: also S-1-5-21-3000185186-3909684444-328561933-1055
> [2005/10/20 12:24:38, 5] lib/util_seaccess.c:se_access_check(314)
> se_access_check: access (601bf) denied.
> [2005/10/20 12:24:38, 4]
> rpc_server/srv_samr_nt.c:access_check_samr_object(164)
> _samr_open_user: ACCESS should be DENIED (requested: 0x000601bf)
> but overritten by euid == sec_initial_uid()
> [2005/10/20 12:24:38, 4]
> rpc_server/srv_samr_nt.c:access_check_samr_object(182)
> _samr_open_user: access GRANTED (requested: 0x000601bf, granted: 0x000f05ff)
> [2005/10/20 12:24:38, 3] smbd/sec_ctx.c:push_sec_ctx(256)
> push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
> [2005/10/20 12:24:38, 3] smbd/uid.c:push_conn_ctx(388)
> push_conn_ctx(101) : conn_ctx_stack_ndx = 0
> [2005/10/20 12:24:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
> [2005/10/20 12:24:38, 5] auth/auth_util.c:debug_nt_user_token(452)
> NT user token: (NULL)
> [2005/10/20 12:24:38, 5] auth/auth_util.c:debug_unix_user_token(473)
> UNIX token of user 0
> Primary group is 0 and contains 0 supplementary groups
> [2005/10/20 12:24:38, 5] passdb/pdb_smbpasswd.c:getsmbfilepwent(486)
> getsmbfilepwent: returning passwd entry for user nobody, uid 65534
> [2005/10/20 12:24:38, 5] passdb/pdb_smbpasswd.c:getsmbfilepwent(486)
> getsmbfilepwent: returning passwd entry for user root, uid 0
> [2005/10/20 12:24:38, 5] passdb/pdb_smbpasswd.c:getsmbfilepwent(486)
> getsmbfilepwent: returning passwd entry for user winxp$, uid 1001
> [2005/10/20 12:24:38, 5] passdb/pdb_smbpasswd.c:getsmbfilepwent(486)
> getsmbfilepwent: returning passwd entry for user winxp2$, uid 1004
> [2005/10/20 12:24:38, 5] passdb/pdb_smbpasswd.c:getsmbfilepwent(486)
> getsmbfilepwent: returning passwd entry for user atm, uid 1010
> [2005/10/20 12:24:38, 3] smbd/sec_ctx.c:push_sec_ctx(256)
> push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
> [2005/10/20 12:24:38, 3] smbd/uid.c:push_conn_ctx(388)
> push_conn_ctx(101) : conn_ctx_stack_ndx = 1
> [2005/10/20 12:24:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
> [2005/10/20 12:24:38, 5] auth/auth_util.c:debug_nt_user_token(452)
> NT user token: (NULL)
> [2005/10/20 12:24:38, 5] auth/auth_util.c:debug_unix_user_token(473)
> UNIX token of user 0
> Primary group is 0 and contains 0 supplementary groups
> [2005/10/20 12:24:38, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
> pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
> [2005/10/20 12:24:38, 4] lib/substitute.c:automount_server(337)
> Home server: spider-man
> [2005/10/20 12:24:38, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
> pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
> [2005/10/20 12:24:38, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
> Opened policy hnd[5] [000] 00 00 00 00 65 00 00 00 00 00 00 00 66 70 57 43
> ....e... ....fpWC
> [010] BC 19 00 00 ....
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 samr_io_r_open_user
> [2005/10/20 12:24:38, 6] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 smb_io_pol_hnd user_pol
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0000 data1: 00000000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0004 data2: 00000065
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0008 data3: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 000a data4: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8s(758)
> 000c data5: 66 70 57 43 bc 19 00 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_ntstatus(701)
> 0014 status: NT_STATUS_OK
> [2005/10/20 12:24:38, 5] rpc_server/srv_pipe.c:api_rpcTNP(1590)
> api_rpcTNP: called samr successfully
> [2005/10/20 12:24:38, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(543)
> free_pipe_context: destroying talloc pool of size 1668
> [2005/10/20 12:24:38, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(910)
> read_from_pipe: 7668 name: samr len: 1024
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 smb_io_rpc_hdr hdr
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0000 major : 05
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0001 minor : 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0002 pkt_type : 02
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0003 flags : 03
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0004 pack_type0: 10
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0005 pack_type1: 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0006 pack_type2: 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0007 pack_type3: 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0008 frag_len : 0030
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 000a auth_len : 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 000c call_id : 0000015e
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000010 smb_io_rpc_hdr_resp resp
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0010 alloc_hint: 00000018
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0014 context_id: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0016 cancel_ct : 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0017 reserved : 00
> [2005/10/20 12:24:38, 5] smbd/ipc.c:copy_trans_params_and_data(60)
> copy_trans_params_and_data: params[0..0] data[0..48]
> [2005/10/20 12:24:38, 5] lib/util.c:show_msg(454)
> [2005/10/20 12:24:38, 5] lib/util.c:show_msg(464)
> size=104
> smb_com=0x25
> smb_rcls=0
> smb_reh=0
> smb_err=0
> smb_flg=136
> smb_flg2=51201
> smb_tid=2
> smb_pid=928
> smb_uid=101
> smb_mid=6656
> smt_wct=10
> smb_vwv[ 0]= 0 (0x0)
> smb_vwv[ 1]= 48 (0x30)
> smb_vwv[ 2]= 0 (0x0)
> smb_vwv[ 3]= 0 (0x0)
> smb_vwv[ 4]= 56 (0x38)
> smb_vwv[ 5]= 0 (0x0)
> smb_vwv[ 6]= 48 (0x30)
> smb_vwv[ 7]= 56 (0x38)
> smb_vwv[ 8]= 0 (0x0)
> smb_vwv[ 9]= 0 (0x0)
> smb_bcc=49
> [2005/10/20 12:24:38, 6] smbd/process.c:process_smb(1113)
> got message type 0x0 of len 0x80
> [2005/10/20 12:24:38, 3] smbd/process.c:process_smb(1114)
> Transaction 423 of length 132
> [2005/10/20 12:24:38, 5] lib/util.c:show_msg(454)
> [2005/10/20 12:24:38, 5] lib/util.c:show_msg(464)
> size=128
> smb_com=0x25
> smb_rcls=0
> smb_reh=0
> smb_err=0
> smb_flg=24
> smb_flg2=51207
> smb_tid=2
> smb_pid=928
> smb_uid=101
> smb_mid=6720
> smt_wct=16
> smb_vwv[ 0]= 0 (0x0)
> smb_vwv[ 1]= 44 (0x2C)
> smb_vwv[ 2]= 0 (0x0)
> smb_vwv[ 3]= 1024 (0x400)
> smb_vwv[ 4]= 0 (0x0)
> smb_vwv[ 5]= 0 (0x0)
> smb_vwv[ 6]= 0 (0x0)
> smb_vwv[ 7]= 0 (0x0)
> smb_vwv[ 8]= 0 (0x0)
> smb_vwv[ 9]= 0 (0x0)
> smb_vwv[10]= 84 (0x54)
> smb_vwv[11]= 44 (0x2C)
> smb_vwv[12]= 84 (0x54)
> smb_vwv[13]= 2 (0x2)
> smb_vwv[14]= 38 (0x26)
> smb_vwv[15]=30312 (0x7668)
> smb_bcc=61
> [2005/10/20 12:24:38, 3] smbd/process.c:switch_message(900)
> switch message SMBtrans (pid 6588) conn 0x80360f00
> [2005/10/20 12:24:38, 4] smbd/uid.c:change_to_user(217)
> change_to_user: Skipping user change - already user
> [2005/10/20 12:24:38, 3] smbd/ipc.c:reply_trans(539)
> trans <\PIPE\> data=44 params=0 setup=2
> [2005/10/20 12:24:38, 5] smbd/ipc.c:reply_trans(560)
> calling named_pipe
> [2005/10/20 12:24:38, 3] smbd/ipc.c:named_pipe(334)
> named pipe command on <> name
> [2005/10/20 12:24:38, 5] smbd/ipc.c:api_fd_reply(265)
> api_fd_reply
> [2005/10/20 12:24:38, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1169)
> search for pipe pnum=7668
> [2005/10/20 12:24:38, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1173)
> pipe name lsarpc pnum=7669 (pipes_open=2)
> [2005/10/20 12:24:38, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1173)
> pipe name samr pnum=7668 (pipes_open=2)
> [2005/10/20 12:24:38, 3] smbd/ipc.c:api_fd_reply(294)
> Got API command 0x26 on pipe "samr" (pnum 7668)
> [2005/10/20 12:24:38, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(853)
> write_to_pipe: 7668 name: samr open: Yes len: 44
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 smb_io_rpc_hdr
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0000 major : 05
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0001 minor : 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0002 pkt_type : 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0003 flags : 03
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0004 pack_type0: 10
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0005 pack_type1: 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0006 pack_type2: 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8(582)
> 0007 pack_type3: 00
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0008 frag_len : 002c
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 000a auth_len : 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 000c call_id : 0000015f
> [2005/10/20 12:24:38, 5]
> rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
> unmarshall_rpc_header: using little-endian RPC
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 smb_io_rpc_hdr_req req
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0000 alloc_hint: 00000014
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0004 context_id: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0006 opnum : 0001
> [2005/10/20 12:24:38, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(543)
> free_pipe_context: destroying talloc pool of size 0
> [2005/10/20 12:24:38, 5] rpc_server/srv_pipe.c:api_pipe_request(1509)
> Requested \PIPE\samr
> [2005/10/20 12:24:38, 4] rpc_server/srv_pipe.c:api_rpcTNP(1543)
> api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
> [2005/10/20 12:24:38, 6] rpc_server/srv_pipe.c:api_rpcTNP(1569)
> api_rpc_cmds[0].fn == 0x801183cc
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 samr_io_q_close_hnd
> [2005/10/20 12:24:38, 6] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 smb_io_pol_hnd pol
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0000 data1: 00000000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0004 data2: 00000065
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0008 data3: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 000a data4: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint8s(758)
> 000c data5: 66 70 57 43 bc 19 00 00
> [2005/10/20 12:24:38, 4]
> rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
> Found policy hnd[0] [000] 00 00 00 00 65 00 00 00 00 00 00 00 66 70 57 43
> ....e... ....fpWC
> [010] BC 19 00 00 ....
> [2005/10/20 12:24:38, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
> Closed policy
> [2005/10/20 12:24:38, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(334)
> samr_reply_close_hnd: 334
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 samr_io_r_close_hnd
> [2005/10/20 12:24:38, 6] rpc_parse/parse_prs.c:prs_debug(82)
> 000000 smb_io_pol_hnd pol
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0000 data1: 00000000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint32(671)
> 0004 data2: 00000000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> 0008 data3: 0000
> [2005/10/20 12:24:38, 5] rpc_parse/parse_prs.c:prs_uint16(642)
> Everything works fine.
> 
> --
> 
> Mvh Asbjørn Morell

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/