Script started on Fri 04 Sep 2015 10:25:48 BST ]777;notify;Command completed;/usr/sbin/winbindd -d10 -SF]0;dwoodhou@i7:/home/dwmw2/fedora/samba/f22/results_samba/4.2.2/1.1.fc22]7;file://i7.infradead.org/home/dwmw2/fedora/samba/f22/results_samba/4.2.2/1.1.fc22[root@i7 1.1.fc22]# /usr/sbin/winbindd -d10 -SF INFO: Current debug levels: all: 10 tdb: 10 printdrivers: 10 lanman: 10 smb: 10 rpc_parse: 10 rpc_srv: 10 rpc_cli: 10 passdb: 10 sam: 10 auth: 10 winbind: 10 vfs: 10 idmap: 10 quota: 10 acls: 10 locking: 10 msdfs: 10 dmapi: 10 registry: 10 scavenger: 10 dns: 10 ldb: 10 Maximum core file size limits now 16777216(soft) -1(hard) winbindd version 4.2.2 started. Copyright Andrew Tridgell and the Samba Team 1992-2014 lp_load_ex: refreshing parameters Initialising global parameters rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) INFO: Current debug levels: all: 10 tdb: 10 printdrivers: 10 lanman: 10 smb: 10 rpc_parse: 10 rpc_srv: 10 rpc_cli: 10 passdb: 10 sam: 10 auth: 10 winbind: 10 vfs: 10 idmap: 10 quota: 10 acls: 10 locking: 10 msdfs: 10 dmapi: 10 registry: 10 scavenger: 10 dns: 10 ldb: 10 Processing section "[global]" doing parameter security = ads doing parameter realm = GER.CORP.INTEL.COM doing parameter workgroup = GER doing parameter winbind use default domain = yes doing parameter winbind offline logon = yes doing parameter winbind refresh tickets = yes doing parameter winbind enum users = no doing parameter winbind enum groups = no doing parameter netbios name = DWOODHOU-LINUX doing parameter create krb5 conf = no doing parameter log level = 0 auth:10 winbind:10 doing parameter kerberos method = secrets and keytab doing parameter client NTLMv2 auth = no doing parameter gencache:stabilize_count = 1 doing parameter gencache:stabilize_interval = 1 pm_process() returned Yes lp_servicenumber: couldn't find homes Maximum core file size limits now 16777216(soft) -1(hard) Registering messaging pointer for type 2 - private_data=(nil) Registering messaging pointer for type 9 - private_data=(nil) Registered MSG_REQ_POOL_USAGE Registering messaging pointer for type 11 - private_data=(nil) Registering messaging pointer for type 12 - private_data=(nil) Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED Registering messaging pointer for type 1 - private_data=(nil) Registering messaging pointer for type 5 - private_data=(nil) lp_load_ex: refreshing parameters Freeing parametrics: Initialising global parameters rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) INFO: Current debug levels: all: 10 tdb: 10 printdrivers: 10 lanman: 10 smb: 10 rpc_parse: 10 rpc_srv: 10 rpc_cli: 10 passdb: 10 sam: 10 auth: 10 winbind: 10 vfs: 10 idmap: 10 quota: 10 acls: 10 locking: 10 msdfs: 10 dmapi: 10 registry: 10 scavenger: 10 dns: 10 ldb: 10 Processing section "[global]" doing parameter security = ads doing parameter realm = GER.CORP.INTEL.COM doing parameter workgroup = GER doing parameter winbind use default domain = yes doing parameter winbind offline logon = yes doing parameter winbind refresh tickets = yes doing parameter winbind enum users = no doing parameter winbind enum groups = no doing parameter netbios name = DWOODHOU-LINUX doing parameter create krb5 conf = no doing parameter log level = 0 auth:10 winbind:10 doing parameter kerberos method = secrets and keytab doing parameter client NTLMv2 auth = no doing parameter gencache:stabilize_count = 1 doing parameter gencache:stabilize_interval = 1 pm_process() returned Yes lp_servicenumber: couldn't find homes added interface em0 ip=2001:8b0:10b:1:21e:67ff:fecb:7a92 bcast= netmask=ffff:ffff:ffff:ffff:: added interface em0 ip=90.155.92.213 bcast=90.155.92.255 netmask=255.255.255.192 added interface virbr2 ip=172.31.0.1 bcast=172.31.0.255 netmask=255.255.255.0 added interface virbr1 ip=192.168.100.1 bcast=192.168.100.255 netmask=255.255.255.0 added interface virbr0 ip=192.168.122.1 bcast=192.168.122.255 netmask=255.255.255.0 Netbios name list:- my_netbios_names[0]="DWOODHOU-LINUX" added interface em0 ip=2001:8b0:10b:1:21e:67ff:fecb:7a92 bcast= netmask=ffff:ffff:ffff:ffff:: added interface em0 ip=90.155.92.213 bcast=90.155.92.255 netmask=255.255.255.192 added interface virbr2 ip=172.31.0.1 bcast=172.31.0.255 netmask=255.255.255.0 added interface virbr1 ip=192.168.100.1 bcast=192.168.100.255 netmask=255.255.255.0 added interface virbr0 ip=192.168.122.1 bcast=192.168.122.255 netmask=255.255.255.0 fcntl_lock 10 6 0 1 1 fcntl_lock: Lock call successful TimeInit: Serverzone is -3600 winbindd_validate_cache: replacing panic function tdb_validate_open called for tdb '/var/lib/samba/winbindd_cache.tdb' tdb_validate called for tdb '/var/lib/samba/winbindd_cache.tdb' tdb_validate: forking to let child do validation. tdb_validate: fork succeeded, child PID = 98303 tdb_validate: waiting for child to finish... tdb_validate (validation child): created tdb_validate (validation child): calling tdb_validate_child tdb_validate_child: tdb /var/lib/samba/winbindd_cache.tdb freelist has 5 entries validate_sn: SN/S-1-5-21-725345543-602162358-527237240-412953 ok validate_ns: NS/GER/EXIM ok validate_cache_version: WINBINDD_CACHE_VERSION ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-971119 ok validate_sn: SN/S-1-5-32-545 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-2245286 ok validate_ns: NS/GER/COLORD ok validate_sn: SN/S-1-5-21-2052111302-1275210071-1644491937-422813 ok validate_cred: CRED/S-1-5-21-2052111302-1275210071-1644491937-705477 ok validate_ns: NS/GER/DWMW2 ok validate_gm: GM/S-1-5-21-2052111302-1275210071-1644491937-422813 ok validate_loc_pol: LOC_POL/CORP ok validate_loc_pol: LOC_POL/CCR ok validate_ns: NS/GER/500 ok validate_sn: SN/S-1-5-21-823518204-2139871995-682003330-5273 ok validate_sn: SN/S-1-5-21-823518204-2139871995-682003330-18072 ok validate_sn: SN/S-1-5-21-823518204-2139871995-682003330-6424 ok validate_ua: UA/S-1-5-21-2052111302-1275210071-1644491937-279532/S-1-5-21-2052111302-1275210071-1644491937-513/S-1-5-21-2052111302-1275210071-1644491937-196238/S-1-5-21-2052111302-1275210071-1644491937-170157/S-1-5-21-2052111302-1275210071-1644491937-617267/S-1-5-21-2052111302-1275210071-1644491937-301017/S-1-5-21-2052111302-1275210071-1644491937-404596/S-1-5-21-2052111302-1275210071-1644491937-408155/S-1-5-21-2052111302-1275210071-1644491937-346582/S-1-5-21-823518204-2139871995-682003330-44669/S-1-5-21-823518204-2139871995-682003330-5346/S-1-5-21-725345543-602162358-527237240-347703/S-1-5-21-725345543-602162358-527237240-1993781/S-1-5-21-725345543-602162358-527237240-2115640/S-1-5-21-1757981266-725345543-1404487317-124700/S-1-5-21-725345543-602162358-527237240-632733/S-1-5-21-725345543-602162358-527237240-710385/S-1-5-21-725345543-602162358-527237240-938523/S-1-5-21-725345543-602162358-527237240-389586/S-1-5-21-725345543-602162358-527237240-971119/S-1-5-21-823518204-2139871995-682003330-2750/S-1-5-21-823518 +> 204-2139871995-682003330-5273/S-1-5-21-725345543-602162358-527237240-1235048/S-1-5-21-823518204-2139871995-682003330-6424/S-1-5-21-725345543-602162358-527237240-1048331/S-1-5-21-725345543-602162358-527237240-2245286/S-1-5-21-725345543-602162358-527237240-1150207/S-1-5-21-725345543-602162358-527237240-2379415/S-1-5-21-725345543-602162358-527237240-1791180/S-1-5-21-725345543-602162358-527237240-921311/S-1-5-21-725345543-602162358-527237240-1961607/S-1-5-21-725345543-602162358-527237240-876174/S-1-5-21-823518204-2139871995-682003330-18345/S-1-5-21-725345543-602162358-527237240-2257863/S-1-5-21-823518204-2139871995-682003330-18072/S-1-5-21-725345543-602162358-527237240-2201840/S-1-5-21-725345543-602162358-527237240-719732/S-1-5-21-725345543-602162358-527237240-1715732/S-1-5-21-725345543-602162358-527237240-411987/S-1-5-21-725345543-602162358-527237240-1422688/S-1-5-21-823518204-2139871995-682003330-12124/S-1-5-21-725345543-602162358-527237240-412953/S-1-5-21-823518204-2139871995-682003330-55165/S-1-5-21-72534554 +> 3-602162358-527237240-2245288/S-1-5-21-725345543-602162358-527237240-1330665/S-1-5-21-725345543-602162358-527237240-2351279/S-1-5-21-105273194-1791699089-474703532-513 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-1715732 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-1330665 ok validate_sn: SN/S-1-5-21-823518204-2139871995-682003330-44669 ok validate_u: U/S-1-5-21-2052111302-1275210071-1644491937-279532 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-921311 ok validate_sn: SN/S-1-5-21-1757981266-725345543-1404487317-124700 ok validate_sn: SN/S-1-5-21-105273194-1791699089-474703532-513 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-1791180 ok validate_ns: NS/GER/ROOT ok validate_ns: NS/GER/PULSE ok validate_sn: SN/S-1-5-21-2052111302-1275210071-1644491937-453672 ok validate_gm: GM/S-1-5-21-2052111302-1275210071-1644491937-422812 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-2245288 ok validate_sn: SN/S-1-5-32-546 ok validate_pwd_pol: PWD_POL/GER ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-2257863 ok validate_sn: SN/S-1-5-21-2052111302-1275210071-1644491937-427813 ok validate_ug: UG/S-1-5-21-2052111302-1275210071-1644491937-279532 ok validate_sn: SN/S-1-5-21-1387027602-3023916034-3107813797-28218 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-389586 ok validate_sn: SN/S-1-5-21-823518204-2139871995-682003330-2750 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-2379415 ok validate_offline: WINBINDD_OFFLINE ok validate_ns: NS/GER/DWOODHOU ok validate_ua: UA/S-1-5-21-2052111302-1275210071-1644491937-453672/S-1-5-21-2052111302-1275210071-1644491937-513/S-1-5-21-1387027602-3023916034-3107813797-28218/S-1-5-21-105273194-1791699089-474703532-513/S-1-5-21-2052111302-1275210071-1644491937-422812/S-1-5-21-2052111302-1275210071-1644491937-422813/S-1-5-21-725345543-602162358-527237240-347703/S-1-5-21-2052111302-1275210071-1644491937-427813 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-2351279 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-1961607 ok validate_ug: UG/S-1-5-21-2052111302-1275210071-1644491937-453672 ok validate_loc_pol: LOC_POL/GER ok validate_sn: SN/S-1-5-21-823518204-2139871995-682003330-18345 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-1048331 ok validate_sn: SN/S-1-5-21-823518204-2139871995-682003330-5346 ok validate_loc_pol: LOC_POL/AMR ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-938523 ok validate_pwinfo: NSS/PWINFO/S-1-5-21-2052111302-1275210071-1644491937-279532 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-2115640 ok validate_sn: SN/S-1-5-21-1457581372-2114166478-3974051346-501 ok validate_sn: SN/S-1-5-21-2052111302-1275210071-1644491937-422812 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-876174 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-411987 ok validate_trustdomcache: TRUSTDOMCACHE/GER ok Don't trust me, I am a DUMMY! validate_sn: SN/S-1-5-21-725345543-602162358-527237240-719732 ok validate_sn: SN/S-1-5-32-544 ok validate_ns: NS/GER/AVAHI ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-2201840 ok validate_cred: CRED/S-1-5-21-2052111302-1275210071-1644491937-279532 ok validate_sn: SN/S-1-5-21-823518204-2139871995-682003330-12124 ok validate_ns: NS/GER/RTKIT ok validate_trustdomcache: TRUSTDOMCACHE/WORKGROUP ok Don't trust me, I am a DUMMY! validate_sn: SN/S-1-5-21-725345543-602162358-527237240-1235048 ok validate_ns: NS/GER/JLAHTINE ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-710385 ok validate_ns: NS/GER/PULSE-RT ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-632733 ok validate_sn: SN/S-1-5-21-2052111302-1275210071-1644491937-279532 ok validate_ns: NS/GER/HALDAEMON ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-1422688 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-1993781 ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-347703 ok validate_sn: SN/S-1-5-21-823518204-2139871995-682003330-55165 ok validate_ns: NS/GER/NM-OPENCONNECT ok validate_sn: SN/S-1-5-21-1457581372-2114166478-3974051346-514 ok validate_sn: SN/S-0-0 ok validate_ns: NS/GER/GDM ok validate_ns: NS/GER/POLKITD ok validate_sn: SN/S-1-5-21-725345543-602162358-527237240-1150207 ok validate_gm: GM/S-1-5-21-2052111302-1275210071-1644491937-427813 ok tdb_validate_child: tdb /var/lib/samba/winbindd_cache.tdb is good with 260 entries tdb_validate_child: summary of validation status: * tdb error: no * bad freelist: no * bad entry: no * unknown key: no => overall success: yes tdb_validate: validating child returned. tdb_validate: child exited, code 0. tdb_validate returning code '0' for tdb '/var/lib/samba/winbindd_cache.tdb' tdb '/var/lib/samba/winbindd_cache.tdb' is valid moved '/var/lib/samba/winbindd_cache.tdb.bak' to '/var/lib/samba/winbindd_cache.tdb.bak.old' tdb_backup: successfully copied 260 entries Created backup '/var/lib/samba/winbindd_cache.tdb.bak' of tdb '/var/lib/samba/winbindd_cache.tdb' winbindd_validate_cache: restoring panic function check lock order 2 for /var/lib/samba/serverid.tdb lock order: 1: 2:/var/lib/samba/serverid.tdb 3: Locking key FE7F010000000000FFFF Allocated locked data 0x0x55ff70cbe050 Unlocking key FE7F010000000000FFFF release lock order 2 for /var/lib/samba/serverid.tdb lock order: 1: 2: 3: Registering messaging pointer for type 33 - private_data=(nil) Registering messaging pointer for type 13 - private_data=(nil) Registering messaging pointer for type 1028 - private_data=(nil) Registering messaging pointer for type 1027 - private_data=(nil) Registering messaging pointer for type 1029 - private_data=(nil) Registering messaging pointer for type 1036 - private_data=(nil) Registering messaging pointer for type 1035 - private_data=(nil) Registering messaging pointer for type 1280 - private_data=(nil) Registering messaging pointer for type 1032 - private_data=(nil) Registering messaging pointer for type 1033 - private_data=(nil) Registering messaging pointer for type 1034 - private_data=(nil) Registering messaging pointer for type 1 - private_data=(nil) Overriding messaging pointer for type 1 - private_data=(nil) wcache_tdc_add_domain: Adding domain BUILTIN ((null)), SID S-1-5-32, flags = 0x0, attributes = 0x0, type = 0x0 pack_tdc_domains: Packing 1 trusted domains pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) idmap config BUILTIN : range = not defined Added domain BUILTIN (null) S-1-5-32 wcache_tdc_add_domain: Adding domain DWOODHOU-LINUX ((null)), SID S-1-5-21-1457581372-2114166478-3974051346, flags = 0x0, attributes = 0x0, type = 0x0 pack_tdc_domains: Packing 2 trusted domains pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) pack_tdc_domains: Packing domain DWOODHOU-LINUX (UNKNOWN) idmap config DWOODHOU-LINUX : range = not defined Added domain DWOODHOU-LINUX (null) S-1-5-21-1457581372-2114166478-3974051346 wcache_tdc_add_domain: Adding domain GER (GER.CORP.INTEL.COM), SID S-1-5-21-2052111302-1275210071-1644491937, flags = 0x0, attributes = 0x0, type = 0x0 pack_tdc_domains: Packing 3 trusted domains pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) pack_tdc_domains: Packing domain DWOODHOU-LINUX (UNKNOWN) pack_tdc_domains: Packing domain GER (GER.CORP.INTEL.COM) idmap config GER : range = not defined Added domain GER GER.CORP.INTEL.COM S-1-5-21-2052111302-1275210071-1644491937 set_domain_online_request: called for domain GER set_domain_online_request: domain GER was globally offline. STATUS=daemon 'winbindd' finished starting up and ready to serve connections fork_domain_child called for domain 'GER' Child process 98304 Deregistering messaging pointer for type 33 - private_data=(nil) Deregistering messaging pointer for type 13 - private_data=(nil) Deregistering messaging pointer for type 1028 - private_data=(nil) Deregistering messaging pointer for type 1027 - private_data=(nil) Deregistering messaging pointer for type 1029 - private_data=(nil) Deregistering messaging pointer for type 1280 - private_data=(nil) Deregistering messaging pointer for type 1033 - private_data=(nil) Deregistering messaging pointer for type 1 - private_data=(nil) Deregistering messaging pointer for type 1036 - private_data=(nil) Deregistering messaging pointer for type 1035 - private_data=(nil) Registering messaging pointer for type 1028 - private_data=(nil) Registering messaging pointer for type 1027 - private_data=(nil) Registering messaging pointer for type 1280 - private_data=(nil) Registering messaging pointer for type 1 - private_data=(nil) Registering messaging pointer for type 1034 - private_data=(nil) Overriding messaging pointer for type 1034 - private_data=(nil) set_domain_online_request: called for domain GER set_domain_online_request: domain GER was globally offline. set_domain_online_request: called for domain GER account_lockout_policy_handler called connection_ok: Connection to (null) for domain GER is not connected Opening cache file at /var/lib/samba/gencache.tdb Opening cache file at /var/lib/samba/gencache_notrans.tdb saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER" domain check_negative_conn_cache returning result 0 for domain GER server IRSGER402.ger.corp.intel.com cm_open_connection: saf_servername is 'IRSGER402.ger.corp.intel.com' for domain GER cm_open_connection: dcname is 'IRSGER402.ger.corp.intel.com' for domain GER check_negative_conn_cache returning result 0 for domain GER server IRSGER402.ger.corp.intel.com sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs Connecting to 10.104.193.75 at port 445 Connecting to 10.104.193.75 at port 139 sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_dc_name: domain=GER sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_find_dc: (cldap) looking for realm 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) name GER.CORP.INTEL.COM#1C found. remove_duplicate_addrs2: looking for duplicate address/port pairs Adding 3 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 Adding cache entry with key=[NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.72] and timeout=[Thu Jan 1 01:00:00 1970 BST] (-1441358750 seconds in the past) check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 3 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 10.104.193.72:389 10.104.193.77:389 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 ads_try_connect: sending CLDAP request to 10.104.193.75 (realm: GER.CORP.INTEL.COM) check_domain_online_handler: called for domain GER (online = False) Registering messaging pointer for type 1030 - private_data=(nil) Registering messaging pointer for type 1031 - private_data=(nil) Deregistering messaging pointer for type 33 - private_data=(nil) Deregistering messaging pointer for type 13 - private_data=(nil) Deregistering messaging pointer for type 1028 - private_data=(nil) Deregistering messaging pointer for type 1027 - private_data=(nil) Deregistering messaging pointer for type 1029 - private_data=(nil) Deregistering messaging pointer for type 1280 - private_data=(nil) Deregistering messaging pointer for type 1033 - private_data=(nil) Deregistering messaging pointer for type 1 - private_data=(nil) Deregistering messaging pointer for type 1036 - private_data=(nil) Deregistering messaging pointer for type 1035 - private_data=(nil) Opening cache file at /var/lib/samba/gencache.tdb Opening cache file at /var/lib/samba/gencache_notrans.tdb sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_dc_name: domain=GER sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_find_dc: (cldap) looking for realm 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) name GER.CORP.INTEL.COM#1C found. remove_duplicate_addrs2: looking for duplicate address/port pairs Adding 3 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 3 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 10.104.193.72:389 10.104.193.77:389 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 ads_try_connect: sending CLDAP request to 10.104.193.75 (realm: GER.CORP.INTEL.COM) ads_cldap_netlogon: did not get a reply ads_try_connect: CLDAP request 10.104.193.75 failed. Adding cache entry with key=[NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.75] and timeout=[Fri Sep 4 10:26:56 2015 BST] (60 seconds ahead) add_failed_connection_entry: added domain GER.CORP.INTEL.COM (10.104.193.75) to failed conn cache check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 ads_try_connect: sending CLDAP request to 10.104.193.72 (realm: GER.CORP.INTEL.COM) ads_cldap_netlogon: did not get a reply ads_try_connect: CLDAP request 10.104.193.75 failed. Did not store value for NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.75, we already got it add_failed_connection_entry: added domain GER.CORP.INTEL.COM (10.104.193.75) to failed conn cache check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 ads_try_connect: sending CLDAP request to 10.104.193.72 (realm: GER.CORP.INTEL.COM) ads_cldap_netlogon: did not get a reply ads_try_connect: CLDAP request 10.104.193.72 failed. Adding cache entry with key=[NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.72] and timeout=[Fri Sep 4 10:27:02 2015 BST] (60 seconds ahead) add_failed_connection_entry: added domain GER.CORP.INTEL.COM (10.104.193.72) to failed conn cache check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 ads_try_connect: sending CLDAP request to 10.104.193.77 (realm: GER.CORP.INTEL.COM) ads_cldap_netlogon: did not get a reply ads_try_connect: CLDAP request 10.104.193.72 failed. Did not store value for NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.72, we already got it add_failed_connection_entry: added domain GER.CORP.INTEL.COM (10.104.193.72) to failed conn cache check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 ads_try_connect: sending CLDAP request to 10.104.193.77 (realm: GER.CORP.INTEL.COM) ads_cldap_netlogon: did not get a reply ads_try_connect: CLDAP request 10.104.193.77 failed. Adding cache entry with key=[NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.77] and timeout=[Fri Sep 4 10:27:08 2015 BST] (60 seconds ahead) add_failed_connection_entry: added domain GER.CORP.INTEL.COM (10.104.193.77) to failed conn cache ads_find_dc: failed to find a valid DC on our site (IR-Ireland), trying to find another DC Deleting cache entry (key=[NBT/GER.CORP.INTEL.COM#1C]) Adding cache entry with key=[NBT/GER.CORP.INTEL.COM#1C] and timeout=[Thu Jan 1 01:00:00 1970 BST] (-1441358768 seconds in the past) ads_find_dc: (cldap) looking for realm 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result -1073741823 for domain GER.CORP.INTEL.COM server 10.104.193.75 get_dc_list: negative entry IRSGER402.ger.corp.intel.com removed from DC list remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 0 ip addresses in an ordered list get_dc_list: ads_find_dc: (cldap) looking for domain 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER.CORP.INTEL.COM<0x1c> E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccae30] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cccc50] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccea70] mpx_fde[(nil)] fd[28] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cd1070] mpx_fde[(nil)] fd[29] - disabling Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result -1073741823 for domain GER.CORP.INTEL.COM server 10.104.193.75 get_dc_list: negative entry IRSGER402.ger.corp.intel.com removed from DC list remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 0 ip addresses in an unordered list get_dc_list: get_sorted_dc_list: attempting lookup for name GER (sitename NULL) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER#1c (sitename (null)) no entry for GER#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER<0x1c> bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccab10] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc930] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cce750] mpx_fde[(nil)] fd[28] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cd0d50] mpx_fde[(nil)] fd[29] - disabling Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result 0 for domain GER server 10.104.193.75 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 1 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 name_status_find: looking up GER#1c at 10.104.193.75 namecache_status_fetch: no entry for NBT/GER#1C.20.10.104.193.75 found. bind succeeded on port 0 async_connect failed: No such file or directory nmbd not around ads_cldap_netlogon: did not get a reply ads_try_connect: CLDAP request 10.104.193.77 failed. Did not store value for NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.77, we already got it add_failed_connection_entry: added domain GER.CORP.INTEL.COM (10.104.193.77) to failed conn cache ads_find_dc: failed to find a valid DC on our site (IR-Ireland), trying to find another DC Deleting cache entry (key=[NBT/GER.CORP.INTEL.COM#1C]) ads_find_dc: (cldap) looking for realm 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result -1073741823 for domain GER.CORP.INTEL.COM server 10.104.193.75 get_dc_list: negative entry IRSGER402.ger.corp.intel.com removed from DC list remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 0 ip addresses in an ordered list get_dc_list: ads_find_dc: (cldap) looking for domain 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER.CORP.INTEL.COM<0x1c> E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccacd0] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cccaf0] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cce910] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cd0f10] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result -1073741823 for domain GER.CORP.INTEL.COM server 10.104.193.75 get_dc_list: negative entry IRSGER402.ger.corp.intel.com removed from DC list remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 0 ip addresses in an unordered list get_dc_list: get_sorted_dc_list: attempting lookup for name GER (sitename NULL) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER#1c (sitename (null)) no entry for GER#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER<0x1c> bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccacd0] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cccaf0] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cce910] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cd0f10] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result 0 for domain GER server 10.104.193.75 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 1 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 name_status_find: looking up GER#1c at 10.104.193.75 namecache_status_fetch: no entry for NBT/GER#1C.20.10.104.193.75 found. bind succeeded on port 0 async_connect failed: No such file or directory nmbd not around name_status_find: name not found sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.IR-Ireland._sites.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result -1073741823 for domain GER.CORP.INTEL.COM server 10.104.193.75 get_dc_list: negative entry IRSGER402.ger.corp.intel.com removed from DC list remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 0 ip addresses in an ordered list get_dc_list: get_sorted_dc_list: no server for name GER.CORP.INTEL.COM available in site IR-Ireland, fallback to all servers saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result -1073741823 for domain GER.CORP.INTEL.COM server 10.104.193.75 get_dc_list: negative entry IRSGER402.ger.corp.intel.com removed from DC list remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 0 ip addresses in an ordered list get_dc_list: get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result -1073741823 for domain GER.CORP.INTEL.COM server 10.104.193.75 get_dc_list: negative entry IRSGER402.ger.corp.intel.com removed from DC list remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 0 ip addresses in an ordered list get_dc_list: get_sorted_dc_list: attempting lookup for name GER (sitename NULL) saf_fetch: Returning "IRSGER402.ger.corp.intel.com" for "GER" domain get_dc_list: preferred server list: "IRSGER402.ger.corp.intel.com, *" internal_resolve_name: looking up GER#1c (sitename (null)) no entry for GER#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER<0x1c> bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccab10] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc930] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cce750] mpx_fde[(nil)] fd[28] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cd0d50] mpx_fde[(nil)] fd[29] - disabling Adding 0 DC's from auto lookup sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" internal_resolve_name: looking up IRSGER402.ger.corp.intel.com#20 (sitename IR-Ireland) name IRSGER402.ger.corp.intel.com#20 found. remove_duplicate_addrs2: looking for duplicate address/port pairs check_negative_conn_cache returning result 0 for domain GER server 10.104.193.75 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 1 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.75 Connecting to 10.104.193.75 at port 445 Connecting to 10.104.193.75 at port 139 find_new_dc: smbsock_any_connect failed for domain GER address 10.104.193.75. Error was NT_STATUS_NETWORK_UNREACHABLE Adding cache entry with key=[NEG_CONN_CACHE/GER,10.104.193.75] and timeout=[Fri Sep 4 10:27:21 2015 BST] (60 seconds ahead) add_failed_connection_entry: added domain GER (10.104.193.75) to failed conn cache Deleting cache entry (key=[SAFJOIN/DOMAIN/GER]) Deleting cache entry (key=[SAF/DOMAIN/GER]) Adding cache entry with key=[SAF/DOMAIN/GER] and timeout=[Thu Jan 1 01:00:00 1970 BST] (-1441358781 seconds in the past) saf_delete: domain = [GER] Adding cache entry with key=[NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.75] and timeout=[Fri Sep 4 10:27:21 2015 BST] (60 seconds ahead) add_failed_connection_entry: added domain GER.CORP.INTEL.COM (10.104.193.75) to failed conn cache Deleting cache entry (key=[SAFJOIN/DOMAIN/GER.CORP.INTEL.COM]) Deleting cache entry (key=[SAF/DOMAIN/GER.CORP.INTEL.COM]) Adding cache entry with key=[SAF/DOMAIN/GER.CORP.INTEL.COM] and timeout=[Thu Jan 1 01:00:00 1970 BST] (-1441358781 seconds in the past) saf_delete: domain = [GER.CORP.INTEL.COM] set_global_winbindd_state_offline: offline requested. set_global_winbindd_state_offline: offline state set. set_domain_offline: called for domain GER set_domain_offline: domain GER remaining globally offline get_cache: Setting MS-RPC methods for domain GER centry_expired: Key LOC_POL/GER for domain GER valid as winbindd is globally offline. wcache_fetch: returning entry LOC_POL/GER for domain GER lockout_policy: [Cached] - cached info for domain GER status: NT_STATUS_OK fork_domain_child: domain GER no longer in 'startup' mode. child daemon request 51 child_process_request: request fn INIT_CONNECTION Finished processing child request 51 Writing 3496 bytes to parent child daemon request 20 child_process_request: request fn LIST_TRUSTDOM [98302]: list trusted domains Finished processing child request 20 Writing 3562 bytes to parent name_status_find: name not found sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.IR-Ireland._sites.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: no server for name GER.CORP.INTEL.COM available in site IR-Ireland, fallback to all servers saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER (sitename NULL) saf_fetch: failed to find server for "GER" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER#1c (sitename (null)) no entry for GER#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER<0x1c> bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cca9b0] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc7d0] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cce5f0] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cd0bf0] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found messaging_dgm_send: Sending message to 98302 messaging_recv_cb: Received message 0x407 len 4 (num_fds:0) from 98306 msg_fail_to_go_online: received for domain GER. set_domain_offline: called for domain GER set_domain_offline: added event handler for domain GER messaging_dgm_send: Sending message to 98277 Already reaped child 98306 died check_domain_online_handler: called for domain GER (online = False) check_domain_online_handler: domain GER no longer in 'startup' mode. Registering messaging pointer for type 1030 - private_data=(nil) Overriding messaging pointer for type 1030 - private_data=(nil) Registering messaging pointer for type 1031 - private_data=(nil) Overriding messaging pointer for type 1031 - private_data=(nil) Deregistering messaging pointer for type 33 - private_data=(nil) Deregistering messaging pointer for type 13 - private_data=(nil) Deregistering messaging pointer for type 1028 - private_data=(nil) Deregistering messaging pointer for type 1027 - private_data=(nil) Deregistering messaging pointer for type 1029 - private_data=(nil) Deregistering messaging pointer for type 1280 - private_data=(nil) Deregistering messaging pointer for type 1033 - private_data=(nil) Deregistering messaging pointer for type 1 - private_data=(nil) Deregistering messaging pointer for type 1036 - private_data=(nil) Deregistering messaging pointer for type 1035 - private_data=(nil) Opening cache file at /var/lib/samba/gencache.tdb Opening cache file at /var/lib/samba/gencache_notrans.tdb sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_dc_name: domain=GER sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_find_dc: (cldap) looking for realm 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.IR-Ireland._sites.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: no server for name GER.CORP.INTEL.COM available in site IR-Ireland, fallback to all servers saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found ads_find_dc: (cldap) looking for domain 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) no entry for GER.CORP.INTEL.COM#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER.CORP.INTEL.COM<0x1c> E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc8db0] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccabd0] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc9f0] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cceff0] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: no server for name GER.CORP.INTEL.COM available in site IR-Ireland, fallback to all servers saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER.CORP.INTEL.COM<0x1c> E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc8c60] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccaa80] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc8a0] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cceea0] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER (sitename NULL) saf_fetch: failed to find server for "GER" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER#1c (sitename (null)) no entry for GER#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER<0x1c> bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc8c60] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccaa80] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc8a0] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cceea0] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup get_dc_list: no servers found Could not look up dc's for domain GER sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.IR-Ireland._sites.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: no server for name GER.CORP.INTEL.COM available in site IR-Ireland, fallback to all servers saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER (sitename NULL) saf_fetch: failed to find server for "GER" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER#1c (sitename (null)) no entry for GER#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER<0x1c> bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc8c60] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccaa80] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc8a0] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cceea0] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found messaging_dgm_send: Sending message to 98302 messaging_recv_cb: Received message 0x407 len 4 (num_fds:0) from 98373 msg_fail_to_go_online: received for domain GER. set_domain_offline: called for domain GER set_domain_offline: added event handler for domain GER messaging_dgm_send: Sending message to 98277 Already reaped child 98373 died check_domain_online_handler: called for domain GER (online = False) Registering messaging pointer for type 1030 - private_data=(nil) Overriding messaging pointer for type 1030 - private_data=(nil) Registering messaging pointer for type 1031 - private_data=(nil) Overriding messaging pointer for type 1031 - private_data=(nil) Deregistering messaging pointer for type 33 - private_data=(nil) Deregistering messaging pointer for type 13 - private_data=(nil) Deregistering messaging pointer for type 1028 - private_data=(nil) Deregistering messaging pointer for type 1027 - private_data=(nil) Deregistering messaging pointer for type 1029 - private_data=(nil) Deregistering messaging pointer for type 1280 - private_data=(nil) Deregistering messaging pointer for type 1033 - private_data=(nil) Deregistering messaging pointer for type 1 - private_data=(nil) Deregistering messaging pointer for type 1036 - private_data=(nil) Deregistering messaging pointer for type 1035 - private_data=(nil) Opening cache file at /var/lib/samba/gencache.tdb Opening cache file at /var/lib/samba/gencache_notrans.tdb sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_dc_name: domain=GER sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_find_dc: (cldap) looking for realm 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.IR-Ireland._sites.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: no server for name GER.CORP.INTEL.COM available in site IR-Ireland, fallback to all servers saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found ads_find_dc: (cldap) looking for domain 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) no entry for GER.CORP.INTEL.COM#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER.CORP.INTEL.COM<0x1c> E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc8da0] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccabc0] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc9e0] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccefe0] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: no server for name GER.CORP.INTEL.COM available in site IR-Ireland, fallback to all servers saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER.CORP.INTEL.COM<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER.CORP.INTEL.COM<0x1c> E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around E2BIG: convert_string(UTF-8,CP850): srclen=19 destlen=16 - 'GER.CORP.INTEL.COM' bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc8c50] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccaa70] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc890] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccee90] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER (sitename NULL) saf_fetch: failed to find server for "GER" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER#1c (sitename (null)) no entry for GER#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER<0x1c> bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc8c50] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccaa70] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc890] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccee90] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup get_dc_list: no servers found Could not look up dc's for domain GER sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.IR-Ireland._sites.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: no server for name GER.CORP.INTEL.COM available in site IR-Ireland, fallback to all servers saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER (sitename NULL) saf_fetch: failed to find server for "GER" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER#1c (sitename (null)) no entry for GER#1C found. resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> resolve_lmhosts: Attempting lmhosts lookup for name GER<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: not appropriate for name type <0x1c> name_resolve_bcast: Attempting broadcast lookup for name GER<0x1c> bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around bind succeeded on port 0 Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 1 SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. Could not test socket option TCP_KEEPCNT. Could not test socket option TCP_KEEPIDLE. Could not test socket option TCP_KEEPINTVL. IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_REUSEPORT = 1 SO_SNDBUF = 212992 SO_RCVBUF = 212992 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 Could not test socket option TCP_QUICKACK. Could not test socket option TCP_DEFER_ACCEPT. async_connect failed: No such file or directory nmbd not around samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc8c50] mpx_fde[(nil)] fd[25] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccaa70] mpx_fde[(nil)] fd[26] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccc890] mpx_fde[(nil)] fd[27] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccee90] mpx_fde[(nil)] fd[28] - disabling Adding 0 DC's from auto lookup get_dc_list: no servers found get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS dns_send_req: Failed to resolve _ldap._tcp.dc._msdcs.GER.CORP.INTEL.COM (Success) ads_dns_lookup_srv: Failed to send DNS query (NT_STATUS_UNSUCCESSFUL) Adding 0 DC's from auto lookup get_dc_list: no servers found messaging_dgm_send: Sending message to 98302 messaging_recv_cb: Received message 0x407 len 4 (num_fds:0) from 98414 msg_fail_to_go_online: received for domain GER. set_domain_offline: called for domain GER set_domain_offline: added event handler for domain GER messaging_dgm_send: Sending message to 98277 Already reaped child 98414 died accepted socket 23 process_request: request fn INTERFACE_VERSION [98471]: request interface version (version = 27) winbind_client_response_written[98471:INTERFACE_VERSION]: delivered response to client process_request: request fn WINBINDD_PRIV_PIPE_DIR [98471]: request location of privileged pipe winbind_client_response_written[98471:WINBINDD_PRIV_PIPE_DIR]: delivered response to client process_request: Handling async request 98471:PAM_AUTH [98471]: pam auth dwoodhou child daemon request 13 child_process_request: request fn PAM_AUTH [98302]: dual pam auth GER\dwoodhou winbindd_dual_pam_auth: domain: GER last was offline winbindd_dual_pam_auth_cached centry_expired: Key NS/GER/DWOODHOU for domain GER valid as winbindd is globally offline. wcache_fetch: returning entry NS/GER/DWOODHOU for domain GER name_to_sid: [Cached] - cached name for domain GER status: NT_STATUS_OK centry_expired: Key CRED/S-1-5-21-2052111302-1275210071-1644491937-279532 for domain GER valid as winbindd is globally offline. wcache_fetch: returning entry CRED/S-1-5-21-2052111302-1275210071-1644491937-279532 for domain GER wcache_get_creds: [Cached] - cached creds for user S-1-5-21-2052111302-1275210071-1644491937-279532 status: NT_STATUS_OK netsamlogon_cache_get: SID [S-1-5-21-2052111302-1275210071-1644491937-279532] &r: struct netsamlogoncache_entry timestamp : Fri Sep 4 10:25:14 2015 BST info3: struct netr_SamInfo3 base: struct netr_SamBaseInfo logon_time : Fri Sep 4 10:25:13 2015 BST logoff_time : Thu Sep 14 03:48:05 30828 BST kickoff_time : Thu Sep 14 03:48:05 30828 BST last_password_change : Tue Jul 7 12:11:37 2015 BST allow_password_change : Tue Jul 7 12:11:37 2015 BST force_password_change : Mon Oct 5 12:11:37 2015 BST account_name: struct lsa_String length : 0x0010 (16) size : 0x0010 (16) string : * string : 'dwoodhou' full_name: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'Woodhouse, David' logon_script: struct lsa_String length : 0x0012 (18) size : 0x0012 (18) string : * string : 'logon.bat' profile_path: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_directory: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_drive: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' logon_count : 0x0203 (515) bad_password_count : 0x0000 (0) rid : 0x000443ec (279532) primary_gid : 0x00000201 (513) groups: struct samr_RidWithAttributeArray count : 0x0000000b (11) rids : * rids: ARRAY(11) rids: struct samr_RidWithAttribute rid : 0x00000201 (513) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0008aee7 (569063) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0009a9f5 (633333) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0002fe8e (196238) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000298ad (170157) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00096b33 (617267) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000497d9 (301017) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00062c74 (404596) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0001cb24 (117540) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00063a5b (408155) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000549d6 (346582) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) user_flags : 0x00000024 (36) 0: NETLOGON_GUEST 0: NETLOGON_NOENCRYPTION 1: NETLOGON_CACHED_ACCOUNT 0: NETLOGON_USED_LM_PASSWORD 1: NETLOGON_EXTRA_SIDS 0: NETLOGON_SUBAUTH_SESSION_KEY 0: NETLOGON_SERVER_TRUST_ACCOUNT 0: NETLOGON_NTLMV2_ENABLED 0: NETLOGON_RESOURCE_GROUPS 0: NETLOGON_PROFILE_PATH_RETURNED 0: NETLOGON_GRACE_LOGON key: struct netr_UserSessionKey key : 00000000000000000000000000000000 logon_server: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'IRSGER402' logon_domain: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'GER' domain_sid : * domain_sid : S-1-5-21-2052111302-1275210071-1644491937 LMSessKey: struct netr_LMSessionKey key : 0000000000000000 acct_flags : 0x00000010 (16) 0: ACB_DISABLED 0: ACB_HOMDIRREQ 0: ACB_PWNOTREQ 0: ACB_TEMPDUP 1: ACB_NORMAL 0: ACB_MNS 0: ACB_DOMTRUST 0: ACB_WSTRUST 0: ACB_SVRTRUST 0: ACB_PWNOEXP 0: ACB_AUTOLOCK 0: ACB_ENC_TXT_PWD_ALLOWED 0: ACB_SMARTCARD_REQUIRED 0: ACB_TRUSTED_FOR_DELEGATION 0: ACB_NOT_DELEGATED 0: ACB_USE_DES_KEY_ONLY 0: ACB_DONT_REQUIRE_PREAUTH 0: ACB_PW_EXPIRED 0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION 0: ACB_NO_AUTH_DATA_REQD 0: ACB_PARTIAL_SECRETS_ACCOUNT 0: ACB_USE_AES_KEYS sub_auth_status : 0x00000000 (0) last_successful_logon : NTTIME(0) last_failed_logon : NTTIME(0) failed_logon_count : 0x00000000 (0) reserved : 0x00000000 (0) sidcount : 0x00000044 (68) sids : * sids: ARRAY(68) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-3050236 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2403581 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924259 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-44669 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2620541 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2717936 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5346 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2506613 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381315 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1993781 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2718125 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-1757981266-725345543-1404487317-124700 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308934 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-632733 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-710385 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-938523 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-389586 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308935 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-971119 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1163455 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2360597 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-2750 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381303 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5273 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2297010 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1235048 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-6424 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2304480 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1048331 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1150207 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2379415 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-921311 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1539736 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2535322 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-876174 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2371110 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-18345 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2788958 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2629228 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2479093 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2257863 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-537526 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2296849 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2571102 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2309097 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-719732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924260 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2755522 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2848078 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1715732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2628756 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1654171 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-411987 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2619776 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1422688 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-12124 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-412953 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2016132 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2612803 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2464652 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-55165 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2650967 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2485486 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2762591 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1330665 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2411815 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-105273194-1791699089-474703532-513 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-18-1 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) wcache_tdc_fetch_domain: Searching for domain GER wcache_tdc_fetch_domain: Found domain GER using ccache: FILE:/tmp/krb5cc_500 add_ccache_to_list: added krb5_ticket handler add_ccache_to_list: added ccache [FILE:/tmp/krb5cc_500] for user [GER\dwoodhou] to the list winbindd_add_memory_creds_internal: added entry for user GER\dwoodhou winbindd_add_memory_creds returned: NT_STATUS_OK wcache_save_creds: S-1-5-21-2052111302-1275210071-1644491937-279532 netsamlogon_cache_store: SID [S-1-5-21-2052111302-1275210071-1644491937-279532] &r: struct netsamlogoncache_entry timestamp : Fri Sep 4 10:27:26 2015 BST info3: struct netr_SamInfo3 base: struct netr_SamBaseInfo logon_time : Fri Sep 4 10:27:26 2015 BST logoff_time : Thu Sep 14 03:48:05 30828 BST kickoff_time : Thu Sep 14 03:48:05 30828 BST last_password_change : Tue Jul 7 12:11:37 2015 BST allow_password_change : Tue Jul 7 12:11:37 2015 BST force_password_change : Mon Oct 5 12:11:37 2015 BST account_name: struct lsa_String length : 0x0010 (16) size : 0x0010 (16) string : * string : 'dwoodhou' full_name: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'Woodhouse, David' logon_script: struct lsa_String length : 0x0012 (18) size : 0x0012 (18) string : * string : 'logon.bat' profile_path: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_directory: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_drive: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' logon_count : 0x0203 (515) bad_password_count : 0x0000 (0) rid : 0x000443ec (279532) primary_gid : 0x00000201 (513) groups: struct samr_RidWithAttributeArray count : 0x0000000b (11) rids : * rids: ARRAY(11) rids: struct samr_RidWithAttribute rid : 0x00000201 (513) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0008aee7 (569063) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0009a9f5 (633333) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0002fe8e (196238) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000298ad (170157) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00096b33 (617267) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000497d9 (301017) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00062c74 (404596) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0001cb24 (117540) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00063a5b (408155) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000549d6 (346582) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) user_flags : 0x00000024 (36) 0: NETLOGON_GUEST 0: NETLOGON_NOENCRYPTION 1: NETLOGON_CACHED_ACCOUNT 0: NETLOGON_USED_LM_PASSWORD 1: NETLOGON_EXTRA_SIDS 0: NETLOGON_SUBAUTH_SESSION_KEY 0: NETLOGON_SERVER_TRUST_ACCOUNT 0: NETLOGON_NTLMV2_ENABLED 0: NETLOGON_RESOURCE_GROUPS 0: NETLOGON_PROFILE_PATH_RETURNED 0: NETLOGON_GRACE_LOGON key: struct netr_UserSessionKey key : 00000000000000000000000000000000 logon_server: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'IRSGER402' logon_domain: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'GER' domain_sid : * domain_sid : S-1-5-21-2052111302-1275210071-1644491937 LMSessKey: struct netr_LMSessionKey key : 0000000000000000 acct_flags : 0x00000010 (16) 0: ACB_DISABLED 0: ACB_HOMDIRREQ 0: ACB_PWNOTREQ 0: ACB_TEMPDUP 1: ACB_NORMAL 0: ACB_MNS 0: ACB_DOMTRUST 0: ACB_WSTRUST 0: ACB_SVRTRUST 0: ACB_PWNOEXP 0: ACB_AUTOLOCK 0: ACB_ENC_TXT_PWD_ALLOWED 0: ACB_SMARTCARD_REQUIRED 0: ACB_TRUSTED_FOR_DELEGATION 0: ACB_NOT_DELEGATED 0: ACB_USE_DES_KEY_ONLY 0: ACB_DONT_REQUIRE_PREAUTH 0: ACB_PW_EXPIRED 0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION 0: ACB_NO_AUTH_DATA_REQD 0: ACB_PARTIAL_SECRETS_ACCOUNT 0: ACB_USE_AES_KEYS sub_auth_status : 0x00000000 (0) last_successful_logon : NTTIME(0) last_failed_logon : NTTIME(0) failed_logon_count : 0x00000000 (0) reserved : 0x00000000 (0) sidcount : 0x00000044 (68) sids : * sids: ARRAY(68) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-3050236 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2403581 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924259 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-44669 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2620541 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2717936 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5346 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2506613 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381315 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1993781 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2718125 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-1757981266-725345543-1404487317-124700 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308934 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-632733 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-710385 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-938523 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-389586 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308935 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-971119 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1163455 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2360597 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-2750 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381303 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5273 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2297010 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1235048 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-6424 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2304480 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1048331 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1150207 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2379415 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-921311 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1539736 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2535322 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-876174 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2371110 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-18345 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2788958 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2629228 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2479093 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2257863 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-537526 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2296849 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2571102 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2309097 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-719732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924260 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2755522 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2848078 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1715732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2628756 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1654171 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-411987 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2619776 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1422688 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-12124 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-412953 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2016132 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2612803 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2464652 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-55165 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2650967 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2485486 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2762591 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1330665 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2411815 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-105273194-1791699089-474703532-513 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-18-1 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) winbindd_dual_pam_auth_cached succeeded netsamlogon_cache_store: SID [S-1-5-21-2052111302-1275210071-1644491937-279532] &r: struct netsamlogoncache_entry timestamp : Fri Sep 4 10:27:26 2015 BST info3: struct netr_SamInfo3 base: struct netr_SamBaseInfo logon_time : Fri Sep 4 10:27:26 2015 BST logoff_time : Thu Sep 14 03:48:05 30828 BST kickoff_time : Thu Sep 14 03:48:05 30828 BST last_password_change : Tue Jul 7 12:11:37 2015 BST allow_password_change : Tue Jul 7 12:11:37 2015 BST force_password_change : Mon Oct 5 12:11:37 2015 BST account_name: struct lsa_String length : 0x0010 (16) size : 0x0010 (16) string : * string : 'dwoodhou' full_name: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'Woodhouse, David' logon_script: struct lsa_String length : 0x0012 (18) size : 0x0012 (18) string : * string : 'logon.bat' profile_path: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_directory: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_drive: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' logon_count : 0x0203 (515) bad_password_count : 0x0000 (0) rid : 0x000443ec (279532) primary_gid : 0x00000201 (513) groups: struct samr_RidWithAttributeArray count : 0x0000000b (11) rids : * rids: ARRAY(11) rids: struct samr_RidWithAttribute rid : 0x00000201 (513) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0008aee7 (569063) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0009a9f5 (633333) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0002fe8e (196238) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000298ad (170157) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00096b33 (617267) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000497d9 (301017) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00062c74 (404596) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0001cb24 (117540) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00063a5b (408155) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000549d6 (346582) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) user_flags : 0x00000024 (36) 0: NETLOGON_GUEST 0: NETLOGON_NOENCRYPTION 1: NETLOGON_CACHED_ACCOUNT 0: NETLOGON_USED_LM_PASSWORD 1: NETLOGON_EXTRA_SIDS 0: NETLOGON_SUBAUTH_SESSION_KEY 0: NETLOGON_SERVER_TRUST_ACCOUNT 0: NETLOGON_NTLMV2_ENABLED 0: NETLOGON_RESOURCE_GROUPS 0: NETLOGON_PROFILE_PATH_RETURNED 0: NETLOGON_GRACE_LOGON key: struct netr_UserSessionKey key : 00000000000000000000000000000000 logon_server: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'IRSGER402' logon_domain: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'GER' domain_sid : * domain_sid : S-1-5-21-2052111302-1275210071-1644491937 LMSessKey: struct netr_LMSessionKey key : 0000000000000000 acct_flags : 0x00000010 (16) 0: ACB_DISABLED 0: ACB_HOMDIRREQ 0: ACB_PWNOTREQ 0: ACB_TEMPDUP 1: ACB_NORMAL 0: ACB_MNS 0: ACB_DOMTRUST 0: ACB_WSTRUST 0: ACB_SVRTRUST 0: ACB_PWNOEXP 0: ACB_AUTOLOCK 0: ACB_ENC_TXT_PWD_ALLOWED 0: ACB_SMARTCARD_REQUIRED 0: ACB_TRUSTED_FOR_DELEGATION 0: ACB_NOT_DELEGATED 0: ACB_USE_DES_KEY_ONLY 0: ACB_DONT_REQUIRE_PREAUTH 0: ACB_PW_EXPIRED 0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION 0: ACB_NO_AUTH_DATA_REQD 0: ACB_PARTIAL_SECRETS_ACCOUNT 0: ACB_USE_AES_KEYS sub_auth_status : 0x00000000 (0) last_successful_logon : NTTIME(0) last_failed_logon : NTTIME(0) failed_logon_count : 0x00000000 (0) reserved : 0x00000000 (0) sidcount : 0x00000044 (68) sids : * sids: ARRAY(68) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-3050236 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2403581 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924259 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-44669 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2620541 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2717936 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5346 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2506613 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381315 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1993781 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2718125 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-1757981266-725345543-1404487317-124700 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308934 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-632733 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-710385 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-938523 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-389586 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308935 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-971119 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1163455 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2360597 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-2750 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381303 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5273 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2297010 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1235048 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-6424 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2304480 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1048331 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1150207 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2379415 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-921311 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1539736 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2535322 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-876174 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2371110 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-18345 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2788958 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2629228 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2479093 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2257863 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-537526 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2296849 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2571102 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2309097 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-719732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924260 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2755522 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2848078 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1715732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2628756 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1654171 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-411987 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2619776 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1422688 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-12124 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-412953 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2016132 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2612803 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2464652 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-55165 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2650967 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2485486 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2762591 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1330665 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2411815 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-105273194-1791699089-474703532-513 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-18-1 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) wcache_save_name_to_sid: GER\DWOODHOU -> S-1-5-21-2052111302-1275210071-1644491937-279532 (NT_STATUS_OK) wcache_save_creds: S-1-5-21-2052111302-1275210071-1644491937-279532 netsamlogon_cache_store: SID [S-1-5-21-2052111302-1275210071-1644491937-279532] &r: struct netsamlogoncache_entry timestamp : Fri Sep 4 10:27:26 2015 BST info3: struct netr_SamInfo3 base: struct netr_SamBaseInfo logon_time : Fri Sep 4 10:27:26 2015 BST logoff_time : Thu Sep 14 03:48:05 30828 BST kickoff_time : Thu Sep 14 03:48:05 30828 BST last_password_change : Tue Jul 7 12:11:37 2015 BST allow_password_change : Tue Jul 7 12:11:37 2015 BST force_password_change : Mon Oct 5 12:11:37 2015 BST account_name: struct lsa_String length : 0x0010 (16) size : 0x0010 (16) string : * string : 'dwoodhou' full_name: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'Woodhouse, David' logon_script: struct lsa_String length : 0x0012 (18) size : 0x0012 (18) string : * string : 'logon.bat' profile_path: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_directory: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_drive: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' logon_count : 0x0203 (515) bad_password_count : 0x0000 (0) rid : 0x000443ec (279532) primary_gid : 0x00000201 (513) groups: struct samr_RidWithAttributeArray count : 0x0000000b (11) rids : * rids: ARRAY(11) rids: struct samr_RidWithAttribute rid : 0x00000201 (513) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0008aee7 (569063) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0009a9f5 (633333) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0002fe8e (196238) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000298ad (170157) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00096b33 (617267) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000497d9 (301017) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00062c74 (404596) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0001cb24 (117540) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00063a5b (408155) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000549d6 (346582) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) user_flags : 0x00000024 (36) 0: NETLOGON_GUEST 0: NETLOGON_NOENCRYPTION 1: NETLOGON_CACHED_ACCOUNT 0: NETLOGON_USED_LM_PASSWORD 1: NETLOGON_EXTRA_SIDS 0: NETLOGON_SUBAUTH_SESSION_KEY 0: NETLOGON_SERVER_TRUST_ACCOUNT 0: NETLOGON_NTLMV2_ENABLED 0: NETLOGON_RESOURCE_GROUPS 0: NETLOGON_PROFILE_PATH_RETURNED 0: NETLOGON_GRACE_LOGON key: struct netr_UserSessionKey key : 00000000000000000000000000000000 logon_server: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'IRSGER402' logon_domain: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'GER' domain_sid : * domain_sid : S-1-5-21-2052111302-1275210071-1644491937 LMSessKey: struct netr_LMSessionKey key : 0000000000000000 acct_flags : 0x00000010 (16) 0: ACB_DISABLED 0: ACB_HOMDIRREQ 0: ACB_PWNOTREQ 0: ACB_TEMPDUP 1: ACB_NORMAL 0: ACB_MNS 0: ACB_DOMTRUST 0: ACB_WSTRUST 0: ACB_SVRTRUST 0: ACB_PWNOEXP 0: ACB_AUTOLOCK 0: ACB_ENC_TXT_PWD_ALLOWED 0: ACB_SMARTCARD_REQUIRED 0: ACB_TRUSTED_FOR_DELEGATION 0: ACB_NOT_DELEGATED 0: ACB_USE_DES_KEY_ONLY 0: ACB_DONT_REQUIRE_PREAUTH 0: ACB_PW_EXPIRED 0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION 0: ACB_NO_AUTH_DATA_REQD 0: ACB_PARTIAL_SECRETS_ACCOUNT 0: ACB_USE_AES_KEYS sub_auth_status : 0x00000000 (0) last_successful_logon : NTTIME(0) last_failed_logon : NTTIME(0) failed_logon_count : 0x00000000 (0) reserved : 0x00000000 (0) sidcount : 0x00000044 (68) sids : * sids: ARRAY(68) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-3050236 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2403581 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924259 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-44669 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2620541 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2717936 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5346 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2506613 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381315 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1993781 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2718125 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-1757981266-725345543-1404487317-124700 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308934 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-632733 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-710385 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-938523 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-389586 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308935 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-971119 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1163455 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2360597 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-2750 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381303 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5273 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2297010 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1235048 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-6424 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2304480 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1048331 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1150207 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2379415 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-921311 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1539736 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2535322 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-876174 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2371110 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-18345 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2788958 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2629228 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2479093 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2257863 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-537526 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2296849 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2571102 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2309097 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-719732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924260 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2755522 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2848078 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1715732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2628756 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1654171 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-411987 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2619776 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1422688 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-12124 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-412953 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2016132 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2612803 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2464652 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-55165 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2650967 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2485486 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2762591 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1330665 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2411815 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-105273194-1791699089-474703532-513 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-18-1 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) Plain-text authentication for user GER\dwoodhou returned NT_STATUS_OK (PAM: 0) Finished processing child request 13 Writing 7620 bytes to parent winbindd_add_memory_creds_internal: added entry for user GER\dwoodhou winbindd_add_memory_creds returned: NT_STATUS_OK wb_request_done[98471:PAM_AUTH]: NT_STATUS_OK winbind_client_response_written[98471:PAM_AUTH]: delivered response to client closing socket 23, client exited accepted socket 23 process_request: request fn INTERFACE_VERSION [98585]: request interface version (version = 27) winbind_client_response_written[98585:INTERFACE_VERSION]: delivered response to client process_request: request fn WINBINDD_PRIV_PIPE_DIR [98585]: request location of privileged pipe winbind_client_response_written[98585:WINBINDD_PRIV_PIPE_DIR]: delivered response to client accepted socket 25 closing socket 23, client exited process_request: Handling async request 98585:DSGETDCNAME [98585]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) fork_domain_child called without domain. Child process 98586 Deregistering messaging pointer for type 33 - private_data=(nil) Deregistering messaging pointer for type 13 - private_data=(nil) Deregistering messaging pointer for type 1028 - private_data=(nil) Deregistering messaging pointer for type 1027 - private_data=(nil) Deregistering messaging pointer for type 1029 - private_data=(nil) Deregistering messaging pointer for type 1280 - private_data=(nil) Deregistering messaging pointer for type 1033 - private_data=(nil) Deregistering messaging pointer for type 1 - private_data=(nil) Deregistering messaging pointer for type 1036 - private_data=(nil) Deregistering messaging pointer for type 1035 - private_data=(nil) Registering messaging pointer for type 1028 - private_data=(nil) Registering messaging pointer for type 1027 - private_data=(nil) Registering messaging pointer for type 1280 - private_data=(nil) Registering messaging pointer for type 1 - private_data=(nil) Registering messaging pointer for type 1034 - private_data=(nil) Overriding messaging pointer for type 1034 - private_data=(nil) Need to read 60 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) Opening cache file at /var/lib/samba/gencache.tdb Opening cache file at /var/lib/samba/gencache_notrans.tdb sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98585:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98585:DSGETDCNAME]: delivered response to client process_request: Handling async request 98585:DSGETDCNAME [98585]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) Need to read 60 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98585:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98585:DSGETDCNAME]: delivered response to client process_request: Handling async request 98585:DSGETDCNAME [98585]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) Need to read 60 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98585:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98585:DSGETDCNAME]: delivered response to client process_request: Handling async request 98585:DSGETDCNAME [98585]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) Need to read 60 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98585:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98585:DSGETDCNAME]: delivered response to client process_request: Handling async request 98585:DSGETDCNAME [98585]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) Need to read 60 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98585:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98585:DSGETDCNAME]: delivered response to client process_request: Handling async request 98585:DSGETDCNAME [98585]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) Need to read 60 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98585:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98585:DSGETDCNAME]: delivered response to client process_request: Handling async request 98585:DSGETDCNAME [98585]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) Need to read 60 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98585:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98585:DSGETDCNAME]: delivered response to client process_request: Handling async request 98585:DSGETDCNAME [98585]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) Need to read 60 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98585:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98585:DSGETDCNAME]: delivered response to client closing socket 25, client exited check_domain_online_handler: called for domain GER (online = False) Registering messaging pointer for type 1030 - private_data=(nil) Overriding messaging pointer for type 1030 - private_data=(nil) Registering messaging pointer for type 1031 - private_data=(nil) Overriding messaging pointer for type 1031 - private_data=(nil) Deregistering messaging pointer for type 33 - private_data=(nil) Deregistering messaging pointer for type 13 - private_data=(nil) Deregistering messaging pointer for type 1028 - private_data=(nil) Deregistering messaging pointer for type 1027 - private_data=(nil) Deregistering messaging pointer for type 1029 - private_data=(nil) Deregistering messaging pointer for type 1280 - private_data=(nil) Deregistering messaging pointer for type 1033 - private_data=(nil) Deregistering messaging pointer for type 1 - private_data=(nil) Deregistering messaging pointer for type 1036 - private_data=(nil) Deregistering messaging pointer for type 1035 - private_data=(nil) Opening cache file at /var/lib/samba/gencache.tdb Opening cache file at /var/lib/samba/gencache_notrans.tdb sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_dc_name: domain=GER sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_find_dc: (cldap) looking for realm 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) no entry for GER.CORP.INTEL.COM#1C found. resolve_ads: Attempting to resolve DCs for GER.CORP.INTEL.COM using DNS ads_dns_lookup_srv: 3 records returned in the answer section. ads_dns_parse_rr_srv: Parsed irsger402.ger.corp.intel.com [10, 100, 389] ads_dns_parse_rr_srv: Parsed irsger401.ger.corp.intel.com [10, 100, 389] ads_dns_parse_rr_srv: Parsed irsger403.ger.corp.intel.com [10, 100, 389] remove_duplicate_addrs2: looking for duplicate address/port pairs namecache_store: storing 3 addresses for GER.CORP.INTEL.COM#1c: 10.104.193.75,10.104.193.72,10.104.193.77 Adding cache entry with key=[NBT/GER.CORP.INTEL.COM#1C] and timeout=[Fri Sep 4 10:38:44 2015 BST] (660 seconds ahead) internal_resolve_name: returning 3 addresses: 10.104.193.75:389 10.104.193.72:389 10.104.193.77:389 Adding 3 DC's from auto lookup Adding cache entry with key=[NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.75] and timeout=[Thu Jan 1 01:00:00 1970 BST] (-1441358864 seconds in the past) check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 Adding cache entry with key=[NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.72] and timeout=[Thu Jan 1 01:00:00 1970 BST] (-1441358864 seconds in the past) check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 Adding cache entry with key=[NEG_CONN_CACHE/GER.CORP.INTEL.COM,10.104.193.77] and timeout=[Thu Jan 1 01:00:00 1970 BST] (-1441358864 seconds in the past) check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 3 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 10.104.193.72:389 10.104.193.77:389 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 ads_try_connect: sending CLDAP request to 10.104.193.75 (realm: GER.CORP.INTEL.COM) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0000f1fc (61948) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : fd271710-1db8-4b63-8d37-90ad313b4c6d forest : 'corp.intel.com' dns_domain : 'ger.corp.intel.com' pdc_dns_name : 'IRSGER402.ger.corp.intel.com' domain_name : 'GER' pdc_name : 'IRSGER402' user_name : '' server_site : 'IR-Ireland' client_site : 'IR-Ireland' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) sitename_store: realm = [GER], sitename = [IR-Ireland], expire = [2085923199] Did not store value for AD_SITENAME/DOMAIN/GER, we already got it sitename_store: realm = [ger.corp.intel.com], sitename = [IR-Ireland], expire = [2085923199] Did not store value for AD_SITENAME/DOMAIN/GER.CORP.INTEL.COM, we already got it Successfully contacted LDAP server 10.104.193.75 sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_closest_dc: NBT_SERVER_CLOSEST flag set ads_dc_name: using server='IRSGER402.GER.CORP.INTEL.COM' IP=10.104.193.75 sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) name GER.CORP.INTEL.COM#1C found. remove_duplicate_addrs2: looking for duplicate address/port pairs Adding 3 DC's from auto lookup check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 3 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 10.104.193.72:389 10.104.193.77:389 Adding cache entry with key=[NEG_CONN_CACHE/GER,10.104.193.75] and timeout=[Thu Jan 1 01:00:00 1970 BST] (-1441358864 seconds in the past) check_negative_conn_cache returning result 0 for domain GER server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.77 get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) name GER.CORP.INTEL.COM#1C found. remove_duplicate_addrs2: looking for duplicate address/port pairs Adding 3 DC's from auto lookup check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 3 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 10.104.193.72:389 10.104.193.77:389 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.77 messaging_dgm_send: Sending message to 98302 messaging_recv_cb: Received message 0x406 len 4 (num_fds:0) from 98642 msg_try_to_go_online: received for domain GER. connection_ok: Connection to (null) for domain GER is not connected Opening cache file at /var/lib/samba/gencache.tdb Opening cache file at /var/lib/samba/gencache_notrans.tdb saf_fetch: failed to find server for "GER" domain cm_open_connection: dcname is '' for domain GER sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_dc_name: domain=GER sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_find_dc: (cldap) looking for realm 'GER.CORP.INTEL.COM' get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) name GER.CORP.INTEL.COM#1C found. remove_duplicate_addrs2: looking for duplicate address/port pairs Adding 3 DC's from auto lookup check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 3 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 10.104.193.72:389 10.104.193.77:389 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 ads_try_connect: sending CLDAP request to 10.104.193.75 (realm: GER.CORP.INTEL.COM) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0000f1fc (61948) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : fd271710-1db8-4b63-8d37-90ad313b4c6d forest : 'corp.intel.com' dns_domain : 'ger.corp.intel.com' pdc_dns_name : 'IRSGER402.ger.corp.intel.com' domain_name : 'GER' pdc_name : 'IRSGER402' user_name : '' server_site : 'IR-Ireland' client_site : 'IR-Ireland' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) sitename_store: realm = [GER], sitename = [IR-Ireland], expire = [2085923199] Did not store value for AD_SITENAME/DOMAIN/GER, we already got it sitename_store: realm = [ger.corp.intel.com], sitename = [IR-Ireland], expire = [2085923199] Did not store value for AD_SITENAME/DOMAIN/GER.CORP.INTEL.COM, we already got it Successfully contacted LDAP server 10.104.193.75 sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" ads_closest_dc: NBT_SERVER_CLOSEST flag set ads_dc_name: using server='IRSGER402.GER.CORP.INTEL.COM' IP=10.104.193.75 sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename IR-Ireland) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename IR-Ireland) name GER.CORP.INTEL.COM#1C found. remove_duplicate_addrs2: looking for duplicate address/port pairs Adding 3 DC's from auto lookup check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 3 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 10.104.193.72:389 10.104.193.77:389 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.77 get_sorted_dc_list: attempting lookup for name GER.CORP.INTEL.COM (sitename NULL) saf_fetch: failed to find server for "GER.CORP.INTEL.COM" domain get_dc_list: preferred server list: ", *" internal_resolve_name: looking up GER.CORP.INTEL.COM#1c (sitename (null)) name GER.CORP.INTEL.COM#1C found. remove_duplicate_addrs2: looking for duplicate address/port pairs Adding 3 DC's from auto lookup check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER.CORP.INTEL.COM server 10.104.193.77 remove_duplicate_addrs2: looking for duplicate address/port pairs get_dc_list: returning 3 ip addresses in an ordered list get_dc_list: 10.104.193.75:389 10.104.193.72:389 10.104.193.77:389 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.75 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.72 check_negative_conn_cache returning result 0 for domain GER server 10.104.193.77 Connecting to 10.104.193.75 at port 445 Connecting to 10.104.193.75 at port 139 Connecting to 10.104.193.72 at port 445 Connecting to 10.104.193.77 at port 445 Connecting to 10.104.193.72 at port 139 Connecting to 10.104.193.77 at port 139 samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc9ef0] mpx_fde[(nil)] fd[29] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc7370] mpx_fde[(nil)] fd[33] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70ccb410] mpx_fde[(nil)] fd[31] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc92e0] mpx_fde[(nil)] fd[32] - disabling samba_tevent: EPOLL_CTL_DEL EBADF for fde[0x55ff70cc5e10] mpx_fde[(nil)] fd[30] - disabling ads_try_connect: sending CLDAP request to 10.104.193.75 (realm: GER.CORP.INTEL.COM) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0000f1fc (61948) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : fd271710-1db8-4b63-8d37-90ad313b4c6d forest : 'corp.intel.com' dns_domain : 'ger.corp.intel.com' pdc_dns_name : 'IRSGER402.ger.corp.intel.com' domain_name : 'GER' pdc_name : 'IRSGER402' user_name : '' server_site : 'IR-Ireland' client_site : 'IR-Ireland' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) sitename_store: realm = [GER], sitename = [IR-Ireland], expire = [2085923199] Did not store value for AD_SITENAME/DOMAIN/GER, we already got it sitename_store: realm = [ger.corp.intel.com], sitename = [IR-Ireland], expire = [2085923199] Did not store value for AD_SITENAME/DOMAIN/GER.CORP.INTEL.COM, we already got it Successfully contacted LDAP server 10.104.193.75 namecache_store: storing 1 address for IRSGER402.ger.corp.intel.com#20: 10.104.193.75 Adding cache entry with key=[NBT/IRSGER402.GER.CORP.INTEL.COM#20] and timeout=[Fri Sep 4 10:38:44 2015 BST] (660 seconds ahead) dcip_to_name: flags = 0xf1fc ads_closest_dc: NBT_SERVER_CLOSEST flag set sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" saf_store: domain = [GER], server = [IRSGER402.ger.corp.intel.com], expire = [1441359764] Adding cache entry with key=[SAF/DOMAIN/GER] and timeout=[Fri Sep 4 10:42:44 2015 BST] (900 seconds ahead) saf_store: domain = [GER.CORP.INTEL.COM], server = [IRSGER402.ger.corp.intel.com], expire = [1441359764] Adding cache entry with key=[SAF/DOMAIN/GER.CORP.INTEL.COM] and timeout=[Fri Sep 4 10:42:44 2015 BST] (900 seconds ahead) cm_prepare_connection: connecting to DC IRSGER402.ger.corp.intel.com for domain GER connecting to IRSGER402.ger.corp.intel.com from DWOODHOU-LINUX with kerberos principal [DWOODHOU-LINUX$@GER.CORP.INTEL.COM] and realm [GER.CORP.INTEL.COM] Doing spnego session setup (blob length=120) got OID=1.3.6.1.4.1.311.2.2.30 got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.2.840.113554.1.2.2.3 got OID=1.3.6.1.4.1.311.2.2.10 got principal=not_defined_in_RFC4178@please_ignore kerberos_kinit_password: as DWOODHOU-LINUX$@GER.CORP.INTEL.COM using [MEMORY:cliconnect] as ccache and config [(null)] cli_session_setup_spnego: using target hostname not SPNEGO principal cli_session_setup_spnego: guessed server principal=cifs/IRSGER402.ger.corp.intel.com@GER.CORP.INTEL.COM Doing kerberos session setup ads_krb5_mk_req: smb_krb5_get_credentials failed for cifs/IRSGER402.ger.corp.intel.com@GER.CORP.INTEL.COM (Matching credential not found) cli_session_setup_kerberos: spnego_gen_krb5_negTokenInit failed: Matching credential not found SPNEGO login failed: Undetermined error failed kerberos session setup with NT_STATUS_UNSUCCESSFUL connecting to IRSGER402.ger.corp.intel.com from DWOODHOU-LINUX with username [GER]\[DWOODHOU-LINUX$] Doing spnego session setup (blob length=120) got OID=1.3.6.1.4.1.311.2.2.30 got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.2.840.113554.1.2.2.3 got OID=1.3.6.1.4.1.311.2.2.10 got principal=not_defined_in_RFC4178@please_ignore negotiate: struct NEGOTIATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmNegotiate (1) NegotiateFlags : 0x60088215 (1611170325) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 1: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 DomainNameLen : 0x0003 (3) DomainNameMaxLen : 0x0003 (3) DomainName : * DomainName : 'GER' WorkstationLen : 0x000e (14) WorkstationMaxLen : 0x000e (14) Workstation : * Workstation : 'DWOODHOU-LINUX' challenge: struct CHALLENGE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmChallenge (0x2) TargetNameLen : 0x0006 (6) TargetNameMaxLen : 0x0006 (6) TargetName : * TargetName : 'GER' NegotiateFlags : 0x62898215 (1653178901) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 1: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 1: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 1: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 ServerChallenge : acaf20399b9ef439 Reserved : 0000000000000000 TargetInfoLen : 0x00b4 (180) TargetNameInfoMaxLen : 0x00b4 (180) TargetInfo : * TargetInfo: struct AV_PAIR_LIST count : 0x00000007 (7) pair: ARRAY(7) pair: struct AV_PAIR AvId : MsvAvNbDomainName (0x2) AvLen : 0x0006 (6) Value : union ntlmssp_AvValue(case 0x2) AvNbDomainName : 'GER' pair: struct AV_PAIR AvId : MsvAvNbComputerName (0x1) AvLen : 0x0012 (18) Value : union ntlmssp_AvValue(case 0x1) AvNbComputerName : 'IRSGER402' pair: struct AV_PAIR AvId : MsvAvDnsDomainName (0x4) AvLen : 0x0024 (36) Value : union ntlmssp_AvValue(case 0x4) AvDnsDomainName : 'ger.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsComputerName (0x3) AvLen : 0x0038 (56) Value : union ntlmssp_AvValue(case 0x3) AvDnsComputerName : 'IRSGER402.ger.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsTreeName (0x5) AvLen : 0x001c (28) Value : union ntlmssp_AvValue(case 0x5) AvDnsTreeName : 'corp.intel.com' pair: struct AV_PAIR AvId : MsvAvTimestamp (0x7) AvLen : 0x0008 (8) Value : union ntlmssp_AvValue(case 0x7) AvTimestamp : Fri Sep 4 10:27:46 2015 BST pair: struct AV_PAIR AvId : MsvAvEOL (0x0) AvLen : 0x0000 (0) Value : union ntlmssp_AvValue(case 0x0) Version: struct ntlmssp_VERSION ProductMajorVersion : NTLMSSP_WINDOWS_MAJOR_VERSION_6 (0x6) ProductMinorVersion : UNKNOWN_ENUM_VALUE (0x3) ProductBuild : 0x2580 (9600) Reserved : 000000 NTLMRevisionCurrent : NTLMSSP_REVISION_W2K3 (0xF) Got challenge flags: Got NTLMSSP neg_flags=0x62898215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_TARGET_INFO NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCH NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x60088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCH NTLMSSP challenge set by NTLM2 challenge is: [0000] C2 89 48 7D 4B 63 60 D0 ..H}Kc`. authenticate: struct AUTHENTICATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmAuthenticate (3) LmChallengeResponseLen : 0x0018 (24) LmChallengeResponseMaxLen: 0x0018 (24) LmChallengeResponse : * LmChallengeResponse : union ntlmssp_LM_RESPONSE(case 24) v1: struct LM_RESPONSE Response : ecbdd7e590375f0c00000000000000000000000000000000 NtChallengeResponseLen : 0x0018 (24) NtChallengeResponseMaxLen: 0x0018 (24) NtChallengeResponse : * NtChallengeResponse : union ntlmssp_NTLM_RESPONSE(case 24) v1: struct NTLM_RESPONSE Response : 87b2e4c89215907112f8130b1e75e043b2ff9bdcb5884385 DomainNameLen : 0x0006 (6) DomainNameMaxLen : 0x0006 (6) DomainName : * DomainName : 'GER' UserNameLen : 0x001e (30) UserNameMaxLen : 0x001e (30) UserName : * UserName : 'DWOODHOU-LINUX$' WorkstationLen : 0x001c (28) WorkstationMaxLen : 0x001c (28) Workstation : * Workstation : 'DWOODHOU-LINUX' EncryptedRandomSessionKeyLen: 0x0010 (16) EncryptedRandomSessionKeyMaxLen: 0x0010 (16) EncryptedRandomSessionKey: * EncryptedRandomSessionKey: DATA_BLOB length=16 [0000] FE 5E 5A 28 29 41 F0 D7 D0 85 2F 8E EC B6 3E C3 .^Z()A.. ../...>. NegotiateFlags : 0x60088215 (1611170325) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 1: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x60088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCH cli_init_creds: user DWOODHOU-LINUX$ domain GER saf_store: domain = [GER], server = [IRSGER402.ger.corp.intel.com], expire = [1441359766] Did not store value for SAF/DOMAIN/GER, we already got it signed SMB2 message signed SMB2 message set_global_winbindd_state_online: online requested. set_domain_online: called for domain GER Deregistering messaging pointer for type 1030 - private_data=(nil) Deregistering messaging pointer for type 1031 - private_data=(nil) messaging_dgm_send: Sending message to 98277 Did not store value for CURRENT_DCNAME/GER, we already got it set_dc_type_and_flags: setting up flags for primary or internal domain set_dc_type_and_flags_connect: domain GER signed SMB2 message GENSEC backend 'gssapi_spnego' registered GENSEC backend 'gssapi_krb5' registered GENSEC backend 'gssapi_krb5_sasl' registered GENSEC backend 'sasl-DIGEST-MD5' registered GENSEC backend 'spnego' registered GENSEC backend 'schannel' registered GENSEC backend 'naclrpc_as_system' registered GENSEC backend 'sasl-EXTERNAL' registered GENSEC backend 'ntlmssp' registered GENSEC backend 'http_basic' registered GENSEC backend 'http_ntlm' registered Bind RPC Pipe: host IRSGER402.ger.corp.intel.com auth_type 0, auth_level 1 &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000001 (1) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 3919286a-b10c-11d0-9ba8-00c04fd92ef5 if_version : 0x00000000 (0) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 rpc_api_pipe: host IRSGER402.ger.corp.intel.com signed SMB2 message rpc_read_send: data_to_read: 52 r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000001 (1) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00159386 (1414022) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] 02 00 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 rpc_api_pipe: got frag len of 68 at offset 0: NT_STATUS_OK rpc_api_pipe: host IRSGER402.ger.corp.intel.com returned 68 bytes. check_bind_response: accepted! cli_rpc_pipe_open_noauth: opened pipe dssetup to machine IRSGER402.ger.corp.intel.com and bound anonymously. dssetup_DsRoleGetPrimaryDomainInformation: struct dssetup_DsRoleGetPrimaryDomainInformation in: struct dssetup_DsRoleGetPrimaryDomainInformation level : DS_ROLE_BASIC_INFORMATION (1) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000002 (2) context_id : 0x0000 (0) opnum : 0x0000 (0) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 rpc_api_pipe: host IRSGER402.ger.corp.intel.com signed SMB2 message rpc_read_send: data_to_read: 172 r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00bc (188) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a4 (164) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=164 [0000] 00 00 02 00 01 00 00 00 04 00 00 00 01 00 00 01 ........ ........ [0010] 04 00 02 00 08 00 02 00 0C 00 02 00 10 17 27 FD ........ ......'. [0020] B8 1D 63 4B 8D 37 90 AD 31 3B 4C 6D 04 00 00 00 ..cK.7.. 1;Lm.... [0030] 00 00 00 00 04 00 00 00 47 00 45 00 52 00 00 00 ........ G.E.R... [0040] 13 00 00 00 00 00 00 00 13 00 00 00 67 00 65 00 ........ ....g.e. [0050] 72 00 2E 00 63 00 6F 00 72 00 70 00 2E 00 69 00 r...c.o. r.p...i. [0060] 6E 00 74 00 65 00 6C 00 2E 00 63 00 6F 00 6D 00 n.t.e.l. ..c.o.m. [0070] 00 00 00 00 0F 00 00 00 00 00 00 00 0F 00 00 00 ........ ........ [0080] 63 00 6F 00 72 00 70 00 2E 00 69 00 6E 00 74 00 c.o.r.p. ..i.n.t. [0090] 65 00 6C 00 2E 00 63 00 6F 00 6D 00 00 00 00 00 e.l...c. o.m..... [00A0] 00 00 00 00 .... Got pdu len 188, data_len 164, ss_len 0 rpc_api_pipe: got frag len of 188 at offset 0: NT_STATUS_OK rpc_api_pipe: host IRSGER402.ger.corp.intel.com returned 164 bytes. dssetup_DsRoleGetPrimaryDomainInformation: struct dssetup_DsRoleGetPrimaryDomainInformation out: struct dssetup_DsRoleGetPrimaryDomainInformation info : * info : union dssetup_DsRoleInfo(case 1) basic: struct dssetup_DsRolePrimaryDomInfoBasic role : DS_ROLE_BACKUP_DC (4) flags : 0x01000001 (16777217) 1: DS_ROLE_PRIMARY_DS_RUNNING 0: DS_ROLE_PRIMARY_DS_MIXED_MODE 0: DS_ROLE_UPGRADE_IN_PROGRESS 1: DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT domain : * domain : 'GER' dns_domain : * dns_domain : 'ger.corp.intel.com' forest : * forest : 'corp.intel.com' domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d result : WERR_OK signed SMB2 message signed SMB2 message Bind RPC Pipe: host IRSGER402.ger.corp.intel.com auth_type 0, auth_level 1 &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000003 (3) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 rpc_api_pipe: host IRSGER402.ger.corp.intel.com signed SMB2 message rpc_read_send: data_to_read: 52 r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000003 (3) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00159389 (1414025) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] 00 00 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 rpc_api_pipe: got frag len of 68 at offset 0: NT_STATUS_OK rpc_api_pipe: host IRSGER402.ger.corp.intel.com returned 68 bytes. check_bind_response: accepted! cli_rpc_pipe_open_noauth: opened pipe lsarpc to machine IRSGER402.ger.corp.intel.com and bound anonymously. lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '\\IRSGER402.GER.CORP.INTEL.COM' attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000004 (4) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000074 (116) context_id : 0x0000 (0) opnum : 0x002c (44) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 rpc_api_pipe: host IRSGER402.ger.corp.intel.com signed SMB2 message rpc_read_send: data_to_read: 32 r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0030 (48) auth_length : 0x0000 (0) call_id : 0x00000004 (4) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000018 (24) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=24 [0000] 00 00 00 00 04 6E 6E 42 C6 33 90 41 93 C7 A9 EC .....nnB .3.A.... [0010] 28 B1 03 84 00 00 00 00 (....... Got pdu len 48, data_len 24, ss_len 0 rpc_api_pipe: got frag len of 48 at offset 0: NT_STATUS_OK rpc_api_pipe: host IRSGER402.ger.corp.intel.com returned 24 bytes. lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 426e6e04-33c6-4190-93c7-a9ec28b10384 result : NT_STATUS_OK lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 in: struct lsa_QueryInfoPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 426e6e04-33c6-4190-93c7-a9ec28b10384 level : LSA_POLICY_INFO_DNS (12) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000005 (5) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000016 (22) context_id : 0x0000 (0) opnum : 0x002e (46) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 rpc_api_pipe: host IRSGER402.ger.corp.intel.com signed SMB2 message rpc_read_send: data_to_read: 200 r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00d8 (216) auth_length : 0x0000 (0) call_id : 0x00000005 (5) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000c0 (192) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=192 [0000] 00 00 02 00 0C 00 00 00 06 00 08 00 04 00 02 00 ........ ........ [0010] 24 00 26 00 08 00 02 00 1C 00 1E 00 0C 00 02 00 $.&..... ........ [0020] 10 17 27 FD B8 1D 63 4B 8D 37 90 AD 31 3B 4C 6D ..'...cK .7..1;Lm [0030] 10 00 02 00 04 00 00 00 00 00 00 00 03 00 00 00 ........ ........ [0040] 47 00 45 00 52 00 00 00 13 00 00 00 00 00 00 00 G.E.R... ........ [0050] 12 00 00 00 67 00 65 00 72 00 2E 00 63 00 6F 00 ....g.e. r...c.o. [0060] 72 00 70 00 2E 00 69 00 6E 00 74 00 65 00 6C 00 r.p...i. n.t.e.l. [0070] 2E 00 63 00 6F 00 6D 00 0F 00 00 00 00 00 00 00 ..c.o.m. ........ [0080] 0E 00 00 00 63 00 6F 00 72 00 70 00 2E 00 69 00 ....c.o. r.p...i. [0090] 6E 00 74 00 65 00 6C 00 2E 00 63 00 6F 00 6D 00 n.t.e.l. ..c.o.m. [00A0] 04 00 00 00 01 04 00 00 00 00 00 05 15 00 00 00 ........ ........ [00B0] C6 BB 50 7A 57 29 02 4C A1 F4 04 62 00 00 00 00 ..PzW).L ...b.... Got pdu len 216, data_len 192, ss_len 0 rpc_api_pipe: got frag len of 216 at offset 0: NT_STATUS_OK rpc_api_pipe: host IRSGER402.ger.corp.intel.com returned 192 bytes. lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 out: struct lsa_QueryInfoPolicy2 info : * info : * info : union lsa_PolicyInformation(case 12) dns: struct lsa_DnsDomainInfo name: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'GER' dns_domain: struct lsa_StringLarge length : 0x0024 (36) size : 0x0026 (38) string : * string : 'ger.corp.intel.com' dns_forest: struct lsa_StringLarge length : 0x001c (28) size : 0x001e (30) string : * string : 'corp.intel.com' domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d sid : * sid : S-1-5-21-2052111302-1275210071-1644491937 result : NT_STATUS_OK set_dc_type_and_flags_connect: domain GER is in native mode. set_dc_type_and_flags_connect: domain GER is running active directory. signed SMB2 message Already reaped child 98642 died accepted socket 27 accepted socket 30 accepted socket 31 process_request: request fn INTERFACE_VERSION [98632]: request interface version (version = 27) process_request: request fn INTERFACE_VERSION [ 3342]: request interface version (version = 27) winbind_client_response_written[98632:INTERFACE_VERSION]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[3342:INTERFACE_VERSION]: delivered response to client winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn WINBINDD_PRIV_PIPE_DIR [98632]: request location of privileged pipe process_request: request fn WINBINDD_PRIV_PIPE_DIR [ 3342]: request location of privileged pipe winbind_client_response_written[98632:WINBINDD_PRIV_PIPE_DIR]: delivered response to client process_request: request fn WINBINDD_PRIV_PIPE_DIR [136877]: request location of privileged pipe winbind_client_response_written[3342:WINBINDD_PRIV_PIPE_DIR]: delivered response to client winbind_client_response_written[136877:WINBINDD_PRIV_PIPE_DIR]: delivered response to client process_request: request fn INTERFACE_VERSION [ 3342]: request interface version (version = 27) process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) accepted socket 32 closing socket 27, client exited winbind_client_response_written[3342:INTERFACE_VERSION]: delivered response to client winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: Handling async request 98632:DSGETDCNAME [98632]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) process_request: request fn INFO [ 3342]: request misc info winbind_client_response_written[3342:INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client Need to read 60 extra bytes process_request: request fn NETBIOS_NAME [ 3342]: request netbios name child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) winbind_client_response_written[3342:NETBIOS_NAME]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * process_request: request fn DOMAIN_NAME site_name : '' [ 3342]: request domain name flags : 0x40020400 (1073873920) winbind_client_response_written[3342:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" process_request: request fn DOMAIN_INFO [ 3342]: domain_info [GER] dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME winbind_client_response_written[3342:DOMAIN_INFO]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' process_request: request fn INFO dc_address : * [ 3342]: request misc info dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d winbind_client_response_written[3342:INFO]: delivered response to client domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * process_request: request fn INFO forest_name : 'corp.intel.com' [136877]: request misc info dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP winbind_client_response_written[136877:INFO]: delivered response to client 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV process_request: request fn NTLMAUTH 1: DS_SERVER_CLOSEST [ 3342]: perform NTLM auth on behalf of user GER\dwoodhou 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 Access granted to uid 500 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT winbind_client_response_written[3342:NTLMAUTH]: delivered response to client dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * process_request: request fn NTLMAUTH client_site_name : 'IR-Ireland' [136877]: perform NTLM auth on behalf of user GER\dwoodhou wbint_DsGetDcName: struct wbint_DsGetDcName winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo winbind_client_response_written[136877:NTLMAUTH]: delivered response to client dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * process_request: request fn INTERFACE_VERSION dc_address : '\\10.104.193.75' [ 3342]: request interface version (version = 27) dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d winbind_client_response_written[3342:INTERFACE_VERSION]: delivered response to client domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * process_request: request fn INTERFACE_VERSION forest_name : 'corp.intel.com' [136877]: request interface version (version = 27) dc_flags : 0xe000f1fc (3758158332) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP process_request: request fn INFO [ 3342]: request misc info 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST winbind_client_response_written[3342:INFO]: delivered response to client 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC process_request: request fn INFO [136877]: request misc info 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER winbind_client_response_written[136877:INFO]: delivered response to client 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * process_request: request fn NETBIOS_NAME [ 3342]: request netbios name dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK winbind_client_response_written[3342:NETBIOS_NAME]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name Finished processing child request 59 Writing 3836 bytes to parent winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [ 3342]: request domain name winbind_client_response_written[3342:DOMAIN_NAME]: delivered response to client wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98632:DSGETDCNAME]: NT_STATUS_OK process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[98632:DSGETDCNAME]: delivered response to client winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [ 3342]: domain_info [GER] winbind_client_response_written[3342:DOMAIN_INFO]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [ 3342]: request misc info winbind_client_response_written[3342:INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [ 3342]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[3342:NTLMAUTH]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [ 3342]: request interface version (version = 27) winbind_client_response_written[3342:INTERFACE_VERSION]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [ 3342]: request misc info winbind_client_response_written[3342:INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [ 3342]: request netbios name process_request: Handling async request 98632:DSGETDCNAME [98632]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) winbind_client_response_written[3342:NETBIOS_NAME]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME Need to read 60 extra bytes [ 3342]: request domain name child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) winbind_client_response_written[3342:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_NAME wbint_DsGetDcName: struct wbint_DsGetDcName [136877]: request domain name in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client site_name : * site_name : '' process_request: request fn DOMAIN_INFO flags : 0x40020400 (1073873920) [ 3342]: domain_info [GER] sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 winbind_client_response_written[3342:DOMAIN_INFO]: delivered response to client DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98632:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98632:DSGETDCNAME]: delivered response to client process_request: request fn INTERFACE_VERSION [ 3342]: request interface version (version = 27) winbind_client_response_written[3342:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [ 3342]: request misc info winbind_client_response_written[3342:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [ 3342]: request netbios name winbind_client_response_written[3342:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [ 3342]: request domain name winbind_client_response_written[3342:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [ 3342]: domain_info [GER] winbind_client_response_written[3342:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [ 3342]: request misc info winbind_client_response_written[3342:INFO]: delivered response to client process_request: request fn NTLMAUTH [ 3342]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[3342:NTLMAUTH]: delivered response to client process_request: request fn INFO [ 3342]: request misc info winbind_client_response_written[3342:INFO]: delivered response to client process_request: request fn NTLMAUTH [ 3342]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 Starting GENSEC mechanism ntlmssp3_client negotiate: struct NEGOTIATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmNegotiate (1) NegotiateFlags : 0x60088215 (1611170325) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 1: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 DomainNameLen : 0x0003 (3) DomainNameMaxLen : 0x0003 (3) DomainName : * DomainName : 'GER' WorkstationLen : 0x000e (14) WorkstationMaxLen : 0x000e (14) Workstation : * Workstation : 'DWOODHOU-LINUX' challenge: struct CHALLENGE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmChallenge (0x2) TargetNameLen : 0x0006 (6) TargetNameMaxLen : 0x0006 (6) TargetName : * TargetName : 'GER' NegotiateFlags : 0xa2898215 (2726920725) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 1: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 1: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 1: NTLMSSP_NEGOTIATE_56 ServerChallenge : 186b086db0795304 Reserved : 0000000000000000 TargetInfoLen : 0x00b4 (180) TargetNameInfoMaxLen : 0x00b4 (180) TargetInfo : * TargetInfo: struct AV_PAIR_LIST count : 0x00000007 (7) pair: ARRAY(7) pair: struct AV_PAIR AvId : MsvAvNbDomainName (0x2) AvLen : 0x0006 (6) Value : union ntlmssp_AvValue(case 0x2) AvNbDomainName : 'GER' pair: struct AV_PAIR AvId : MsvAvNbComputerName (0x1) AvLen : 0x0012 (18) Value : union ntlmssp_AvValue(case 0x1) AvNbComputerName : 'IRSMSX103' pair: struct AV_PAIR AvId : MsvAvDnsDomainName (0x4) AvLen : 0x0024 (36) Value : union ntlmssp_AvValue(case 0x4) AvDnsDomainName : 'ger.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsComputerName (0x3) AvLen : 0x0038 (56) Value : union ntlmssp_AvValue(case 0x3) AvDnsComputerName : 'IRSMSX103.ger.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsTreeName (0x5) AvLen : 0x001c (28) Value : union ntlmssp_AvValue(case 0x5) AvDnsTreeName : 'corp.intel.com' pair: struct AV_PAIR AvId : MsvAvTimestamp (0x7) AvLen : 0x0008 (8) Value : union ntlmssp_AvValue(case 0x7) AvTimestamp : Fri Sep 4 10:27:46 2015 BST pair: struct AV_PAIR AvId : MsvAvEOL (0x0) AvLen : 0x0000 (0) Value : union ntlmssp_AvValue(case 0x0) Version: struct ntlmssp_VERSION ProductMajorVersion : NTLMSSP_WINDOWS_MAJOR_VERSION_6 (0x6) ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_1 (0x1) ProductBuild : 0x1db1 (7601) Reserved : 000000 NTLMRevisionCurrent : NTLMSSP_REVISION_W2K3 (0xF) Got challenge flags: Got NTLMSSP neg_flags=0xa2898215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_TARGET_INFO NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_56 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP challenge set by NTLM2 challenge is: [0000] 32 F7 86 D9 9D E2 AE 3F 2......? authenticate: struct AUTHENTICATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmAuthenticate (3) LmChallengeResponseLen : 0x0018 (24) LmChallengeResponseMaxLen: 0x0018 (24) LmChallengeResponse : * LmChallengeResponse : union ntlmssp_LM_RESPONSE(case 24) v1: struct LM_RESPONSE Response : bfad5861990cc22800000000000000000000000000000000 NtChallengeResponseLen : 0x0018 (24) NtChallengeResponseMaxLen: 0x0018 (24) NtChallengeResponse : * NtChallengeResponse : union ntlmssp_NTLM_RESPONSE(case 24) v1: struct NTLM_RESPONSE Response : 4cfbb97ba614212ea33d7a037d5052843f972589f4bb72c7 DomainNameLen : 0x0006 (6) DomainNameMaxLen : 0x0006 (6) DomainName : * DomainName : 'GER' UserNameLen : 0x0010 (16) UserNameMaxLen : 0x0010 (16) UserName : * UserName : 'dwoodhou' WorkstationLen : 0x001c (28) WorkstationMaxLen : 0x001c (28) Workstation : * Workstation : 'DWOODHOU-LINUX' EncryptedRandomSessionKeyLen: 0x0000 (0) EncryptedRandomSessionKeyMaxLen: 0x0000 (0) EncryptedRandomSessionKey: * EncryptedRandomSessionKey: DATA_BLOB length=0 NegotiateFlags : 0x20088215 (537428501) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 winbind_client_response_written[3342:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 Starting GENSEC mechanism ntlmssp3_client negotiate: struct NEGOTIATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmNegotiate (1) NegotiateFlags : 0x60088215 (1611170325) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 1: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 DomainNameLen : 0x0003 (3) DomainNameMaxLen : 0x0003 (3) DomainName : * DomainName : 'GER' WorkstationLen : 0x000e (14) WorkstationMaxLen : 0x000e (14) Workstation : * Workstation : 'DWOODHOU-LINUX' challenge: struct CHALLENGE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmChallenge (0x2) TargetNameLen : 0x0006 (6) TargetNameMaxLen : 0x0006 (6) TargetName : * TargetName : 'GER' NegotiateFlags : 0xa2898215 (2726920725) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 1: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 1: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 1: NTLMSSP_NEGOTIATE_56 ServerChallenge : aa35ba1dbc101d66 Reserved : 0000000000000000 TargetInfoLen : 0x00b4 (180) TargetNameInfoMaxLen : 0x00b4 (180) TargetInfo : * TargetInfo: struct AV_PAIR_LIST count : 0x00000007 (7) pair: ARRAY(7) pair: struct AV_PAIR AvId : MsvAvNbDomainName (0x2) AvLen : 0x0006 (6) Value : union ntlmssp_AvValue(case 0x2) AvNbDomainName : 'GER' pair: struct AV_PAIR AvId : MsvAvNbComputerName (0x1) AvLen : 0x0012 (18) Value : union ntlmssp_AvValue(case 0x1) AvNbComputerName : 'IRSMSX103' pair: struct AV_PAIR AvId : MsvAvDnsDomainName (0x4) AvLen : 0x0024 (36) Value : union ntlmssp_AvValue(case 0x4) AvDnsDomainName : 'ger.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsComputerName (0x3) AvLen : 0x0038 (56) Value : union ntlmssp_AvValue(case 0x3) AvDnsComputerName : 'IRSMSX103.ger.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsTreeName (0x5) AvLen : 0x001c (28) Value : union ntlmssp_AvValue(case 0x5) AvDnsTreeName : 'corp.intel.com' pair: struct AV_PAIR AvId : MsvAvTimestamp (0x7) AvLen : 0x0008 (8) Value : union ntlmssp_AvValue(case 0x7) AvTimestamp : Fri Sep 4 10:27:46 2015 BST pair: struct AV_PAIR AvId : MsvAvEOL (0x0) AvLen : 0x0000 (0) Value : union ntlmssp_AvValue(case 0x0) Version: struct ntlmssp_VERSION ProductMajorVersion : NTLMSSP_WINDOWS_MAJOR_VERSION_6 (0x6) ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_1 (0x1) ProductBuild : 0x1db1 (7601) Reserved : 000000 NTLMRevisionCurrent : NTLMSSP_REVISION_W2K3 (0xF) Got challenge flags: Got NTLMSSP neg_flags=0xa2898215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_TARGET_INFO NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_56 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP challenge set by NTLM2 challenge is: [0000] B1 DC ED 5D D8 A2 88 23 ...]...# authenticate: struct AUTHENTICATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmAuthenticate (3) LmChallengeResponseLen : 0x0018 (24) LmChallengeResponseMaxLen: 0x0018 (24) LmChallengeResponse : * LmChallengeResponse : union ntlmssp_LM_RESPONSE(case 24) v1: struct LM_RESPONSE Response : 452ce64e891d388400000000000000000000000000000000 NtChallengeResponseLen : 0x0018 (24) NtChallengeResponseMaxLen: 0x0018 (24) NtChallengeResponse : * NtChallengeResponse : union ntlmssp_NTLM_RESPONSE(case 24) v1: struct NTLM_RESPONSE Response : 41d0214836f09d5323b9c362663c96f3ee33d814f3c4a374 DomainNameLen : 0x0006 (6) DomainNameMaxLen : 0x0006 (6) DomainName : * DomainName : 'GER' UserNameLen : 0x0010 (16) UserNameMaxLen : 0x0010 (16) UserName : * UserName : 'dwoodhou' WorkstationLen : 0x001c (28) WorkstationMaxLen : 0x001c (28) Workstation : * Workstation : 'DWOODHOU-LINUX' EncryptedRandomSessionKeyLen: 0x0000 (0) EncryptedRandomSessionKeyMaxLen: 0x0000 (0) EncryptedRandomSessionKey: * EncryptedRandomSessionKey: DATA_BLOB length=0 NegotiateFlags : 0x20088215 (537428501) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: Handling async request 98632:DSGETDCNAME [98632]: dsgetdcname for GER.CORP.INTEL.COM wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) Need to read 60 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_DSGETDCNAME (no domain) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'GER.CORP.INTEL.COM' domain_guid : NULL site_name : * site_name : '' flags : 0x40020400 (1073873920) sitename_fetch: Returning sitename for GER.CORP.INTEL.COM: "IR-Ireland" dsgetdcname_internal: domain_name: GER.CORP.INTEL.COM, domain_guid: (null), site_name: IR-Ireland, flags: 0x40020400 debug_dsdcinfo_flags: 0x40020400 DS_KDC_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK Finished processing child request 59 Writing 3836 bytes to parent wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : 'IRSGER402.ger.corp.intel.com' dc_address : * dc_address : '\\10.104.193.75' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : fd271710-1db8-4b63-8d37-90ad313b4c6d domain_name : * domain_name : 'ger.corp.intel.com' forest_name : * forest_name : 'corp.intel.com' dc_flags : 0xe000f1fc (3758158332) 0: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'IR-Ireland' client_site_name : * client_site_name : 'IR-Ireland' result : NT_STATUS_OK wb_request_done[98632:DSGETDCNAME]: NT_STATUS_OK winbind_client_response_written[98632:DSGETDCNAME]: delivered response to client closing socket 32, client exited accepted socket 27 process_request: request fn INTERFACE_VERSION [ 4288]: request interface version (version = 27) winbind_client_response_written[4288:INTERFACE_VERSION]: delivered response to client process_request: request fn WINBINDD_PRIV_PIPE_DIR [ 4288]: request location of privileged pipe winbind_client_response_written[4288:WINBINDD_PRIV_PIPE_DIR]: delivered response to client process_request: request fn INTERFACE_VERSION [ 4288]: request interface version (version = 27) winbind_client_response_written[4288:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [ 4288]: request misc info winbind_client_response_written[4288:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [ 4288]: request netbios name winbind_client_response_written[4288:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [ 4288]: request domain name winbind_client_response_written[4288:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [ 4288]: domain_info [GER] winbind_client_response_written[4288:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [ 4288]: request misc info winbind_client_response_written[4288:INFO]: delivered response to client process_request: request fn NTLMAUTH [ 4288]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[4288:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [ 4288]: request interface version (version = 27) winbind_client_response_written[4288:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [ 4288]: request misc info winbind_client_response_written[4288:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [ 4288]: request netbios name winbind_client_response_written[4288:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [ 4288]: request domain name winbind_client_response_written[4288:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [ 4288]: domain_info [GER] winbind_client_response_written[4288:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [ 4288]: request misc info winbind_client_response_written[4288:INFO]: delivered response to client process_request: request fn NTLMAUTH [ 4288]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[4288:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [ 4288]: request interface version (version = 27) winbind_client_response_written[4288:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [ 4288]: request misc info winbind_client_response_written[4288:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [ 4288]: request netbios name winbind_client_response_written[4288:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [ 4288]: request domain name winbind_client_response_written[4288:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [ 4288]: domain_info [GER] winbind_client_response_written[4288:DOMAIN_INFO]: delivered response to client process_request: request fn INTERFACE_VERSION [ 4288]: request interface version (version = 27) winbind_client_response_written[4288:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [ 4288]: request misc info winbind_client_response_written[4288:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [ 4288]: request netbios name winbind_client_response_written[4288:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [ 4288]: request domain name winbind_client_response_written[4288:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [ 4288]: domain_info [GER] winbind_client_response_written[4288:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [ 4288]: request misc info winbind_client_response_written[4288:INFO]: delivered response to client process_request: request fn NTLMAUTH [ 4288]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[4288:NTLMAUTH]: delivered response to client process_request: request fn INFO [ 4288]: request misc info winbind_client_response_written[4288:INFO]: delivered response to client process_request: request fn NTLMAUTH [ 4288]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 Starting GENSEC mechanism ntlmssp3_client negotiate: struct NEGOTIATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmNegotiate (1) NegotiateFlags : 0x60088215 (1611170325) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 1: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 DomainNameLen : 0x0003 (3) DomainNameMaxLen : 0x0003 (3) DomainName : * DomainName : 'GER' WorkstationLen : 0x000e (14) WorkstationMaxLen : 0x000e (14) Workstation : * Workstation : 'DWOODHOU-LINUX' challenge: struct CHALLENGE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmChallenge (0x2) TargetNameLen : 0x0006 (6) TargetNameMaxLen : 0x0006 (6) TargetName : * TargetName : 'GER' NegotiateFlags : 0xa2898215 (2726920725) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 1: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 1: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 1: NTLMSSP_NEGOTIATE_56 ServerChallenge : 77ed626ab04d771c Reserved : 0000000000000000 TargetInfoLen : 0x00b4 (180) TargetNameInfoMaxLen : 0x00b4 (180) TargetInfo : * TargetInfo: struct AV_PAIR_LIST count : 0x00000007 (7) pair: ARRAY(7) pair: struct AV_PAIR AvId : MsvAvNbDomainName (0x2) AvLen : 0x0006 (6) Value : union ntlmssp_AvValue(case 0x2) AvNbDomainName : 'GER' pair: struct AV_PAIR AvId : MsvAvNbComputerName (0x1) AvLen : 0x0012 (18) Value : union ntlmssp_AvValue(case 0x1) AvNbComputerName : 'IRSMSX103' pair: struct AV_PAIR AvId : MsvAvDnsDomainName (0x4) AvLen : 0x0024 (36) Value : union ntlmssp_AvValue(case 0x4) AvDnsDomainName : 'ger.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsComputerName (0x3) AvLen : 0x0038 (56) Value : union ntlmssp_AvValue(case 0x3) AvDnsComputerName : 'IRSMSX103.ger.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsTreeName (0x5) AvLen : 0x001c (28) Value : union ntlmssp_AvValue(case 0x5) AvDnsTreeName : 'corp.intel.com' pair: struct AV_PAIR AvId : MsvAvTimestamp (0x7) AvLen : 0x0008 (8) Value : union ntlmssp_AvValue(case 0x7) AvTimestamp : Fri Sep 4 10:27:47 2015 BST pair: struct AV_PAIR AvId : MsvAvEOL (0x0) AvLen : 0x0000 (0) Value : union ntlmssp_AvValue(case 0x0) Version: struct ntlmssp_VERSION ProductMajorVersion : NTLMSSP_WINDOWS_MAJOR_VERSION_6 (0x6) ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_1 (0x1) ProductBuild : 0x1db1 (7601) Reserved : 000000 NTLMRevisionCurrent : NTLMSSP_REVISION_W2K3 (0xF) Got challenge flags: Got NTLMSSP neg_flags=0xa2898215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_TARGET_INFO NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_56 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP challenge set by NTLM2 challenge is: [0000] 79 31 30 0B EF 63 36 3C y10..c6< authenticate: struct AUTHENTICATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmAuthenticate (3) LmChallengeResponseLen : 0x0018 (24) LmChallengeResponseMaxLen: 0x0018 (24) LmChallengeResponse : * LmChallengeResponse : union ntlmssp_LM_RESPONSE(case 24) v1: struct LM_RESPONSE Response : ccf0ccdce52bf5ca00000000000000000000000000000000 NtChallengeResponseLen : 0x0018 (24) NtChallengeResponseMaxLen: 0x0018 (24) NtChallengeResponse : * NtChallengeResponse : union ntlmssp_NTLM_RESPONSE(case 24) v1: struct NTLM_RESPONSE Response : b9783e3d15938cb23f8e200fbfc529754a50e8fe7e4f1871 DomainNameLen : 0x0006 (6) DomainNameMaxLen : 0x0006 (6) DomainName : * DomainName : 'GER' UserNameLen : 0x0010 (16) UserNameMaxLen : 0x0010 (16) UserName : * UserName : 'dwoodhou' WorkstationLen : 0x001c (28) WorkstationMaxLen : 0x001c (28) Workstation : * Workstation : 'DWOODHOU-LINUX' EncryptedRandomSessionKeyLen: 0x0000 (0) EncryptedRandomSessionKeyMaxLen: 0x0000 (0) EncryptedRandomSessionKey: * EncryptedRandomSessionKey: DATA_BLOB length=0 NegotiateFlags : 0x20088215 (537428501) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 winbind_client_response_written[4288:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 Starting GENSEC mechanism ntlmssp3_client negotiate: struct NEGOTIATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmNegotiate (1) NegotiateFlags : 0x60088215 (1611170325) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 1: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 DomainNameLen : 0x0003 (3) DomainNameMaxLen : 0x0003 (3) DomainName : * DomainName : 'GER' WorkstationLen : 0x000e (14) WorkstationMaxLen : 0x000e (14) Workstation : * Workstation : 'DWOODHOU-LINUX' challenge: struct CHALLENGE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmChallenge (0x2) TargetNameLen : 0x0006 (6) TargetNameMaxLen : 0x0006 (6) TargetName : * TargetName : 'AMR' NegotiateFlags : 0xa2898215 (2726920725) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 1: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 1: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 1: NTLMSSP_NEGOTIATE_56 ServerChallenge : 3b1efc96c86d0fcf Reserved : 0000000000000000 TargetInfoLen : 0x00b4 (180) TargetNameInfoMaxLen : 0x00b4 (180) TargetInfo : * TargetInfo: struct AV_PAIR_LIST count : 0x00000007 (7) pair: ARRAY(7) pair: struct AV_PAIR AvId : MsvAvNbDomainName (0x2) AvLen : 0x0006 (6) Value : union ntlmssp_AvValue(case 0x2) AvNbDomainName : 'AMR' pair: struct AV_PAIR AvId : MsvAvNbComputerName (0x1) AvLen : 0x0012 (18) Value : union ntlmssp_AvValue(case 0x1) AvNbComputerName : 'FMSMSX103' pair: struct AV_PAIR AvId : MsvAvDnsDomainName (0x4) AvLen : 0x0024 (36) Value : union ntlmssp_AvValue(case 0x4) AvDnsDomainName : 'amr.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsComputerName (0x3) AvLen : 0x0038 (56) Value : union ntlmssp_AvValue(case 0x3) AvDnsComputerName : 'FMSMSX103.amr.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsTreeName (0x5) AvLen : 0x001c (28) Value : union ntlmssp_AvValue(case 0x5) AvDnsTreeName : 'corp.intel.com' pair: struct AV_PAIR AvId : MsvAvTimestamp (0x7) AvLen : 0x0008 (8) Value : union ntlmssp_AvValue(case 0x7) AvTimestamp : Fri Sep 4 10:27:48 2015 BST pair: struct AV_PAIR AvId : MsvAvEOL (0x0) AvLen : 0x0000 (0) Value : union ntlmssp_AvValue(case 0x0) Version: struct ntlmssp_VERSION ProductMajorVersion : NTLMSSP_WINDOWS_MAJOR_VERSION_6 (0x6) ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_1 (0x1) ProductBuild : 0x1db1 (7601) Reserved : 000000 NTLMRevisionCurrent : NTLMSSP_REVISION_W2K3 (0xF) Got challenge flags: Got NTLMSSP neg_flags=0xa2898215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_TARGET_INFO NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_56 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP challenge set by NTLM2 challenge is: [0000] 6C 45 03 E3 7C 23 33 4E lE..|#3N authenticate: struct AUTHENTICATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmAuthenticate (3) LmChallengeResponseLen : 0x0018 (24) LmChallengeResponseMaxLen: 0x0018 (24) LmChallengeResponse : * LmChallengeResponse : union ntlmssp_LM_RESPONSE(case 24) v1: struct LM_RESPONSE Response : c98015424953015000000000000000000000000000000000 NtChallengeResponseLen : 0x0018 (24) NtChallengeResponseMaxLen: 0x0018 (24) NtChallengeResponse : * NtChallengeResponse : union ntlmssp_NTLM_RESPONSE(case 24) v1: struct NTLM_RESPONSE Response : 784499aef4498dfefd12ded4cbc6542e6e0fe86e3c9bb46f DomainNameLen : 0x0006 (6) DomainNameMaxLen : 0x0006 (6) DomainName : * DomainName : 'GER' UserNameLen : 0x0010 (16) UserNameMaxLen : 0x0010 (16) UserName : * UserName : 'dwoodhou' WorkstationLen : 0x001c (28) WorkstationMaxLen : 0x001c (28) Workstation : * Workstation : 'DWOODHOU-LINUX' EncryptedRandomSessionKeyLen: 0x0000 (0) EncryptedRandomSessionKeyMaxLen: 0x0000 (0) EncryptedRandomSessionKey: * EncryptedRandomSessionKey: DATA_BLOB length=0 NegotiateFlags : 0x20088215 (537428501) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 Starting GENSEC mechanism ntlmssp3_client negotiate: struct NEGOTIATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmNegotiate (1) NegotiateFlags : 0x60088215 (1611170325) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 1: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 DomainNameLen : 0x0003 (3) DomainNameMaxLen : 0x0003 (3) DomainName : * DomainName : 'GER' WorkstationLen : 0x000e (14) WorkstationMaxLen : 0x000e (14) Workstation : * Workstation : 'DWOODHOU-LINUX' challenge: struct CHALLENGE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmChallenge (0x2) TargetNameLen : 0x0006 (6) TargetNameMaxLen : 0x0006 (6) TargetName : * TargetName : 'AMR' NegotiateFlags : 0xa2898215 (2726920725) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 1: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 1: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 1: NTLMSSP_NEGOTIATE_56 ServerChallenge : 71eb47baebcf3a1e Reserved : 0000000000000000 TargetInfoLen : 0x00b4 (180) TargetNameInfoMaxLen : 0x00b4 (180) TargetInfo : * TargetInfo: struct AV_PAIR_LIST count : 0x00000007 (7) pair: ARRAY(7) pair: struct AV_PAIR AvId : MsvAvNbDomainName (0x2) AvLen : 0x0006 (6) Value : union ntlmssp_AvValue(case 0x2) AvNbDomainName : 'AMR' pair: struct AV_PAIR AvId : MsvAvNbComputerName (0x1) AvLen : 0x0012 (18) Value : union ntlmssp_AvValue(case 0x1) AvNbComputerName : 'FMSMSX103' pair: struct AV_PAIR AvId : MsvAvDnsDomainName (0x4) AvLen : 0x0024 (36) Value : union ntlmssp_AvValue(case 0x4) AvDnsDomainName : 'amr.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsComputerName (0x3) AvLen : 0x0038 (56) Value : union ntlmssp_AvValue(case 0x3) AvDnsComputerName : 'FMSMSX103.amr.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsTreeName (0x5) AvLen : 0x001c (28) Value : union ntlmssp_AvValue(case 0x5) AvDnsTreeName : 'corp.intel.com' pair: struct AV_PAIR AvId : MsvAvTimestamp (0x7) AvLen : 0x0008 (8) Value : union ntlmssp_AvValue(case 0x7) AvTimestamp : Fri Sep 4 10:27:49 2015 BST pair: struct AV_PAIR AvId : MsvAvEOL (0x0) AvLen : 0x0000 (0) Value : union ntlmssp_AvValue(case 0x0) Version: struct ntlmssp_VERSION ProductMajorVersion : NTLMSSP_WINDOWS_MAJOR_VERSION_6 (0x6) ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_1 (0x1) ProductBuild : 0x1db1 (7601) Reserved : 000000 NTLMRevisionCurrent : NTLMSSP_REVISION_W2K3 (0xF) Got challenge flags: Got NTLMSSP neg_flags=0xa2898215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_TARGET_INFO NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_56 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP challenge set by NTLM2 challenge is: [0000] A5 61 88 36 98 D9 E3 A6 .a.6.... authenticate: struct AUTHENTICATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmAuthenticate (3) LmChallengeResponseLen : 0x0018 (24) LmChallengeResponseMaxLen: 0x0018 (24) LmChallengeResponse : * LmChallengeResponse : union ntlmssp_LM_RESPONSE(case 24) v1: struct LM_RESPONSE Response : 5053eb3593fe20d600000000000000000000000000000000 NtChallengeResponseLen : 0x0018 (24) NtChallengeResponseMaxLen: 0x0018 (24) NtChallengeResponse : * NtChallengeResponse : union ntlmssp_NTLM_RESPONSE(case 24) v1: struct NTLM_RESPONSE Response : b79ca7cae0d6109814ba7dc94349e5c694b4e112eaaeacb0 DomainNameLen : 0x0006 (6) DomainNameMaxLen : 0x0006 (6) DomainName : * DomainName : 'GER' UserNameLen : 0x0010 (16) UserNameMaxLen : 0x0010 (16) UserName : * UserName : 'dwoodhou' WorkstationLen : 0x001c (28) WorkstationMaxLen : 0x001c (28) Workstation : * Workstation : 'DWOODHOU-LINUX' EncryptedRandomSessionKeyLen: 0x0000 (0) EncryptedRandomSessionKeyMaxLen: 0x0000 (0) EncryptedRandomSessionKey: * EncryptedRandomSessionKey: DATA_BLOB length=0 NegotiateFlags : 0x20088215 (537428501) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INTERFACE_VERSION [136877]: request interface version (version = 27) winbind_client_response_written[136877:INTERFACE_VERSION]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NETBIOS_NAME [136877]: request netbios name winbind_client_response_written[136877:NETBIOS_NAME]: delivered response to client process_request: request fn DOMAIN_NAME [136877]: request domain name winbind_client_response_written[136877:DOMAIN_NAME]: delivered response to client process_request: request fn DOMAIN_INFO [136877]: domain_info [GER] winbind_client_response_written[136877:DOMAIN_INFO]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client process_request: request fn INFO [136877]: request misc info winbind_client_response_written[136877:INFO]: delivered response to client process_request: request fn NTLMAUTH [136877]: perform NTLM auth on behalf of user GER\dwoodhou winbindd_dual_ccache_ntlm_auth: found ccache [GER\dwoodhou] Access granted to uid 500 Starting GENSEC mechanism ntlmssp3_client negotiate: struct NEGOTIATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmNegotiate (1) NegotiateFlags : 0x60088215 (1611170325) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 1: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 DomainNameLen : 0x0003 (3) DomainNameMaxLen : 0x0003 (3) DomainName : * DomainName : 'GER' WorkstationLen : 0x000e (14) WorkstationMaxLen : 0x000e (14) Workstation : * Workstation : 'DWOODHOU-LINUX' challenge: struct CHALLENGE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmChallenge (0x2) TargetNameLen : 0x0006 (6) TargetNameMaxLen : 0x0006 (6) TargetName : * TargetName : 'AMR' NegotiateFlags : 0xa2898215 (2726920725) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 1: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 1: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 1: NTLMSSP_NEGOTIATE_56 ServerChallenge : 4089e40c82bf6ec8 Reserved : 0000000000000000 TargetInfoLen : 0x00b4 (180) TargetNameInfoMaxLen : 0x00b4 (180) TargetInfo : * TargetInfo: struct AV_PAIR_LIST count : 0x00000007 (7) pair: ARRAY(7) pair: struct AV_PAIR AvId : MsvAvNbDomainName (0x2) AvLen : 0x0006 (6) Value : union ntlmssp_AvValue(case 0x2) AvNbDomainName : 'AMR' pair: struct AV_PAIR AvId : MsvAvNbComputerName (0x1) AvLen : 0x0012 (18) Value : union ntlmssp_AvValue(case 0x1) AvNbComputerName : 'FMSMSX103' pair: struct AV_PAIR AvId : MsvAvDnsDomainName (0x4) AvLen : 0x0024 (36) Value : union ntlmssp_AvValue(case 0x4) AvDnsDomainName : 'amr.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsComputerName (0x3) AvLen : 0x0038 (56) Value : union ntlmssp_AvValue(case 0x3) AvDnsComputerName : 'FMSMSX103.amr.corp.intel.com' pair: struct AV_PAIR AvId : MsvAvDnsTreeName (0x5) AvLen : 0x001c (28) Value : union ntlmssp_AvValue(case 0x5) AvDnsTreeName : 'corp.intel.com' pair: struct AV_PAIR AvId : MsvAvTimestamp (0x7) AvLen : 0x0008 (8) Value : union ntlmssp_AvValue(case 0x7) AvTimestamp : Fri Sep 4 10:27:51 2015 BST pair: struct AV_PAIR AvId : MsvAvEOL (0x0) AvLen : 0x0000 (0) Value : union ntlmssp_AvValue(case 0x0) Version: struct ntlmssp_VERSION ProductMajorVersion : NTLMSSP_WINDOWS_MAJOR_VERSION_6 (0x6) ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_1 (0x1) ProductBuild : 0x1db1 (7601) Reserved : 000000 NTLMRevisionCurrent : NTLMSSP_REVISION_W2K3 (0xF) Got challenge flags: Got NTLMSSP neg_flags=0xa2898215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_TARGET_INFO NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_56 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP challenge set by NTLM2 challenge is: [0000] ED 6F 6F 97 6B 96 99 BA .oo.k... authenticate: struct AUTHENTICATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmAuthenticate (3) LmChallengeResponseLen : 0x0018 (24) LmChallengeResponseMaxLen: 0x0018 (24) LmChallengeResponse : * LmChallengeResponse : union ntlmssp_LM_RESPONSE(case 24) v1: struct LM_RESPONSE Response : 222cdba08ab5c71c00000000000000000000000000000000 NtChallengeResponseLen : 0x0018 (24) NtChallengeResponseMaxLen: 0x0018 (24) NtChallengeResponse : * NtChallengeResponse : union ntlmssp_NTLM_RESPONSE(case 24) v1: struct NTLM_RESPONSE Response : fb4b43ac8b5d60db51c8289d714dcd909b1e7b674d94d6de DomainNameLen : 0x0006 (6) DomainNameMaxLen : 0x0006 (6) DomainName : * DomainName : 'GER' UserNameLen : 0x0010 (16) UserNameMaxLen : 0x0010 (16) UserName : * UserName : 'dwoodhou' WorkstationLen : 0x001c (28) WorkstationMaxLen : 0x001c (28) Workstation : * Workstation : 'DWOODHOU-LINUX' EncryptedRandomSessionKeyLen: 0x0000 (0) EncryptedRandomSessionKeyMaxLen: 0x0000 (0) EncryptedRandomSessionKey: * EncryptedRandomSessionKey: DATA_BLOB length=0 NegotiateFlags : 0x20088215 (537428501) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 1: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 0: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 0: NTLMSSP_NEGOTIATE_56 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x20088215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 winbind_client_response_written[136877:NTLMAUTH]: delivered response to client accepted socket 32 process_request: request fn INTERFACE_VERSION [98826]: request interface version (version = 27) winbind_client_response_written[98826:INTERFACE_VERSION]: delivered response to client process_request: request fn WINBINDD_PRIV_PIPE_DIR [98826]: request location of privileged pipe winbind_client_response_written[98826:WINBINDD_PRIV_PIPE_DIR]: delivered response to client process_request: request fn LIST_TRUSTDOM [98826]: list trusted domains winbind_client_response_written[98826:LIST_TRUSTDOM]: delivered response to client closing socket 32, client exited accepted socket 32 process_request: request fn INTERFACE_VERSION [98833]: request interface version (version = 27) winbind_client_response_written[98833:INTERFACE_VERSION]: delivered response to client process_request: request fn WINBINDD_PRIV_PIPE_DIR [98833]: request location of privileged pipe winbind_client_response_written[98833:WINBINDD_PRIV_PIPE_DIR]: delivered response to client process_request: Handling async request 98833:PAM_AUTH [98833]: pam auth dwoodhou child daemon request 13 child_process_request: request fn PAM_AUTH [98302]: dual pam auth GER\dwoodhou winbindd_dual_pam_auth: domain: GER last was offline winbindd_dual_pam_auth_cached centry_expired: Key NS/GER/DWOODHOU for domain GER valid as winbindd is globally offline. wcache_fetch: returning entry NS/GER/DWOODHOU for domain GER name_to_sid: [Cached] - cached name for domain GER status: NT_STATUS_OK centry_expired: Key CRED/S-1-5-21-2052111302-1275210071-1644491937-279532 for domain GER valid as winbindd is globally offline. wcache_fetch: returning entry CRED/S-1-5-21-2052111302-1275210071-1644491937-279532 for domain GER wcache_get_creds: [Cached] - cached creds for user S-1-5-21-2052111302-1275210071-1644491937-279532 status: NT_STATUS_OK netsamlogon_cache_get: SID [S-1-5-21-2052111302-1275210071-1644491937-279532] &r: struct netsamlogoncache_entry timestamp : Fri Sep 4 10:27:26 2015 BST info3: struct netr_SamInfo3 base: struct netr_SamBaseInfo logon_time : Fri Sep 4 10:27:26 2015 BST logoff_time : Thu Sep 14 03:48:05 30828 BST kickoff_time : Thu Sep 14 03:48:05 30828 BST last_password_change : Tue Jul 7 12:11:37 2015 BST allow_password_change : Tue Jul 7 12:11:37 2015 BST force_password_change : Mon Oct 5 12:11:37 2015 BST account_name: struct lsa_String length : 0x0010 (16) size : 0x0010 (16) string : * string : 'dwoodhou' full_name: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'Woodhouse, David' logon_script: struct lsa_String length : 0x0012 (18) size : 0x0012 (18) string : * string : 'logon.bat' profile_path: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_directory: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_drive: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' logon_count : 0x0203 (515) bad_password_count : 0x0000 (0) rid : 0x000443ec (279532) primary_gid : 0x00000201 (513) groups: struct samr_RidWithAttributeArray count : 0x0000000b (11) rids : * rids: ARRAY(11) rids: struct samr_RidWithAttribute rid : 0x00000201 (513) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0008aee7 (569063) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0009a9f5 (633333) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0002fe8e (196238) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000298ad (170157) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00096b33 (617267) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000497d9 (301017) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00062c74 (404596) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0001cb24 (117540) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00063a5b (408155) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000549d6 (346582) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) user_flags : 0x00000024 (36) 0: NETLOGON_GUEST 0: NETLOGON_NOENCRYPTION 1: NETLOGON_CACHED_ACCOUNT 0: NETLOGON_USED_LM_PASSWORD 1: NETLOGON_EXTRA_SIDS 0: NETLOGON_SUBAUTH_SESSION_KEY 0: NETLOGON_SERVER_TRUST_ACCOUNT 0: NETLOGON_NTLMV2_ENABLED 0: NETLOGON_RESOURCE_GROUPS 0: NETLOGON_PROFILE_PATH_RETURNED 0: NETLOGON_GRACE_LOGON key: struct netr_UserSessionKey key : 00000000000000000000000000000000 logon_server: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'IRSGER402' logon_domain: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'GER' domain_sid : * domain_sid : S-1-5-21-2052111302-1275210071-1644491937 LMSessKey: struct netr_LMSessionKey key : 0000000000000000 acct_flags : 0x00000010 (16) 0: ACB_DISABLED 0: ACB_HOMDIRREQ 0: ACB_PWNOTREQ 0: ACB_TEMPDUP 1: ACB_NORMAL 0: ACB_MNS 0: ACB_DOMTRUST 0: ACB_WSTRUST 0: ACB_SVRTRUST 0: ACB_PWNOEXP 0: ACB_AUTOLOCK 0: ACB_ENC_TXT_PWD_ALLOWED 0: ACB_SMARTCARD_REQUIRED 0: ACB_TRUSTED_FOR_DELEGATION 0: ACB_NOT_DELEGATED 0: ACB_USE_DES_KEY_ONLY 0: ACB_DONT_REQUIRE_PREAUTH 0: ACB_PW_EXPIRED 0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION 0: ACB_NO_AUTH_DATA_REQD 0: ACB_PARTIAL_SECRETS_ACCOUNT 0: ACB_USE_AES_KEYS sub_auth_status : 0x00000000 (0) last_successful_logon : NTTIME(0) last_failed_logon : NTTIME(0) failed_logon_count : 0x00000000 (0) reserved : 0x00000000 (0) sidcount : 0x00000044 (68) sids : * sids: ARRAY(68) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-3050236 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2403581 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924259 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-44669 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2620541 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2717936 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5346 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2506613 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381315 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1993781 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2718125 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-1757981266-725345543-1404487317-124700 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308934 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-632733 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-710385 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-938523 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-389586 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308935 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-971119 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1163455 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2360597 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-2750 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381303 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5273 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2297010 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1235048 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-6424 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2304480 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1048331 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1150207 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2379415 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-921311 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1539736 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2535322 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-876174 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2371110 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-18345 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2788958 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2629228 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2479093 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2257863 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-537526 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2296849 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2571102 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2309097 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-719732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924260 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2755522 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2848078 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1715732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2628756 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1654171 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-411987 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2619776 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1422688 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-12124 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-412953 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2016132 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2612803 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2464652 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-55165 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2650967 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2485486 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2762591 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1330665 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2411815 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-105273194-1791699089-474703532-513 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-18-1 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) wcache_tdc_fetch_domain: Searching for domain GER wcache_tdc_fetch_domain: Found domain GER using ccache: FILE:/tmp/krb5cc_500 add_ccache_to_list: ref count on entry GER\dwoodhou is now 2 winbindd_add_memory_creds_internal: ref count for user GER\dwoodhou is now 2 winbindd_add_memory_creds returned: NT_STATUS_OK wcache_save_creds: S-1-5-21-2052111302-1275210071-1644491937-279532 netsamlogon_cache_store: SID [S-1-5-21-2052111302-1275210071-1644491937-279532] &r: struct netsamlogoncache_entry timestamp : Fri Sep 4 10:28:05 2015 BST info3: struct netr_SamInfo3 base: struct netr_SamBaseInfo logon_time : Fri Sep 4 10:28:05 2015 BST logoff_time : Thu Sep 14 03:48:05 30828 BST kickoff_time : Thu Sep 14 03:48:05 30828 BST last_password_change : Tue Jul 7 12:11:37 2015 BST allow_password_change : Tue Jul 7 12:11:37 2015 BST force_password_change : Mon Oct 5 12:11:37 2015 BST account_name: struct lsa_String length : 0x0010 (16) size : 0x0010 (16) string : * string : 'dwoodhou' full_name: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'Woodhouse, David' logon_script: struct lsa_String length : 0x0012 (18) size : 0x0012 (18) string : * string : 'logon.bat' profile_path: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_directory: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_drive: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' logon_count : 0x0203 (515) bad_password_count : 0x0000 (0) rid : 0x000443ec (279532) primary_gid : 0x00000201 (513) groups: struct samr_RidWithAttributeArray count : 0x0000000b (11) rids : * rids: ARRAY(11) rids: struct samr_RidWithAttribute rid : 0x00000201 (513) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0008aee7 (569063) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0009a9f5 (633333) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0002fe8e (196238) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000298ad (170157) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00096b33 (617267) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000497d9 (301017) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00062c74 (404596) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0001cb24 (117540) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00063a5b (408155) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000549d6 (346582) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) user_flags : 0x00000024 (36) 0: NETLOGON_GUEST 0: NETLOGON_NOENCRYPTION 1: NETLOGON_CACHED_ACCOUNT 0: NETLOGON_USED_LM_PASSWORD 1: NETLOGON_EXTRA_SIDS 0: NETLOGON_SUBAUTH_SESSION_KEY 0: NETLOGON_SERVER_TRUST_ACCOUNT 0: NETLOGON_NTLMV2_ENABLED 0: NETLOGON_RESOURCE_GROUPS 0: NETLOGON_PROFILE_PATH_RETURNED 0: NETLOGON_GRACE_LOGON key: struct netr_UserSessionKey key : 00000000000000000000000000000000 logon_server: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'IRSGER402' logon_domain: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'GER' domain_sid : * domain_sid : S-1-5-21-2052111302-1275210071-1644491937 LMSessKey: struct netr_LMSessionKey key : 0000000000000000 acct_flags : 0x00000010 (16) 0: ACB_DISABLED 0: ACB_HOMDIRREQ 0: ACB_PWNOTREQ 0: ACB_TEMPDUP 1: ACB_NORMAL 0: ACB_MNS 0: ACB_DOMTRUST 0: ACB_WSTRUST 0: ACB_SVRTRUST 0: ACB_PWNOEXP 0: ACB_AUTOLOCK 0: ACB_ENC_TXT_PWD_ALLOWED 0: ACB_SMARTCARD_REQUIRED 0: ACB_TRUSTED_FOR_DELEGATION 0: ACB_NOT_DELEGATED 0: ACB_USE_DES_KEY_ONLY 0: ACB_DONT_REQUIRE_PREAUTH 0: ACB_PW_EXPIRED 0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION 0: ACB_NO_AUTH_DATA_REQD 0: ACB_PARTIAL_SECRETS_ACCOUNT 0: ACB_USE_AES_KEYS sub_auth_status : 0x00000000 (0) last_successful_logon : NTTIME(0) last_failed_logon : NTTIME(0) failed_logon_count : 0x00000000 (0) reserved : 0x00000000 (0) sidcount : 0x00000044 (68) sids : * sids: ARRAY(68) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-3050236 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2403581 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924259 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-44669 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2620541 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2717936 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5346 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2506613 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381315 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1993781 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2718125 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-1757981266-725345543-1404487317-124700 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308934 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-632733 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-710385 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-938523 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-389586 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308935 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-971119 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1163455 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2360597 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-2750 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381303 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5273 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2297010 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1235048 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-6424 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2304480 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1048331 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1150207 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2379415 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-921311 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1539736 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2535322 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-876174 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2371110 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-18345 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2788958 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2629228 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2479093 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2257863 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-537526 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2296849 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2571102 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2309097 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-719732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924260 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2755522 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2848078 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1715732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2628756 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1654171 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-411987 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2619776 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1422688 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-12124 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-412953 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2016132 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2612803 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2464652 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-55165 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2650967 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2485486 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2762591 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1330665 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2411815 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-105273194-1791699089-474703532-513 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-18-1 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) winbindd_dual_pam_auth_cached succeeded netsamlogon_cache_store: SID [S-1-5-21-2052111302-1275210071-1644491937-279532] &r: struct netsamlogoncache_entry timestamp : Fri Sep 4 10:28:05 2015 BST info3: struct netr_SamInfo3 base: struct netr_SamBaseInfo logon_time : Fri Sep 4 10:28:05 2015 BST logoff_time : Thu Sep 14 03:48:05 30828 BST kickoff_time : Thu Sep 14 03:48:05 30828 BST last_password_change : Tue Jul 7 12:11:37 2015 BST allow_password_change : Tue Jul 7 12:11:37 2015 BST force_password_change : Mon Oct 5 12:11:37 2015 BST account_name: struct lsa_String length : 0x0010 (16) size : 0x0010 (16) string : * string : 'dwoodhou' full_name: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'Woodhouse, David' logon_script: struct lsa_String length : 0x0012 (18) size : 0x0012 (18) string : * string : 'logon.bat' profile_path: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_directory: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_drive: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' logon_count : 0x0203 (515) bad_password_count : 0x0000 (0) rid : 0x000443ec (279532) primary_gid : 0x00000201 (513) groups: struct samr_RidWithAttributeArray count : 0x0000000b (11) rids : * rids: ARRAY(11) rids: struct samr_RidWithAttribute rid : 0x00000201 (513) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0008aee7 (569063) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0009a9f5 (633333) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0002fe8e (196238) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000298ad (170157) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00096b33 (617267) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000497d9 (301017) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00062c74 (404596) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0001cb24 (117540) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00063a5b (408155) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000549d6 (346582) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) user_flags : 0x00000024 (36) 0: NETLOGON_GUEST 0: NETLOGON_NOENCRYPTION 1: NETLOGON_CACHED_ACCOUNT 0: NETLOGON_USED_LM_PASSWORD 1: NETLOGON_EXTRA_SIDS 0: NETLOGON_SUBAUTH_SESSION_KEY 0: NETLOGON_SERVER_TRUST_ACCOUNT 0: NETLOGON_NTLMV2_ENABLED 0: NETLOGON_RESOURCE_GROUPS 0: NETLOGON_PROFILE_PATH_RETURNED 0: NETLOGON_GRACE_LOGON key: struct netr_UserSessionKey key : 00000000000000000000000000000000 logon_server: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'IRSGER402' logon_domain: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'GER' domain_sid : * domain_sid : S-1-5-21-2052111302-1275210071-1644491937 LMSessKey: struct netr_LMSessionKey key : 0000000000000000 acct_flags : 0x00000010 (16) 0: ACB_DISABLED 0: ACB_HOMDIRREQ 0: ACB_PWNOTREQ 0: ACB_TEMPDUP 1: ACB_NORMAL 0: ACB_MNS 0: ACB_DOMTRUST 0: ACB_WSTRUST 0: ACB_SVRTRUST 0: ACB_PWNOEXP 0: ACB_AUTOLOCK 0: ACB_ENC_TXT_PWD_ALLOWED 0: ACB_SMARTCARD_REQUIRED 0: ACB_TRUSTED_FOR_DELEGATION 0: ACB_NOT_DELEGATED 0: ACB_USE_DES_KEY_ONLY 0: ACB_DONT_REQUIRE_PREAUTH 0: ACB_PW_EXPIRED 0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION 0: ACB_NO_AUTH_DATA_REQD 0: ACB_PARTIAL_SECRETS_ACCOUNT 0: ACB_USE_AES_KEYS sub_auth_status : 0x00000000 (0) last_successful_logon : NTTIME(0) last_failed_logon : NTTIME(0) failed_logon_count : 0x00000000 (0) reserved : 0x00000000 (0) sidcount : 0x00000044 (68) sids : * sids: ARRAY(68) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-3050236 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2403581 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924259 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-44669 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2620541 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2717936 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5346 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2506613 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381315 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1993781 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2718125 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-1757981266-725345543-1404487317-124700 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308934 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-632733 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-710385 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-938523 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-389586 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308935 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-971119 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1163455 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2360597 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-2750 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381303 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5273 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2297010 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1235048 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-6424 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2304480 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1048331 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1150207 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2379415 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-921311 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1539736 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2535322 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-876174 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2371110 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-18345 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2788958 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2629228 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2479093 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2257863 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-537526 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2296849 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2571102 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2309097 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-719732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924260 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2755522 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2848078 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1715732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2628756 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1654171 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-411987 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2619776 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1422688 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-12124 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-412953 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2016132 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2612803 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2464652 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-55165 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2650967 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2485486 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2762591 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1330665 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2411815 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-105273194-1791699089-474703532-513 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-18-1 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) wcache_save_name_to_sid: GER\DWOODHOU -> S-1-5-21-2052111302-1275210071-1644491937-279532 (NT_STATUS_OK) wcache_save_creds: S-1-5-21-2052111302-1275210071-1644491937-279532 netsamlogon_cache_store: SID [S-1-5-21-2052111302-1275210071-1644491937-279532] &r: struct netsamlogoncache_entry timestamp : Fri Sep 4 10:28:05 2015 BST info3: struct netr_SamInfo3 base: struct netr_SamBaseInfo logon_time : Fri Sep 4 10:28:05 2015 BST logoff_time : Thu Sep 14 03:48:05 30828 BST kickoff_time : Thu Sep 14 03:48:05 30828 BST last_password_change : Tue Jul 7 12:11:37 2015 BST allow_password_change : Tue Jul 7 12:11:37 2015 BST force_password_change : Mon Oct 5 12:11:37 2015 BST account_name: struct lsa_String length : 0x0010 (16) size : 0x0010 (16) string : * string : 'dwoodhou' full_name: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'Woodhouse, David' logon_script: struct lsa_String length : 0x0012 (18) size : 0x0012 (18) string : * string : 'logon.bat' profile_path: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_directory: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' home_drive: struct lsa_String length : 0x0000 (0) size : 0x0000 (0) string : * string : '' logon_count : 0x0203 (515) bad_password_count : 0x0000 (0) rid : 0x000443ec (279532) primary_gid : 0x00000201 (513) groups: struct samr_RidWithAttributeArray count : 0x0000000b (11) rids : * rids: ARRAY(11) rids: struct samr_RidWithAttribute rid : 0x00000201 (513) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0008aee7 (569063) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0009a9f5 (633333) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0002fe8e (196238) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000298ad (170157) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00096b33 (617267) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000497d9 (301017) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00062c74 (404596) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x0001cb24 (117540) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x00063a5b (408155) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) rids: struct samr_RidWithAttribute rid : 0x000549d6 (346582) attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) user_flags : 0x00000024 (36) 0: NETLOGON_GUEST 0: NETLOGON_NOENCRYPTION 1: NETLOGON_CACHED_ACCOUNT 0: NETLOGON_USED_LM_PASSWORD 1: NETLOGON_EXTRA_SIDS 0: NETLOGON_SUBAUTH_SESSION_KEY 0: NETLOGON_SERVER_TRUST_ACCOUNT 0: NETLOGON_NTLMV2_ENABLED 0: NETLOGON_RESOURCE_GROUPS 0: NETLOGON_PROFILE_PATH_RETURNED 0: NETLOGON_GRACE_LOGON key: struct netr_UserSessionKey key : 00000000000000000000000000000000 logon_server: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'IRSGER402' logon_domain: struct lsa_StringLarge length : 0x0006 (6) size : 0x0008 (8) string : * string : 'GER' domain_sid : * domain_sid : S-1-5-21-2052111302-1275210071-1644491937 LMSessKey: struct netr_LMSessionKey key : 0000000000000000 acct_flags : 0x00000010 (16) 0: ACB_DISABLED 0: ACB_HOMDIRREQ 0: ACB_PWNOTREQ 0: ACB_TEMPDUP 1: ACB_NORMAL 0: ACB_MNS 0: ACB_DOMTRUST 0: ACB_WSTRUST 0: ACB_SVRTRUST 0: ACB_PWNOEXP 0: ACB_AUTOLOCK 0: ACB_ENC_TXT_PWD_ALLOWED 0: ACB_SMARTCARD_REQUIRED 0: ACB_TRUSTED_FOR_DELEGATION 0: ACB_NOT_DELEGATED 0: ACB_USE_DES_KEY_ONLY 0: ACB_DONT_REQUIRE_PREAUTH 0: ACB_PW_EXPIRED 0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION 0: ACB_NO_AUTH_DATA_REQD 0: ACB_PARTIAL_SECRETS_ACCOUNT 0: ACB_USE_AES_KEYS sub_auth_status : 0x00000000 (0) last_successful_logon : NTTIME(0) last_failed_logon : NTTIME(0) failed_logon_count : 0x00000000 (0) reserved : 0x00000000 (0) sidcount : 0x00000044 (68) sids : * sids: ARRAY(68) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-3050236 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2403581 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924259 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-44669 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2620541 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2717936 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5346 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2506613 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381315 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1993781 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2718125 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-1757981266-725345543-1404487317-124700 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308934 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-632733 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-710385 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-938523 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-389586 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2308935 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-971119 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1163455 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2360597 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-2750 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2381303 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-5273 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2297010 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1235048 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-6424 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2304480 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1048331 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1150207 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2379415 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-921311 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1539736 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2535322 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-876174 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2371110 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-18345 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2788958 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2629228 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2479093 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2257863 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-537526 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2296849 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2571102 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2309097 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-719732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2924260 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2755522 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2848078 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1715732 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2628756 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1654171 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-411987 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2619776 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1422688 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-12124 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-412953 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2016132 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2612803 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2464652 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-823518204-2139871995-682003330-55165 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2650967 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2485486 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2762591 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-1330665 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-725345543-602162358-527237240-2411815 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-5-21-105273194-1791699089-474703532-513 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) sids: struct netr_SidAttr sid : * sid : S-1-18-1 attributes : 0x00000007 (7) 1: SE_GROUP_MANDATORY 1: SE_GROUP_ENABLED_BY_DEFAULT 1: SE_GROUP_ENABLED 0: SE_GROUP_OWNER 0: SE_GROUP_USE_FOR_DENY_ONLY 0: SE_GROUP_RESOURCE 0x00: SE_GROUP_LOGON_ID (0) Plain-text authentication for user GER\dwoodhou returned NT_STATUS_OK (PAM: 0) Finished processing child request 13 Writing 7620 bytes to parent winbindd_add_memory_creds_internal: ref count for user GER\dwoodhou is now 2 winbindd_add_memory_creds returned: NT_STATUS_OK wb_request_done[98833:PAM_AUTH]: NT_STATUS_OK winbind_client_response_written[98833:PAM_AUTH]: delivered response to client closing socket 32, client exited ^CGot sig[2] terminate (is_parent=1) Got sig[2] terminate (is_parent=0) Got sig[2] terminate (is_parent=0) check lock order 2 for /var/lib/samba/serverid.tdb lock order: 1: 2:/var/lib/samba/serverid.tdb 3: Locking key FE7F010000000000FFFF Allocated locked data 0x0x55ff70cc9700 Unlocking key FE7F010000000000FFFF release lock order 2 for /var/lib/samba/serverid.tdb lock order: 1: 2: 3: ]777;notify;Command completed;/usr/sbin/winbindd -d10 -SF]0;dwoodhou@i7:/home/dwmw2/fedora/samba/f22/results_samba/4.2.2/1.1.fc22]7;file://i7.infradead.org/home/dwmw2/fedora/samba/f22/results_samba/4.2.2/1.1.fc22[root@i7 1.1.fc22]# exit Script done on Fri 04 Sep 2015 10:28:25 BST