[2016/02/28 20:46:58.548075, 3, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:3714(lp_load_ex) lp_load_ex: refreshing parameters [2016/02/28 20:46:58.548092, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:1296(free_param_opts) Freeing parametrics: [2016/02/28 20:46:58.548127, 3, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:527(init_globals) Initialising global parameters [2016/02/28 20:46:58.548140, 2, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:316(max_open_files) rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) [2016/02/28 20:46:58.548195, 3, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:2643(lp_do_section) Processing section "[global]" doing parameter netbios name = uri-vgw-4 doing parameter server string = doing parameter encrypt passwords = yes doing parameter server signing = disabled doing parameter log level = 10 [2016/02/28 20:46:58.548228, 5, pid=29680, effective(0, 0), real(0, 0)] ../lib/util/debug.c:638(debug_dump_status) INFO: Current debug levels: all: 10 tdb: 10 printdrivers: 10 lanman: 10 smb: 10 rpc_parse: 10 rpc_srv: 10 rpc_cli: 10 passdb: 10 sam: 10 auth: 10 winbind: 10 vfs: 10 idmap: 10 quota: 10 acls: 10 locking: 10 msdfs: 10 dmapi: 10 registry: 10 scavenger: 10 dns: 10 ldb: 10 tevent: 10 doing parameter debug pid = yes doing parameter read only = no doing parameter guest account = nobody doing parameter deadtime = 10 doing parameter enable core files = no doing parameter max smbd processes = 30 doing parameter passdb backend = smbpasswd doing parameter socket options = TCP_KEEPIDLE=120 TCP_KEEPCNT=3 TCP_KEEPINTVL=5 doing parameter disable netbios = yes doing parameter restrict anonymous = 2 doing parameter client max protocol = SMB3 doing parameter aio read size = 4096 doing parameter aio write size = 4096 doing parameter security = ads doing parameter workgroup = CHILD2 doing parameter realm = CHILD2.DOMAIN.LOCAL doing parameter kerberos method = secrets only doing parameter machine password timeout = 0 doing parameter allow trusted domains = yes doing parameter winbind use default domain = yes doing parameter winbind additional group sids = S-1-1-0 doing parameter client ldap sasl wrapping = sign doing parameter saf:ttl = 86400 doing parameter winbind max clients = 130 doing parameter idmap config * : backend = passdb doing parameter idmap config * : range = 0-199999 doing parameter idmap config CHILD2:backend = rid doing parameter idmap config CHILD2:range = 200000-4999999 doing parameter idmap config DOMAIN:backend = rid doing parameter idmap config DOMAIN:range = 5000000-9999999 doing parameter idmap config CHILD:backend = rid doing parameter idmap config CHILD:range = 10000000-14999999 doing parameter map to guest = never doing parameter max log size = 10000 doing parameter lock directory = /var/vol/3/.ctera/samba/lock doing parameter state directory = /var/vol/3/.ctera/samba doing parameter cache directory = /var/vol/3/.ctera/samba/cache [2016/02/28 20:46:58.548742, 4, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:3755(lp_load_ex) pm_process() returned Yes [2016/02/28 20:46:58.548755, 7, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:4071(lp_servicenumber) lp_servicenumber: couldn't find homes [2016/02/28 20:46:58.548843, 2, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/interface.c:341(add_interface) added interface eth0 ip=192.168.91.3 bcast=192.168.95.255 netmask=255.255.248.0 [2016/02/28 20:46:58.548880, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/util_names.c:152(init_names) Netbios name list:- my_netbios_names[0]="URI-VGW-4" [2016/02/28 20:46:58.548912, 2, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/interface.c:341(add_interface) added interface eth0 ip=192.168.91.3 bcast=192.168.95.255 netmask=255.255.248.0 [2016/02/28 20:46:58.549044, 8, pid=29680, effective(0, 0), real(0, 0)] ../lib/util/util.c:394(fcntl_lock) fcntl_lock 18 6 0 1 1 [2016/02/28 20:46:58.549095, 8, pid=29680, effective(0, 0), real(0, 0)] ../lib/util/util.c:429(fcntl_lock) fcntl_lock: Lock call successful [2016/02/28 20:46:58.549113, 4, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/time.c:266(TimeInit) TimeInit: Serverzone is -7200 [2016/02/28 20:46:58.549297, 0, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:3245(initialize_winbindd_cache) initialize_winbindd_cache: clearing cache and re-creating with version number 2 [2016/02/28 20:46:58.555520, 5, pid=29680, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/serverid.tdb [2016/02/28 20:46:58.555537, 10, pid=29680, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/serverid.tdb 3: [2016/02/28 20:46:58.555549, 10, pid=29680, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key F073000000000000FFFF [2016/02/28 20:46:58.555560, 10, pid=29680, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff443045f0 [2016/02/28 20:46:58.555594, 10, pid=29680, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key F073000000000000FFFF [2016/02/28 20:46:58.555606, 5, pid=29680, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/serverid.tdb [2016/02/28 20:46:58.555613, 10, pid=29680, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:58.555622, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 33 - private_data=(nil) [2016/02/28 20:46:58.555629, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 13 - private_data=(nil) [2016/02/28 20:46:58.555637, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:46:58.555644, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:46:58.555651, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1029 - private_data=(nil) [2016/02/28 20:46:58.555657, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1036 - private_data=(nil) [2016/02/28 20:46:58.555664, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1035 - private_data=(nil) [2016/02/28 20:46:58.555671, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:46:58.555678, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1032 - private_data=(nil) [2016/02/28 20:46:58.555684, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1033 - private_data=(nil) [2016/02/28 20:46:58.555691, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:46:58.555698, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:46:58.555710, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:461(messaging_register) Overriding messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:46:58.555875, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4699(wcache_tdc_add_domain) wcache_tdc_add_domain: Adding domain BUILTIN ((null)), SID S-1-5-32, flags = 0x0, attributes = 0x0, type = 0x0 [2016/02/28 20:46:58.555899, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4502(pack_tdc_domains) pack_tdc_domains: Packing 1 trusted domains [2016/02/28 20:46:58.555911, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) [2016/02/28 20:46:58.555970, 2, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:266(add_trusted_domain) Added domain BUILTIN (null) S-1-5-32 [2016/02/28 20:46:58.555987, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4699(wcache_tdc_add_domain) wcache_tdc_add_domain: Adding domain URI-VGW-4 ((null)), SID S-1-5-21-1247966704-913105281-4028998813, flags = 0x0, attributes = 0x0, type = 0x0 [2016/02/28 20:46:58.556005, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4502(pack_tdc_domains) pack_tdc_domains: Packing 2 trusted domains [2016/02/28 20:46:58.556016, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) [2016/02/28 20:46:58.556023, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain URI-VGW-4 (UNKNOWN) [2016/02/28 20:46:58.556039, 2, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:266(add_trusted_domain) Added domain URI-VGW-4 (null) S-1-5-21-1247966704-913105281-4028998813 [2016/02/28 20:46:58.556057, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4699(wcache_tdc_add_domain) wcache_tdc_add_domain: Adding domain CHILD2 (CHILD2.DOMAIN.LOCAL), SID S-1-5-21-733680754-3169875714-4083418759, flags = 0x0, attributes = 0x0, type = 0x0 [2016/02/28 20:46:58.556073, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4502(pack_tdc_domains) pack_tdc_domains: Packing 3 trusted domains [2016/02/28 20:46:58.556083, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) [2016/02/28 20:46:58.556090, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain URI-VGW-4 (UNKNOWN) [2016/02/28 20:46:58.556098, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD2 (CHILD2.DOMAIN.LOCAL) [2016/02/28 20:46:58.556113, 2, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:266(add_trusted_domain) Added domain CHILD2 CHILD2.DOMAIN.LOCAL S-1-5-21-733680754-3169875714-4083418759 [2016/02/28 20:46:58.556125, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:566(set_domain_online_request) set_domain_online_request: called for domain CHILD2 [2016/02/28 20:46:58.556135, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:601(set_domain_online_request) set_domain_online_request: domain CHILD2 was globally offline. [2016/02/28 20:46:58.556317, 0, pid=29680, effective(0, 0), real(0, 0)] ../lib/util/become_daemon.c:124(daemon_ready) STATUS=daemon 'winbindd' finished starting up and ready to serve connections [2016/02/28 20:46:58.556391, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1420(fork_domain_child) fork_domain_child called for domain 'CHILD2' [2016/02/28 20:46:58.562381, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1476(fork_domain_child) Child process 29681 [2016/02/28 20:46:58.562668, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 33 - private_data=(nil) [2016/02/28 20:46:58.562689, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 13 - private_data=(nil) [2016/02/28 20:46:58.562697, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:46:58.562704, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:46:58.562711, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1029 - private_data=(nil) [2016/02/28 20:46:58.562718, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:46:58.562725, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1033 - private_data=(nil) [2016/02/28 20:46:58.562732, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:46:58.562743, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1036 - private_data=(nil) [2016/02/28 20:46:58.562751, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1035 - private_data=(nil) [2016/02/28 20:46:58.562815, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:46:58.562830, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:46:58.562837, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:46:58.562844, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:46:58.562850, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:46:58.562858, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:461(messaging_register) Overriding messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:46:58.562868, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:566(set_domain_online_request) set_domain_online_request: called for domain CHILD2 [2016/02/28 20:46:58.562878, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:601(set_domain_online_request) set_domain_online_request: domain CHILD2 was globally offline. [2016/02/28 20:46:58.562928, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1007(calculate_next_machine_pwd_change) machine password never expires [2016/02/28 20:46:58.562957, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 51 [2016/02/28 20:46:58.562968, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn INIT_CONNECTION [2016/02/28 20:46:58.562983, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2118(connection_ok) connection_ok: Connection to (null) for domain CHILD2 is not connected [2016/02/28 20:46:58.563009, 5, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:73(gencache_init) Opening cache file at /var/vol/3/.ctera/samba/cache/gencache.tdb [2016/02/28 20:46:58.563076, 5, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:124(gencache_init) Opening cache file at /var/vol/3/.ctera/samba/lock/gencache_notrans.tdb [2016/02/28 20:46:58.566683, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "CHILD2" domain [2016/02/28 20:46:58.566717, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server Srv.child2.domain.local [2016/02/28 20:46:58.566728, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1876(cm_open_connection) cm_open_connection: saf_servername is 'Srv.child2.domain.local' for domain CHILD2 [2016/02/28 20:46:58.566742, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1917(cm_open_connection) cm_open_connection: dcname is 'Srv.child2.domain.local' for domain CHILD2 [2016/02/28 20:46:58.566755, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server Srv.child2.domain.local [2016/02/28 20:46:58.566769, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:46:58.566779, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:46:58.566793, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:46:58.566837, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:46:58.566881, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.82.95 at port 445 [2016/02/28 20:46:58.567508, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1023(cm_prepare_connection) cm_prepare_connection: connecting to DC Srv.child2.domain.local for domain CHILD2 [2016/02/28 20:46:58.569851, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:46:58.569932, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:46:58.569955, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:58.569966, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44314150 [2016/02/28 20:46:58.569984, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44313980 [2016/02/28 20:46:58.569994, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44314150 "ltdb_callback" [2016/02/28 20:46:58.570014, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44313980 "ltdb_timeout" [2016/02/28 20:46:58.570024, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44314150 "ltdb_callback" [2016/02/28 20:46:58.570033, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:46:58.570042, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:46:58.570052, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:46:58.570064, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:46:58.570081, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:46:58.570101, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:58.570109, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44314580 [2016/02/28 20:46:58.570118, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44314300 [2016/02/28 20:46:58.570127, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44314580 "ltdb_callback" [2016/02/28 20:46:58.570136, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:46:58.570144, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44314300 "ltdb_timeout" [2016/02/28 20:46:58.570153, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44314580 "ltdb_callback" [2016/02/28 20:46:58.570167, 3, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:46:58.570199, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:46:58.570219, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:58.570227, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44313830 [2016/02/28 20:46:58.570245, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44313a90 [2016/02/28 20:46:58.570255, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44313830 "ltdb_callback" [2016/02/28 20:46:58.570356, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44313a90 "ltdb_timeout" [2016/02/28 20:46:58.570369, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44313830 "ltdb_callback" [2016/02/28 20:46:58.570403, 5, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1116(cm_prepare_connection) connecting to Srv.child2.domain.local from URI-VGW-4 with kerberos principal [URI-VGW-4$@CHILD2.DOMAIN.LOCAL] and realm [CHILD2.DOMAIN.LOCAL] [2016/02/28 20:46:58.570435, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1772(cli_session_setup_spnego_send) Doing spnego session setup (blob length=120) [2016/02/28 20:46:58.570472, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1799(cli_session_setup_spnego_send) got OID=1.3.6.1.4.1.311.2.2.30 got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.2.840.113554.1.2.2.3 got OID=1.3.6.1.4.1.311.2.2.10 [2016/02/28 20:46:58.570487, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1809(cli_session_setup_spnego_send) got principal=not_defined_in_RFC4178@please_ignore [2016/02/28 20:46:58.570495, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1679(cli_session_setup_get_principal) cli_session_setup_spnego: using target hostname not SPNEGO principal [2016/02/28 20:46:58.570503, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1694(cli_session_setup_get_principal) cli_session_setup_spnego: guessed server principal=cifs/Srv.child2.domain.local@CHILD2.DOMAIN.LOCAL [2016/02/28 20:46:58.571221, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:217(kerberos_kinit_password_ext) kerberos_kinit_password: as URI-VGW-4$@CHILD2.DOMAIN.LOCAL using [MEMORY:cliconnect] as ccache and config [(null)] [2016/02/28 20:46:59.229178, 2, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1288(cli_session_setup_kerberos_send) Doing kerberos session setup [2016/02/28 20:46:59.237517, 4, pid=29681, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:592(ads_krb5_mk_req) ads_krb5_mk_req: Advancing clock by 27 seconds to cope with clock skew [2016/02/28 20:46:59.237542, 3, pid=29681, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:339(ads_cleanup_expired_creds) ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect] expiration Mon, 29 Feb 2016 06:46:58 IST [2016/02/28 20:46:59.237579, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:606(ads_krb5_mk_req) ads_krb5_mk_req: Ticket (cifs/Srv.child2.domain.local@CHILD2.DOMAIN.LOCAL) in ccache (MEMORY:cliconnect) is valid until: (Mon, 29 Feb 2016 06:46:58 IST - 1456721218) [2016/02/28 20:46:59.237658, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:882(get_krb5_smb_session_key) Got KRB5 session key of length 32 [2016/02/28 20:46:59.239209, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.239533, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.239855, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [CHILD2], server = [Srv.child2.domain.local], expire = [1456771619] [2016/02/28 20:46:59.239888, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD2, we already got it [2016/02/28 20:46:59.239922, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [CHILD2.DOMAIN.LOCAL], server = [Srv.child2.domain.local], expire = [1456771619] [2016/02/28 20:46:59.239937, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD2.DOMAIN.LOCAL, we already got it [2016/02/28 20:46:59.239967, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:3590(set_global_winbindd_state_online) set_global_winbindd_state_online: online requested. [2016/02/28 20:46:59.239979, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:3593(set_global_winbindd_state_online) set_global_winbindd_state_online: rejecting. [2016/02/28 20:46:59.239987, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:480(set_domain_online) set_domain_online: called for domain CHILD2 [2016/02/28 20:46:59.240005, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/messages_dgm.c:284(messaging_dgm_send) messaging_dgm_send: Sending message to 29680 [2016/02/28 20:46:59.240045, 10, pid=29680, effective(0, 0), real(0, 0)] ../source4/lib/messaging/messaging.c:423(imessaging_dgm_recv) imessaging_dgm_recv: dst 29680 matches my id: 29680, type=0x40b [2016/02/28 20:46:59.240069, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:254(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 7 (num_fds:0) from 29681 [2016/02/28 20:46:59.240084, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:385(winbind_msg_domain_online) Domain CHILD2 is marked as online now. [2016/02/28 20:46:59.240116, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[CURRENT_DCNAME/CHILD2] and timeout=[Tue Jan 19 05:14:07 2038 IST] (690798428 seconds ahead) [2016/02/28 20:46:59.241556, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2620(set_dc_type_and_flags) set_dc_type_and_flags: setting up flags for primary or internal domain [2016/02/28 20:46:59.241580, 5, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2357(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: domain CHILD2 [2016/02/28 20:46:59.241644, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.242166, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'gssapi_spnego' registered [2016/02/28 20:46:59.242187, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'gssapi_krb5' registered [2016/02/28 20:46:59.242195, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'gssapi_krb5_sasl' registered [2016/02/28 20:46:59.242204, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'spnego' registered [2016/02/28 20:46:59.242212, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'schannel' registered [2016/02/28 20:46:59.242220, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'naclrpc_as_system' registered [2016/02/28 20:46:59.242229, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'sasl-EXTERNAL' registered [2016/02/28 20:46:59.242238, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'ntlmssp' registered [2016/02/28 20:46:59.242259, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'http_basic' registered [2016/02/28 20:46:59.242269, 3, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'http_ntlm' registered [2016/02/28 20:46:59.242444, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 0, auth_level 1 [2016/02/28 20:46:59.242481, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000001 (1) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 3919286a-b10c-11d0-9ba8-00c04fd92ef5 if_version : 0x00000000 (0) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.242614, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.242654, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.243129, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 52 [2016/02/28 20:46:59.243214, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000001 (1) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000393f9 (234489) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] 71 71 qq num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.243371, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 68 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.243386, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 68 bytes. [2016/02/28 20:46:59.243396, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:46:59.243408, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:2979(cli_rpc_pipe_open_noauth_transport) cli_rpc_pipe_open_noauth: opened pipe dssetup to machine Srv.child2.domain.local and bound anonymously. [2016/02/28 20:46:59.243428, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) dssetup_DsRoleGetPrimaryDomainInformation: struct dssetup_DsRoleGetPrimaryDomainInformation in: struct dssetup_DsRoleGetPrimaryDomainInformation level : DS_ROLE_BASIC_INFORMATION (1) [2016/02/28 20:46:59.243461, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000002 (2) context_id : 0x0000 (0) opnum : 0x0000 (0) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.243569, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.243597, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.244140, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 176 [2016/02/28 20:46:59.244168, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00c0 (192) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=168 [0000] 00 00 02 00 01 00 00 00 05 00 00 00 01 00 00 01 ........ ........ [0010] 04 00 02 00 08 00 02 00 0C 00 02 00 6F 0C 0F 28 ........ ....o..( [0020] 31 E2 AE 4C AF AD 5A 7C FC 8A 04 B0 07 00 00 00 1..L..Z| ........ [0030] 00 00 00 00 07 00 00 00 43 00 48 00 49 00 4C 00 ........ C.H.I.L. [0040] 44 00 32 00 00 00 00 00 14 00 00 00 00 00 00 00 D.2..... ........ [0050] 14 00 00 00 63 00 68 00 69 00 6C 00 64 00 32 00 ....c.h. i.l.d.2. [0060] 2E 00 64 00 6F 00 6D 00 61 00 69 00 6E 00 2E 00 ..d.o.m. a.i.n... [0070] 6C 00 6F 00 63 00 61 00 6C 00 00 00 0D 00 00 00 l.o.c.a. l....... [0080] 00 00 00 00 0D 00 00 00 64 00 6F 00 6D 00 61 00 ........ d.o.m.a. [0090] 69 00 6E 00 2E 00 6C 00 6F 00 63 00 61 00 6C 00 i.n...l. o.c.a.l. [00A0] 00 00 00 00 00 00 00 00 ........ [2016/02/28 20:46:59.244456, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 192, data_len 168, ss_len 0 [2016/02/28 20:46:59.244466, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 192 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.244474, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 168 bytes. [2016/02/28 20:46:59.244502, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) dssetup_DsRoleGetPrimaryDomainInformation: struct dssetup_DsRoleGetPrimaryDomainInformation out: struct dssetup_DsRoleGetPrimaryDomainInformation info : * info : union dssetup_DsRoleInfo(case 1) basic: struct dssetup_DsRolePrimaryDomInfoBasic role : DS_ROLE_PRIMARY_DC (5) flags : 0x01000001 (16777217) 1: DS_ROLE_PRIMARY_DS_RUNNING 0: DS_ROLE_PRIMARY_DS_MIXED_MODE 0: DS_ROLE_UPGRADE_IN_PROGRESS 1: DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT domain : * domain : 'CHILD2' dns_domain : * dns_domain : 'child2.domain.local' forest : * forest : 'domain.local' domain_guid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 result : WERR_OK [2016/02/28 20:46:59.244610, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.245019, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.245529, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 0, auth_level 1 [2016/02/28 20:46:59.245552, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000003 (3) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.245684, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.245709, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.246101, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 52 [2016/02/28 20:46:59.246130, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000003 (3) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000393fa (234490) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] 00 01 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.246271, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 68 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.246280, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 68 bytes. [2016/02/28 20:46:59.246290, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:46:59.246300, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:2979(cli_rpc_pipe_open_noauth_transport) cli_rpc_pipe_open_noauth: opened pipe lsarpc to machine Srv.child2.domain.local and bound anonymously. [2016/02/28 20:46:59.246324, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '\\SRV.CHILD2.DOMAIN.LOCAL' attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:46:59.246461, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000004 (4) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000068 (104) context_id : 0x0000 (0) opnum : 0x002c (44) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.246548, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.246571, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.247079, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 32 [2016/02/28 20:46:59.247106, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0030 (48) auth_length : 0x0000 (0) call_id : 0x00000004 (4) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000018 (24) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=24 [0000] 00 00 00 00 86 F1 EF 0A 71 4F 26 42 B8 B3 20 61 ........ qO&B.. a [0010] 02 A6 7C F1 00 00 00 00 ..|..... [2016/02/28 20:46:59.247235, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 48, data_len 24, ss_len 0 [2016/02/28 20:46:59.247244, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 48 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.247252, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 24 bytes. [2016/02/28 20:46:59.247266, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0aeff186-4f71-4226-b8b3-206102a67cf1 result : NT_STATUS_OK [2016/02/28 20:46:59.247306, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 in: struct lsa_QueryInfoPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0aeff186-4f71-4226-b8b3-206102a67cf1 level : LSA_POLICY_INFO_DNS (12) [2016/02/28 20:46:59.247359, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000005 (5) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000016 (22) context_id : 0x0000 (0) opnum : 0x002e (46) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.247445, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.247466, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.247931, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 204 [2016/02/28 20:46:59.247968, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00dc (220) auth_length : 0x0000 (0) call_id : 0x00000005 (5) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000c4 (196) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=196 [0000] 00 00 02 00 0C 00 00 00 0C 00 0E 00 04 00 02 00 ........ ........ [0010] 26 00 28 00 08 00 02 00 18 00 1A 00 0C 00 02 00 &.(..... ........ [0020] 6F 0C 0F 28 31 E2 AE 4C AF AD 5A 7C FC 8A 04 B0 o..(1..L ..Z|.... [0030] 10 00 02 00 07 00 00 00 00 00 00 00 06 00 00 00 ........ ........ [0040] 43 00 48 00 49 00 4C 00 44 00 32 00 14 00 00 00 C.H.I.L. D.2..... [0050] 00 00 00 00 13 00 00 00 63 00 68 00 69 00 6C 00 ........ c.h.i.l. [0060] 64 00 32 00 2E 00 64 00 6F 00 6D 00 61 00 69 00 d.2...d. o.m.a.i. [0070] 6E 00 2E 00 6C 00 6F 00 63 00 61 00 6C 00 00 00 n...l.o. c.a.l... [0080] 0D 00 00 00 00 00 00 00 0C 00 00 00 64 00 6F 00 ........ ....d.o. [0090] 6D 00 61 00 69 00 6E 00 2E 00 6C 00 6F 00 63 00 m.a.i.n. ..l.o.c. [00A0] 61 00 6C 00 04 00 00 00 01 04 00 00 00 00 00 05 a.l..... ........ [00B0] 15 00 00 00 72 14 BB 2B 02 77 F0 BC 87 06 64 F3 ....r..+ .w....d. [00C0] 00 00 00 00 .... [2016/02/28 20:46:59.248273, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 220, data_len 196, ss_len 0 [2016/02/28 20:46:59.248281, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 220 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.248289, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 196 bytes. [2016/02/28 20:46:59.248314, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 out: struct lsa_QueryInfoPolicy2 info : * info : * info : union lsa_PolicyInformation(case 12) dns: struct lsa_DnsDomainInfo name: struct lsa_StringLarge length : 0x000c (12) size : 0x000e (14) string : * string : 'CHILD2' dns_domain: struct lsa_StringLarge length : 0x0026 (38) size : 0x0028 (40) string : * string : 'child2.domain.local' dns_forest: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'domain.local' domain_guid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 sid : * sid : S-1-5-21-733680754-3169875714-4083418759 result : NT_STATUS_OK [2016/02/28 20:46:59.248446, 5, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2596(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: domain CHILD2 is in native mode. [2016/02/28 20:46:59.248457, 5, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2599(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: domain CHILD2 is running active directory. [2016/02/28 20:46:59.248483, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.248853, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 51 [2016/02/28 20:46:59.248869, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3496 bytes to parent [2016/02/28 20:46:59.248939, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 20 [2016/02/28 20:46:59.248954, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn LIST_TRUSTDOM [2016/02/28 20:46:59.248963, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:161(winbindd_dual_list_trusted_domains) [29680]: list trusted domains [2016/02/28 20:46:59.248977, 5, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:170(get_cache) get_cache: Setting ADS methods for domain CHILD2 [2016/02/28 20:46:59.248985, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:2910(trusted_domains) trusted_domains: [Cached] - doing backend query for info for domain CHILD2 [2016/02/28 20:46:59.248993, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1554(trusted_domains) ads: trusted_domains [2016/02/28 20:46:59.249084, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:46:59.249146, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:46:59.249167, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.249176, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44314170 [2016/02/28 20:46:59.249185, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443182c0 [2016/02/28 20:46:59.249195, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44314170 "ltdb_callback" [2016/02/28 20:46:59.249222, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443182c0 "ltdb_timeout" [2016/02/28 20:46:59.249233, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44314170 "ltdb_callback" [2016/02/28 20:46:59.249242, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:46:59.249249, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:46:59.249259, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:46:59.249271, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:46:59.249289, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:46:59.249309, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.249317, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44314030 [2016/02/28 20:46:59.249326, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44316cd0 [2016/02/28 20:46:59.249348, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44314030 "ltdb_callback" [2016/02/28 20:46:59.249359, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:46:59.249367, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44316cd0 "ltdb_timeout" [2016/02/28 20:46:59.249376, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44314030 "ltdb_callback" [2016/02/28 20:46:59.249387, 3, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:46:59.249411, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:46:59.249428, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.249436, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44317610 [2016/02/28 20:46:59.249445, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443177f0 [2016/02/28 20:46:59.249454, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44317610 "ltdb_callback" [2016/02/28 20:46:59.249557, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443177f0 "ltdb_timeout" [2016/02/28 20:46:59.249569, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44317610 "ltdb_callback" [2016/02/28 20:46:59.249714, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.82.95 at port 135 [2016/02/28 20:46:59.250146, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/util/util_net.c:890(print_socket_options) Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 0 SO_BROADCAST = 0 TCP_NODELAY = 0 TCP_KEEPCNT = 3 TCP_KEEPIDLE = 120 TCP_KEEPINTVL = 5 IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_SNDBUF = 22760 SO_RCVBUF = 87380 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 TCP_QUICKACK = 1 TCP_DEFER_ACCEPT = 0 [2016/02/28 20:46:59.250308, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 0, auth_level 1 [2016/02/28 20:46:59.250328, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000006 (6) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.250459, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.250469, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 72 [2016/02/28 20:46:59.250779, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 44 [2016/02/28 20:46:59.250813, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x00000006 (6) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x0002d492 (185490) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] 00 00 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.250950, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 60 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.250959, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 60 bytes. [2016/02/28 20:46:59.250969, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:46:59.251008, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : * object : 12345678-1234-abcd-ef00-01234567cffb map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0087 (135) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2016/02/28 20:46:59.251312, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000007 (7) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000084 (132) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.251415, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.251432, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 156 [2016/02/28 20:46:59.251784, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 136 [2016/02/28 20:46:59.251813, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x00000007 (7) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 8F 6B 95 BE E0 53 5D 4A 85 83 F7 92 .....k.. .S]J.... [0010] CD 0D C8 1B 01 00 00 00 01 00 00 00 00 00 00 00 ........ ........ [0020] 01 00 00 00 03 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C0 06 01 00 09 04 00 C0 A8 52 5F 00 00 00 00 00 ........ .R_..... [2016/02/28 20:46:59.252038, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128, ss_len 0 [2016/02/28 20:46:59.252047, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 152 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.252055, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 128 bytes. [2016/02/28 20:46:59.252099, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : be956b8f-53e0-4a5d-8583-f792cd0dc81b num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc006 (49158) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 192.168.82.95 result : 0x00000000 (0) [2016/02/28 20:46:59.252447, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.82.95 at port 49158 [2016/02/28 20:46:59.252803, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/util/util_net.c:890(print_socket_options) Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 0 SO_BROADCAST = 0 TCP_NODELAY = 0 TCP_KEEPCNT = 3 TCP_KEEPIDLE = 120 TCP_KEEPINTVL = 5 IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_SNDBUF = 22760 SO_RCVBUF = 87380 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 TCP_QUICKACK = 1 TCP_DEFER_ACCEPT = 0 [2016/02/28 20:46:59.252964, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 0, auth_level 1 [2016/02/28 20:46:59.252988, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000008 (8) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.253106, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.253115, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 72 [2016/02/28 20:46:59.253508, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 44 [2016/02/28 20:46:59.253542, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x00000008 (8) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000393fb (234491) secondary_address_size : 0x0006 (6) secondary_address : '49158' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.253680, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 60 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.253691, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 60 bytes. [2016/02/28 20:46:59.253702, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:46:59.253714, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:2979(cli_rpc_pipe_open_noauth_transport) cli_rpc_pipe_open_noauth: opened pipe netlogon to machine Srv.child2.domain.local and bound anonymously. [2016/02/28 20:46:59.253734, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.253751, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.253765, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.253777, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff44313ee0 [2016/02/28 20:46:59.253886, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.253899, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.253907, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.253920, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:46:59.253927, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/flash/samba/netlogon_creds_cli.tdb 3: [2016/02/28 20:46:59.253937, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.253946, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431d6d0 [2016/02/28 20:46:59.253956, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.253963, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:46:59.253983, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.254005, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_ServerReqChallenge: struct netr_ServerReqChallenge in: struct netr_ServerReqChallenge server_name : * server_name : '\\Srv.child2.domain.local' computer_name : * computer_name : 'URI-VGW-4' credentials : * credentials: struct netr_Credential data : d24edc28cd4c7c26 [2016/02/28 20:46:59.254056, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000009 (9) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000006c (108) context_id : 0x0000 (0) opnum : 0x0004 (4) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.254142, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.254151, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 132 [2016/02/28 20:46:59.254464, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 20 [2016/02/28 20:46:59.254494, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0024 (36) auth_length : 0x0000 (0) call_id : 0x00000009 (9) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=12 [0000] EF 21 13 93 57 81 20 6E 00 00 00 00 .!..W. n .... [2016/02/28 20:46:59.254623, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 36, data_len 12, ss_len 0 [2016/02/28 20:46:59.254640, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 36 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.254649, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 12 bytes. [2016/02/28 20:46:59.254665, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_ServerReqChallenge: struct netr_ServerReqChallenge out: struct netr_ServerReqChallenge return_credentials : * return_credentials: struct netr_Credential data : ef2113935781206e result : NT_STATUS_OK [2016/02/28 20:46:59.254723, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_ServerAuthenticate3: struct netr_ServerAuthenticate3 in: struct netr_ServerAuthenticate3 server_name : * server_name : '\\Srv.child2.domain.local' account_name : * account_name : 'URI-VGW-4$' secure_channel_type : SEC_CHAN_WKSTA (2) computer_name : * computer_name : 'URI-VGW-4' credentials : * credentials: struct netr_Credential data : 2d93ce09bdd13639 negotiate_flags : * negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC [2016/02/28 20:46:59.254857, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000000a (10) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000094 (148) context_id : 0x0000 (0) opnum : 0x001a (26) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.254949, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.254959, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 172 [2016/02/28 20:46:59.255665, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 28 [2016/02/28 20:46:59.255694, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x002c (44) auth_length : 0x0000 (0) call_id : 0x0000000a (10) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000014 (20) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=20 [0000] 10 6E 01 0F F1 1B D1 0B FF FF 0F 61 52 04 00 00 .n...... ...aR... [0010] 00 00 00 00 .... [2016/02/28 20:46:59.255814, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 44, data_len 20, ss_len 0 [2016/02/28 20:46:59.255822, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 44 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.255830, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 20 bytes. [2016/02/28 20:46:59.255853, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_ServerAuthenticate3: struct netr_ServerAuthenticate3 out: struct netr_ServerAuthenticate3 return_credentials : * return_credentials: struct netr_Credential data : 106e010ff11bd10b negotiate_flags : * negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC rid : * rid : 0x00000452 (1106) result : NT_STATUS_OK [2016/02/28 20:46:59.255976, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:46:59.255986, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/flash/samba/netlogon_creds_cli.tdb 3: [2016/02/28 20:46:59.255996, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.256007, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4430f1a0 [2016/02/28 20:46:59.256110, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.256125, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:46:59.256132, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.256142, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.256149, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.256158, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.256168, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff44313830 [2016/02/28 20:46:59.256191, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.256200, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.256207, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.256233, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_netlogon.c:218(rpccli_setup_netlogon_creds) rpccli_setup_netlogon_creds: using new netlogon_creds cli[URI-VGW-4$/URI-VGW-4] to Srv.child2.domain.local [2016/02/28 20:46:59.256302, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.82.95 at port 135 [2016/02/28 20:46:59.256624, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/util/util_net.c:890(print_socket_options) Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 0 SO_BROADCAST = 0 TCP_NODELAY = 0 TCP_KEEPCNT = 3 TCP_KEEPIDLE = 120 TCP_KEEPINTVL = 5 IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_SNDBUF = 22760 SO_RCVBUF = 87380 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 TCP_QUICKACK = 1 TCP_DEFER_ACCEPT = 0 [2016/02/28 20:46:59.256784, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 0, auth_level 1 [2016/02/28 20:46:59.256806, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x0000000b (11) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.256924, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.256942, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 72 [2016/02/28 20:46:59.257239, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 44 [2016/02/28 20:46:59.257271, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x0000000b (11) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x0002d493 (185491) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] 95 BE .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:46:59.257412, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 60 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.257422, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 60 bytes. [2016/02/28 20:46:59.257431, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:46:59.257465, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : * object : 12345678-1234-abcd-ef00-01234567cffb map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0087 (135) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2016/02/28 20:46:59.257771, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000000c (12) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000084 (132) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.257868, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.257877, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 156 [2016/02/28 20:46:59.258199, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 136 [2016/02/28 20:46:59.258228, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x0000000c (12) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 41 4B A1 6E 70 E6 EE 41 BE 55 40 AE ....AK.n p..A.U@. [0010] 8E 25 C7 DA 01 00 00 00 01 00 00 00 00 00 00 00 .%...... ........ [0020] 01 00 00 00 03 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C0 06 01 00 09 04 00 C0 A8 52 5F 00 00 00 00 00 ........ .R_..... [2016/02/28 20:46:59.258465, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128, ss_len 0 [2016/02/28 20:46:59.258474, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 152 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.258482, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 128 bytes. [2016/02/28 20:46:59.258503, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 6ea14b41-e670-41ee-be55-40ae8e25c7da num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc006 (49158) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 192.168.82.95 result : 0x00000000 (0) [2016/02/28 20:46:59.258857, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.82.95 at port 49158 [2016/02/28 20:46:59.259147, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/util/util_net.c:890(print_socket_options) Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 0 SO_BROADCAST = 0 TCP_NODELAY = 0 TCP_KEEPCNT = 3 TCP_KEEPIDLE = 120 TCP_KEEPINTVL = 5 IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_SNDBUF = 22760 SO_RCVBUF = 87380 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 TCP_QUICKACK = 1 TCP_DEFER_ACCEPT = 0 [2016/02/28 20:46:59.259220, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.259230, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.259241, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.259251, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4430f1a0 [2016/02/28 20:46:59.259268, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.259276, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.259283, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.259423, 5, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:672(gensec_start_mech) Starting GENSEC mechanism schannel [2016/02/28 20:46:59.259446, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 68, auth_level 6 [2016/02/28 20:46:59.259456, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1012(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2016/02/28 20:46:59.259508, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=25 [0000] 00 00 00 00 03 00 00 00 43 48 49 4C 44 32 00 55 ........ CHILD2.U [0010] 52 49 2D 56 47 57 2D 34 00 RI-VGW-4 . [2016/02/28 20:46:59.259573, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0069 (105) auth_length : 0x0019 (25) call_id : 0x0000000d (13) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=33 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 43 48 49 4C 44 32 00 55 52 49 2D 56 47 57 2D 34 CHILD2.U RI-VGW-4 [0020] 00 . [2016/02/28 20:46:59.259759, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.259771, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 105 [2016/02/28 20:46:59.260141, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 64 [2016/02/28 20:46:59.260174, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0050 (80) auth_length : 0x000c (12) call_id : 0x0000000d (13) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000393fc (234492) secondary_address_size : 0x0006 (6) secondary_address : '49158' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 2E 00 .... [2016/02/28 20:46:59.260320, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 80 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.260357, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 80 bytes. [2016/02/28 20:46:59.260369, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:46:59.260380, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=12 [0000] 01 00 00 00 00 00 00 00 00 00 2E 00 ........ .... [2016/02/28 20:46:59.260433, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.260442, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.260452, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.260463, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff44317860 [2016/02/28 20:46:59.260479, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.260488, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.260495, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.260508, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.260516, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.260525, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.260534, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff443179b0 [2016/02/28 20:46:59.260547, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.260555, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.260562, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.260580, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:146(netlogon_creds_step) seed 09ce932d:3936d1bd [2016/02/28 20:46:59.260592, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:151(netlogon_creds_step) seed+time 60a1d3d2:3936d1bd [2016/02/28 20:46:59.260601, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:156(netlogon_creds_step) CLIENT 42220e2d:b79b6567 [2016/02/28 20:46:59.260611, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:162(netlogon_creds_step) seed+time+1 60a1d3d3:3936d1bd [2016/02/28 20:46:59.260637, 5, pid=29681, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:167(netlogon_creds_step) SERVER 851b032c:57806081 [2016/02/28 20:46:59.260652, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_LogonGetCapabilities: struct netr_LogonGetCapabilities in: struct netr_LogonGetCapabilities server_name : * server_name : '\\Srv.child2.domain.local' computer_name : * computer_name : 'URI-VGW-4' credential : * credential: struct netr_Authenticator cred: struct netr_Credential data : 2d0e224267659bb7 timestamp : Sun Feb 28 20:47:01 2016 IST return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : 0000000000000000 timestamp : (time_t)0 query_level : 0x00000001 (1) [2016/02/28 20:46:59.260727, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2016/02/28 20:46:59.260825, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000000e (14) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x000000bc (188) context_id : 0x0000 (0) opnum : 0x0015 (21) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.260919, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:46:59.260982, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.260991, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 280 [2016/02/28 20:46:59.264357, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 104 [2016/02/28 20:46:59.264390, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0078 (120) auth_length : 0x0038 (56) call_id : 0x0000000e (14) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000018 (24) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=96 [0000] 30 B9 21 9B 4B B7 0C C3 7D A7 5A 16 D9 6C D9 A4 0.!.K... }.Z..l.. [0010] 71 41 8D B2 C8 D7 F2 5E FA C4 69 A6 47 85 81 33 qA.....^ ..i.G..3 [0020] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0030] F8 4A 1A F1 25 E0 1B 4A BB 5E 3B ED D2 A4 2D 34 .J..%..J .^;...-4 [0040] BD E4 26 EE 48 B9 0E FE 44 00 32 00 14 00 00 00 ..&.H... D.2..... [0050] 00 00 00 00 13 00 00 00 63 00 68 00 69 00 6C 00 ........ c.h.i.l. [2016/02/28 20:46:59.264586, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:46:59.264598, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:46:59.264607, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:46:59.264651, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 120, data_len 24, ss_len 8 [2016/02/28 20:46:59.264662, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 120 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.264669, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 24 bytes. [2016/02/28 20:46:59.264689, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_LogonGetCapabilities: struct netr_LogonGetCapabilities out: struct netr_LogonGetCapabilities return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : 2c031b8581608057 timestamp : (time_t)0 capabilities : * capabilities : union netr_Capabilities(case 1) server_capabilities : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC result : NT_STATUS_OK [2016/02/28 20:46:59.264815, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:46:59.264824, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/flash/samba/netlogon_creds_cli.tdb 3: [2016/02/28 20:46:59.264835, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.264846, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff44318e20 [2016/02/28 20:46:59.264856, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.264864, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:46:59.264872, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.264894, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.264902, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.264911, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.264921, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431ec90 [2016/02/28 20:46:59.264937, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.264945, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.264951, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.264966, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:3195(cli_rpc_pipe_open_schannel_with_creds) cli_rpc_pipe_open_schannel_with_creds: opened pipe netlogon to machine Srv.child2.domain.local for domain CHILD2 and bound using schannel. [2016/02/28 20:46:59.264985, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsrEnumerateDomainTrusts: struct netr_DsrEnumerateDomainTrusts in: struct netr_DsrEnumerateDomainTrusts server_name : * server_name : 'Srv.child2.domain.local' trust_flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES [2016/02/28 20:46:59.265039, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000000f (15) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000044 (68) context_id : 0x0000 (0) opnum : 0x0028 (40) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.265127, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:46:59.265186, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.265196, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 168 [2016/02/28 20:46:59.268356, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 536 [2016/02/28 20:46:59.268388, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0228 (552) auth_length : 0x0038 (56) call_id : 0x0000000f (15) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000001c8 (456) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=528 [0000] B7 A5 1E BE 10 7B 05 CD 1F E0 0F C3 A0 83 8E A4 .....{.. ........ [0010] 42 B0 3B 04 59 63 36 C5 5F 26 B8 4A 9A 0C D9 4B B.;.Yc6. _&.J...K [0020] 56 F6 61 B2 96 F7 4A 17 E1 17 D9 8F 6D 82 63 89 V.a...J. ....m.c. [0030] DB 18 64 9B F2 5C 9C 5B 51 B2 80 69 1E C1 D5 B2 ..d..\.[ Q..i.... [0040] 27 83 00 94 94 B9 E4 FD CD 83 88 99 3A C5 33 84 '....... ....:.3. [0050] 4E 4E FE 0C 57 43 1A 07 B7 02 2E FA 14 AE 27 42 NN..WC.. ......'B [0060] E3 4E D7 7E 44 33 1E 21 F0 9E 64 CC A3 EA 3B 69 .N.~D3.! ..d...;i [0070] 54 7F 94 51 3C 0F 60 C2 75 FC 6A 68 9D C5 9A DC T..Q<.`. u.jh.... [0080] 5C 93 A1 EF 21 49 3D 14 80 02 56 A5 1A BF 33 9D \...!I=. ..V...3. [0090] 5C 76 12 66 EE AD 48 A1 94 FB BE 8E CC 7E 82 9C \v.f..H. .....~.. [00A0] C4 BA 8E 33 6E 74 74 61 B5 4E 91 46 D2 2C 1E 8B ...3ntta .N.F.,.. [00B0] 0D 3A 22 6A A4 0B 8C CD B8 F1 8D 34 39 12 0E D3 .:"j.... ...49... [00C0] AB 8B 74 07 6C 89 50 1E 4A 4E CC 4D CF 8C 1A CD ..t.l.P. JN.M.... [00D0] 80 52 54 F4 97 58 05 4E 7D AA BF F5 64 F7 2F 6B .RT..X.N }...d./k [00E0] B3 89 AF 8C 7D E5 D2 64 5F 53 DF 15 ED CB 21 1A ....}..d _S....!. [00F0] B2 33 E5 D6 95 50 D3 30 AE 11 58 55 10 BD B9 52 .3...P.0 ..XU...R [0100] EC D3 19 A4 F3 40 1F D3 F1 AD 97 0E 7F C3 99 0D .....@.. ........ [0110] 9B 91 C2 63 17 C9 FF A9 D5 00 9C C8 EC 49 D6 7F ...c.... .....I.. [0120] 93 B9 EB EA D7 18 A7 33 DE 87 28 A5 22 0F 18 0D .......3 ..(."... [0130] 26 80 63 B3 74 9B B9 9D FF C3 18 75 C0 E8 94 7A &.c.t... ...u...z [0140] 21 0F 07 73 E0 66 96 C4 38 19 A6 87 84 4B E1 D1 !..s.f.. 8....K.. [0150] A0 DB E4 0B 3F C8 DB EF CC FD 21 8A C6 64 20 CF ....?... ..!..d . [0160] F8 CE 74 52 64 04 9C 15 1D 36 E6 4A 6C B9 9D C4 ..tRd... .6.Jl... [0170] 39 55 0A 70 76 DF 98 DC EE C8 11 C0 30 A5 A6 24 9U.pv... ....0..$ [0180] 31 D4 7C D7 A5 5E 0F 74 50 80 96 42 DA 09 10 F6 1.|..^.t P..B.... [0190] D2 08 68 05 23 D8 EB 78 71 9C 81 9F 15 57 C7 0E ..h.#..x q....W.. [01A0] 5A EA 4A F1 C5 0D 2F 3D 53 56 73 B5 9C C7 DF 5E Z.J.../= SVs....^ [01B0] 64 CC 80 0E A4 CF 08 F4 19 7B 46 30 25 99 A4 22 d....... .{F0%.." [01C0] 48 99 1A 1B B6 B5 76 E4 59 92 66 DE BA 0D 9F 7B H.....v. Y.f....{ [01D0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [01E0] B6 29 44 7C B3 E2 4A 5D 74 4F 50 5B CA 25 23 72 .)D|..J] tOP[.%#r [01F0] 34 D1 F6 BD C3 2C 2C 90 E9 76 1C 7C DC 14 AE 31 4....,,. .v.|...1 [0200] 99 66 FA 35 C4 AE 74 F0 14 58 E6 95 87 24 DD C0 .f.5..t. .X...$.. [2016/02/28 20:46:59.269061, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:46:59.269073, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:46:59.269081, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:46:59.269160, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 552, data_len 456, ss_len 8 [2016/02/28 20:46:59.269168, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 552 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.269176, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 456 bytes. [2016/02/28 20:46:59.269202, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsrEnumerateDomainTrusts: struct netr_DsrEnumerateDomainTrusts out: struct netr_DsrEnumerateDomainTrusts trusts : * trusts: struct netr_DomainTrustList count : 0x00000003 (3) array : * array: ARRAY(3) array: struct netr_DomainTrust netbios_name : * netbios_name : 'DOMAIN' dns_name : * dns_name : 'domain.local' trust_flags : 0x00000027 (39) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 1: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000020 (32) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 1: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION sid : * sid : S-1-5-21-962387436-534109671-967373764 guid : 648a62d6-5e24-40dc-a0a7-efc689e00852 array: struct netr_DomainTrust netbios_name : * netbios_name : 'CHILD' dns_name : * dns_name : 'child.domain.local' trust_flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000020 (32) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 1: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 guid : a33c6725-bd2a-462b-828b-583a97175a8e array: struct netr_DomainTrust netbios_name : * netbios_name : 'CHILD2' dns_name : * dns_name : 'child2.domain.local' trust_flags : 0x00000019 (25) 1: NETR_TRUST_FLAG_IN_FOREST 0: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 1: NETR_TRUST_FLAG_PRIMARY 1: NETR_TRUST_FLAG_NATIVE 0: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000000 (0) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION sid : * sid : S-1-5-21-733680754-3169875714-4083418759 guid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 result : WERR_OK [2016/02/28 20:46:59.269554, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1639(trusted_domains) trusted_domains(ads): Searching trusted domain list of CHILD2 and storing trust flags for domain domain.local [2016/02/28 20:46:59.269567, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4699(wcache_tdc_add_domain) wcache_tdc_add_domain: Adding domain DOMAIN (domain.local), SID S-1-5-21-962387436-534109671-967373764, flags = 0x27, attributes = 0x20, type = 0x2 [2016/02/28 20:46:59.269612, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4502(pack_tdc_domains) pack_tdc_domains: Packing 4 trusted domains [2016/02/28 20:46:59.269635, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) [2016/02/28 20:46:59.269644, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain URI-VGW-4 (UNKNOWN) [2016/02/28 20:46:59.269652, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD2 (CHILD2.DOMAIN.LOCAL) [2016/02/28 20:46:59.269660, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain DOMAIN (domain.local) [2016/02/28 20:46:59.269686, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1639(trusted_domains) trusted_domains(ads): Searching trusted domain list of CHILD2 and storing trust flags for domain child.domain.local [2016/02/28 20:46:59.269695, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4699(wcache_tdc_add_domain) wcache_tdc_add_domain: Adding domain CHILD (child.domain.local), SID S-1-5-21-3518453233-2884963923-3703870538, flags = 0x23, attributes = 0x20, type = 0x2 [2016/02/28 20:46:59.269714, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4502(pack_tdc_domains) pack_tdc_domains: Packing 5 trusted domains [2016/02/28 20:46:59.269726, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) [2016/02/28 20:46:59.269734, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain URI-VGW-4 (UNKNOWN) [2016/02/28 20:46:59.269741, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD2 (CHILD2.DOMAIN.LOCAL) [2016/02/28 20:46:59.269749, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain DOMAIN (domain.local) [2016/02/28 20:46:59.269757, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD (child.domain.local) [2016/02/28 20:46:59.269778, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1639(trusted_domains) trusted_domains(ads): Searching trusted domain list of CHILD2 and storing trust flags for domain child2.domain.local [2016/02/28 20:46:59.269787, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4699(wcache_tdc_add_domain) wcache_tdc_add_domain: Adding domain CHILD2 (child2.domain.local), SID S-1-5-21-733680754-3169875714-4083418759, flags = 0x19, attributes = 0x0, type = 0x2 [2016/02/28 20:46:59.269802, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4409(add_wbdomain_to_tdc_array) add_wbdomain_to_tdc_array: Found existing record for CHILD2 [2016/02/28 20:46:59.269810, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4502(pack_tdc_domains) pack_tdc_domains: Packing 5 trusted domains [2016/02/28 20:46:59.269830, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) [2016/02/28 20:46:59.269840, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain URI-VGW-4 (UNKNOWN) [2016/02/28 20:46:59.269848, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD2 (child2.domain.local) [2016/02/28 20:46:59.269856, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain DOMAIN (domain.local) [2016/02/28 20:46:59.269863, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD (child.domain.local) [2016/02/28 20:46:59.269886, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 20 [2016/02/28 20:46:59.269894, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3714 bytes to parent [2016/02/28 20:46:59.269927, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:349(trustdom_list_done) parsing response line 'DOMAIN\domain.local\S-1-5-21-962387436-534109671-967373764\39\2\32 CHILD\child.domain.local\S-1-5-21-3518453233-2884963923-3703870538\35\2\32 CHILD2\child2.domain.local\S-1-5-21-733680754-3169875714-4083418759\25\2\0' [2016/02/28 20:46:59.269962, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4699(wcache_tdc_add_domain) wcache_tdc_add_domain: Adding domain DOMAIN (domain.local), SID S-1-5-21-962387436-534109671-967373764, flags = 0x27, attributes = 0x20, type = 0x2 [2016/02/28 20:46:59.269986, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4409(add_wbdomain_to_tdc_array) add_wbdomain_to_tdc_array: Found existing record for DOMAIN [2016/02/28 20:46:59.269996, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4502(pack_tdc_domains) pack_tdc_domains: Packing 5 trusted domains [2016/02/28 20:46:59.270008, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) [2016/02/28 20:46:59.270015, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain URI-VGW-4 (UNKNOWN) [2016/02/28 20:46:59.270023, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD2 (child2.domain.local) [2016/02/28 20:46:59.270039, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain DOMAIN (domain.local) [2016/02/28 20:46:59.270047, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD (child.domain.local) [2016/02/28 20:46:59.270066, 2, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:266(add_trusted_domain) Added domain DOMAIN domain.local S-1-5-21-962387436-534109671-967373764 [2016/02/28 20:46:59.270076, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:349(trustdom_list_done) parsing response line 'CHILD\child.domain.local\S-1-5-21-3518453233-2884963923-3703870538\35\2\32 CHILD2\child2.domain.local\S-1-5-21-733680754-3169875714-4083418759\25\2\0' [2016/02/28 20:46:59.270093, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4699(wcache_tdc_add_domain) wcache_tdc_add_domain: Adding domain CHILD (child.domain.local), SID S-1-5-21-3518453233-2884963923-3703870538, flags = 0x23, attributes = 0x20, type = 0x2 [2016/02/28 20:46:59.270108, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4409(add_wbdomain_to_tdc_array) add_wbdomain_to_tdc_array: Found existing record for CHILD [2016/02/28 20:46:59.270117, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4502(pack_tdc_domains) pack_tdc_domains: Packing 5 trusted domains [2016/02/28 20:46:59.270128, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain BUILTIN (UNKNOWN) [2016/02/28 20:46:59.270135, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain URI-VGW-4 (UNKNOWN) [2016/02/28 20:46:59.270143, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD2 (child2.domain.local) [2016/02/28 20:46:59.270151, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain DOMAIN (domain.local) [2016/02/28 20:46:59.270158, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4521(pack_tdc_domains) pack_tdc_domains: Packing domain CHILD (child.domain.local) [2016/02/28 20:46:59.270171, 2, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:266(add_trusted_domain) Added domain CHILD child.domain.local S-1-5-21-3518453233-2884963923-3703870538 [2016/02/28 20:46:59.270179, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:349(trustdom_list_done) parsing response line 'CHILD2\child2.domain.local\S-1-5-21-733680754-3169875714-4083418759\25\2\0' [2016/02/28 20:46:59.270189, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:349(trustdom_list_done) parsing response line '' [2016/02/28 20:46:59.270196, 0, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:353(trustdom_list_done) Got invalid trustdom response [2016/02/28 20:46:59.270248, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:496(rescan_forest_root_trusts) rescan_forest_root_trusts: Following trust path for domain tree root DOMAIN (domain.local) [2016/02/28 20:46:59.270266, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1420(fork_domain_child) fork_domain_child called for domain 'DOMAIN' [2016/02/28 20:46:59.274394, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1476(fork_domain_child) Child process 29684 [2016/02/28 20:46:59.274746, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 33 - private_data=(nil) [2016/02/28 20:46:59.274766, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 13 - private_data=(nil) [2016/02/28 20:46:59.274773, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:46:59.274780, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:46:59.274787, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1029 - private_data=(nil) [2016/02/28 20:46:59.274794, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:46:59.274801, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1033 - private_data=(nil) [2016/02/28 20:46:59.274807, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:46:59.274814, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1036 - private_data=(nil) [2016/02/28 20:46:59.274821, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1035 - private_data=(nil) [2016/02/28 20:46:59.274884, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:46:59.274898, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:46:59.274905, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:46:59.274912, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:46:59.274920, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:46:59.274927, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:461(messaging_register) Overriding messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:46:59.274939, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:566(set_domain_online_request) set_domain_online_request: called for domain DOMAIN [2016/02/28 20:46:59.274949, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:601(set_domain_online_request) set_domain_online_request: domain DOMAIN was globally offline. [2016/02/28 20:46:59.274957, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:566(set_domain_online_request) set_domain_online_request: called for domain CHILD2 [2016/02/28 20:46:59.274964, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:601(set_domain_online_request) set_domain_online_request: domain CHILD2 was globally offline. [2016/02/28 20:46:59.274989, 4, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 20 [2016/02/28 20:46:59.275000, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn LIST_TRUSTDOM [2016/02/28 20:46:59.275010, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:161(winbindd_dual_list_trusted_domains) [29680]: list trusted domains [2016/02/28 20:46:59.275036, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2118(connection_ok) connection_ok: Connection to (null) for domain DOMAIN is not connected [2016/02/28 20:46:59.275046, 5, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2222(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: domain DOMAIN [2016/02/28 20:46:59.275055, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2118(connection_ok) connection_ok: Connection to (null) for domain CHILD2 is not connected [2016/02/28 20:46:59.275062, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2253(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: No connection to our domain! [2016/02/28 20:46:59.275091, 5, pid=29684, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:73(gencache_init) Opening cache file at /var/vol/3/.ctera/samba/cache/gencache.tdb [2016/02/28 20:46:59.275176, 5, pid=29684, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:124(gencache_init) Opening cache file at /var/vol/3/.ctera/samba/lock/gencache_notrans.tdb [2016/02/28 20:46:59.279660, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:210(saf_fetch) saf_fetch: failed to find server for "DOMAIN" domain [2016/02/28 20:46:59.279689, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1917(cm_open_connection) cm_open_connection: dcname is '' for domain DOMAIN [2016/02/28 20:46:59.279707, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2118(connection_ok) connection_ok: Connection to (null) for domain CHILD2 is not connected [2016/02/28 20:46:59.279734, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "CHILD2" domain [2016/02/28 20:46:59.279748, 9, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server Srv.child2.domain.local [2016/02/28 20:46:59.279756, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1876(cm_open_connection) cm_open_connection: saf_servername is 'Srv.child2.domain.local' for domain CHILD2 [2016/02/28 20:46:59.279766, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1917(cm_open_connection) cm_open_connection: dcname is 'Srv.child2.domain.local' for domain CHILD2 [2016/02/28 20:46:59.279776, 9, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server Srv.child2.domain.local [2016/02/28 20:46:59.279789, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:46:59.279800, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:46:59.279814, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:46:59.279873, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:46:59.279911, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.82.95 at port 445 [2016/02/28 20:46:59.280380, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1023(cm_prepare_connection) cm_prepare_connection: connecting to DC Srv.child2.domain.local for domain CHILD2 [2016/02/28 20:46:59.282457, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:46:59.282540, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:46:59.282568, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.282582, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44315430 [2016/02/28 20:46:59.282591, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44314c60 [2016/02/28 20:46:59.282601, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44315430 "ltdb_callback" [2016/02/28 20:46:59.282621, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44314c60 "ltdb_timeout" [2016/02/28 20:46:59.282638, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44315430 "ltdb_callback" [2016/02/28 20:46:59.282654, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:46:59.282665, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:46:59.282676, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:46:59.282688, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:46:59.282706, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:46:59.282726, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.282734, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44315960 [2016/02/28 20:46:59.282743, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443156e0 [2016/02/28 20:46:59.282752, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44315960 "ltdb_callback" [2016/02/28 20:46:59.282771, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:46:59.282780, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443156e0 "ltdb_timeout" [2016/02/28 20:46:59.282789, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44315960 "ltdb_callback" [2016/02/28 20:46:59.282804, 3, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:46:59.282837, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:46:59.282857, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.282865, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44314d70 [2016/02/28 20:46:59.282873, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44314e30 [2016/02/28 20:46:59.282882, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44314d70 "ltdb_callback" [2016/02/28 20:46:59.282973, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44314e30 "ltdb_timeout" [2016/02/28 20:46:59.282983, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44314d70 "ltdb_callback" [2016/02/28 20:46:59.283017, 5, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1116(cm_prepare_connection) connecting to Srv.child2.domain.local from URI-VGW-4 with kerberos principal [URI-VGW-4$@CHILD2.DOMAIN.LOCAL] and realm [child2.domain.local] [2016/02/28 20:46:59.283050, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1772(cli_session_setup_spnego_send) Doing spnego session setup (blob length=120) [2016/02/28 20:46:59.283086, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1799(cli_session_setup_spnego_send) got OID=1.3.6.1.4.1.311.2.2.30 got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.2.840.113554.1.2.2.3 got OID=1.3.6.1.4.1.311.2.2.10 [2016/02/28 20:46:59.283101, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1809(cli_session_setup_spnego_send) got principal=not_defined_in_RFC4178@please_ignore [2016/02/28 20:46:59.283109, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1679(cli_session_setup_get_principal) cli_session_setup_spnego: using target hostname not SPNEGO principal [2016/02/28 20:46:59.283118, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1694(cli_session_setup_get_principal) cli_session_setup_spnego: guessed server principal=cifs/Srv.child2.domain.local@CHILD2.DOMAIN.LOCAL [2016/02/28 20:46:59.283940, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:217(kerberos_kinit_password_ext) kerberos_kinit_password: as URI-VGW-4$@CHILD2.DOMAIN.LOCAL using [MEMORY:cliconnect] as ccache and config [(null)] [2016/02/28 20:46:59.572209, 2, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1288(cli_session_setup_kerberos_send) Doing kerberos session setup [2016/02/28 20:46:59.691508, 4, pid=29684, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:592(ads_krb5_mk_req) ads_krb5_mk_req: Advancing clock by 28 seconds to cope with clock skew [2016/02/28 20:46:59.691559, 3, pid=29684, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:339(ads_cleanup_expired_creds) ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect] expiration Mon, 29 Feb 2016 06:46:59 IST [2016/02/28 20:46:59.691582, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:606(ads_krb5_mk_req) ads_krb5_mk_req: Ticket (cifs/Srv.child2.domain.local@CHILD2.DOMAIN.LOCAL) in ccache (MEMORY:cliconnect) is valid until: (Mon, 29 Feb 2016 06:46:59 IST - 1456721219) [2016/02/28 20:46:59.691656, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:882(get_krb5_smb_session_key) Got KRB5 session key of length 32 [2016/02/28 20:46:59.693210, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.693549, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.693862, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [CHILD2], server = [Srv.child2.domain.local], expire = [1456771619] [2016/02/28 20:46:59.693894, 10, pid=29684, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD2, we already got it [2016/02/28 20:46:59.693906, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [child2.domain.local], server = [Srv.child2.domain.local], expire = [1456771619] [2016/02/28 20:46:59.693918, 10, pid=29684, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD2.DOMAIN.LOCAL, we already got it [2016/02/28 20:46:59.693947, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:480(set_domain_online) set_domain_online: called for domain CHILD2 [2016/02/28 20:46:59.693967, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages_dgm.c:284(messaging_dgm_send) messaging_dgm_send: Sending message to 29680 [2016/02/28 20:46:59.694003, 10, pid=29680, effective(0, 0), real(0, 0)] ../source4/lib/messaging/messaging.c:423(imessaging_dgm_recv) imessaging_dgm_recv: dst 29680 matches my id: 29680, type=0x40b [2016/02/28 20:46:59.694026, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:254(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 7 (num_fds:0) from 29684 [2016/02/28 20:46:59.694039, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:385(winbind_msg_domain_online) Domain CHILD2 is marked as online now. [2016/02/28 20:46:59.694072, 10, pid=29684, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for CURRENT_DCNAME/CHILD2, we already got it [2016/02/28 20:46:59.694170, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:46:59.694232, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:46:59.694253, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.694263, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44318d20 [2016/02/28 20:46:59.694273, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443184b0 [2016/02/28 20:46:59.694283, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44318d20 "ltdb_callback" [2016/02/28 20:46:59.694321, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443184b0 "ltdb_timeout" [2016/02/28 20:46:59.694333, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44318d20 "ltdb_callback" [2016/02/28 20:46:59.694355, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:46:59.694363, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:46:59.694374, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:46:59.694386, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:46:59.694403, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:46:59.694423, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.694432, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff443190e0 [2016/02/28 20:46:59.694441, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44318e60 [2016/02/28 20:46:59.694451, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff443190e0 "ltdb_callback" [2016/02/28 20:46:59.694460, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:46:59.694468, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44318e60 "ltdb_timeout" [2016/02/28 20:46:59.694477, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff443190e0 "ltdb_callback" [2016/02/28 20:46:59.694487, 3, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:46:59.694511, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:46:59.694529, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.694537, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44318230 [2016/02/28 20:46:59.694546, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443184b0 [2016/02/28 20:46:59.694555, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44318230 "ltdb_callback" [2016/02/28 20:46:59.694656, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443184b0 "ltdb_timeout" [2016/02/28 20:46:59.694675, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44318230 "ltdb_callback" [2016/02/28 20:46:59.694811, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_netlogon.c:177(rpccli_setup_netlogon_creds) rpccli_setup_netlogon_creds: using cached netlogon_creds cli[URI-VGW-4$/URI-VGW-4] to Srv.child2.domain.local [2016/02/28 20:46:59.694875, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.695366, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.695388, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.695402, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.695415, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff44318920 [2016/02/28 20:46:59.695467, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.695479, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.695486, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.695542, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'gssapi_spnego' registered [2016/02/28 20:46:59.695558, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'gssapi_krb5' registered [2016/02/28 20:46:59.695566, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'gssapi_krb5_sasl' registered [2016/02/28 20:46:59.695574, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'spnego' registered [2016/02/28 20:46:59.695583, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'schannel' registered [2016/02/28 20:46:59.695592, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'naclrpc_as_system' registered [2016/02/28 20:46:59.695600, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'sasl-EXTERNAL' registered [2016/02/28 20:46:59.695609, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'ntlmssp' registered [2016/02/28 20:46:59.695617, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'http_basic' registered [2016/02/28 20:46:59.695626, 3, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'http_ntlm' registered [2016/02/28 20:46:59.695798, 5, pid=29684, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:672(gensec_start_mech) Starting GENSEC mechanism schannel [2016/02/28 20:46:59.695824, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 68, auth_level 6 [2016/02/28 20:46:59.695857, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1012(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2016/02/28 20:46:59.695961, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=25 [0000] 00 00 00 00 03 00 00 00 43 48 49 4C 44 32 00 55 ........ CHILD2.U [0010] 52 49 2D 56 47 57 2D 34 00 RI-VGW-4 . [2016/02/28 20:46:59.696035, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0069 (105) auth_length : 0x0019 (25) call_id : 0x00000001 (1) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=33 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 43 48 49 4C 44 32 00 55 52 49 2D 56 47 57 2D 34 CHILD2.U RI-VGW-4 [0020] 00 . [2016/02/28 20:46:59.696203, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.696236, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.696831, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 72 [2016/02/28 20:46:59.696868, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0058 (88) auth_length : 0x000c (12) call_id : 0x00000001 (1) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000393fd (234493) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] 00 00 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2016/02/28 20:46:59.697036, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 88 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.697050, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 88 bytes. [2016/02/28 20:46:59.697059, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:46:59.697069, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=12 [0000] 01 00 00 00 00 00 00 00 00 00 00 00 ........ .... [2016/02/28 20:46:59.697120, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.697129, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.697139, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.697151, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431ae90 [2016/02/28 20:46:59.697167, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.697183, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.697191, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.697205, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.697213, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.697222, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.697231, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431ae90 [2016/02/28 20:46:59.697245, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.697253, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.697260, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.697280, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:146(netlogon_creds_step) seed 60a1d3d3:3936d1bd [2016/02/28 20:46:59.697290, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:151(netlogon_creds_step) seed+time b775147a:3936d1bd [2016/02/28 20:46:59.697304, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:156(netlogon_creds_step) CLIENT aed19185:9cd042a1 [2016/02/28 20:46:59.697311, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:162(netlogon_creds_step) seed+time+1 b775147b:3936d1bd [2016/02/28 20:46:59.697318, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:167(netlogon_creds_step) SERVER fd64d684:580336a8 [2016/02/28 20:46:59.697348, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_LogonGetCapabilities: struct netr_LogonGetCapabilities in: struct netr_LogonGetCapabilities server_name : * server_name : '\\Srv.child2.domain.local' computer_name : * computer_name : 'URI-VGW-4' credential : * credential: struct netr_Authenticator cred: struct netr_Credential data : 8591d1aea142d09c timestamp : Sun Feb 28 20:47:03 2016 IST return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : 0000000000000000 timestamp : (time_t)0 query_level : 0x00000001 (1) [2016/02/28 20:46:59.697436, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2016/02/28 20:46:59.697543, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000002 (2) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x000000bc (188) context_id : 0x0000 (0) opnum : 0x0015 (21) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.697631, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:46:59.697707, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.697738, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.698283, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 104 [2016/02/28 20:46:59.698310, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0078 (120) auth_length : 0x0038 (56) call_id : 0x00000002 (2) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000018 (24) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=96 [0000] D3 B6 03 ED 13 2E 77 39 A0 D8 C3 2D 91 EE 44 CE ......w9 ...-..D. [0010] 2C 0A 3F B6 2D E6 BA 3C 30 6F 40 F9 0F 04 54 5C ,.?.-..< 0o@...T\ [0020] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0030] DF B1 22 AF 7B EF E6 37 9F 39 92 83 94 54 5C B8 ..".{..7 .9...T\. [0040] 04 5D 47 0B B3 9F AA B5 44 00 32 00 14 00 00 00 .]G..... D.2..... [0050] 00 00 00 00 13 00 00 00 63 00 68 00 69 00 6C 00 ........ c.h.i.l. [2016/02/28 20:46:59.698527, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:46:59.698537, 6, pid=29684, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:46:59.698545, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:46:59.698565, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 120, data_len 24, ss_len 8 [2016/02/28 20:46:59.698573, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 120 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.698581, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 24 bytes. [2016/02/28 20:46:59.698601, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_LogonGetCapabilities: struct netr_LogonGetCapabilities out: struct netr_LogonGetCapabilities return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : 84d664fda8360358 timestamp : (time_t)0 capabilities : * capabilities : union netr_Capabilities(case 1) server_capabilities : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC result : NT_STATUS_OK [2016/02/28 20:46:59.698763, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:46:59.698775, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/flash/samba/netlogon_creds_cli.tdb 3: [2016/02/28 20:46:59.698785, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.698797, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431a460 [2016/02/28 20:46:59.698812, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.698822, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:46:59.698830, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.698839, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.698846, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:46:59.698855, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:46:59.698864, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff44318030 [2016/02/28 20:46:59.698879, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:46:59.698887, 5, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:46:59.698894, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:46:59.698907, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:3195(cli_rpc_pipe_open_schannel_with_creds) cli_rpc_pipe_open_schannel_with_creds: opened pipe netlogon to machine Srv.child2.domain.local for domain CHILD2 and bound using schannel. [2016/02/28 20:46:59.698927, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsRGetDCName: struct netr_DsRGetDCName in: struct netr_DsRGetDCName server_unc : * server_unc : 'Srv.child2.domain.local' domain_name : * domain_name : 'DOMAIN' domain_guid : NULL site_guid : NULL flags : 0x40000000 (1073741824) 0: DS_FORCE_REDISCOVERY 0: DS_DIRECTORY_SERVICE_REQUIRED 0: DS_DIRECTORY_SERVICE_PREFERRED 0: DS_GC_SERVER_REQUIRED 0: DS_PDC_REQUIRED 0: DS_BACKGROUND_ONLY 0: DS_IP_REQUIRED 0: DS_KDC_REQUIRED 0: DS_TIMESERV_REQUIRED 0: DS_WRITABLE_REQUIRED 0: DS_GOOD_TIMESERV_PREFERRED 0: DS_AVOID_SELF 0: DS_ONLY_LDAP_NEEDED 0: DS_IS_FLAT_NAME 0: DS_IS_DNS_NAME 0: DS_TRY_NEXTCLOSEST_SITE 0: DS_DIRECTORY_SERVICE_6_REQUIRED 0: DS_WEB_SERVICE_REQUIRED 1: DS_RETURN_DNS_NAME 0: DS_RETURN_FLAT_NAME [2016/02/28 20:46:59.699033, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000003 (3) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000006c (108) context_id : 0x0000 (0) opnum : 0x0014 (20) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:46:59.699120, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:46:59.699171, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:46:59.699196, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:46:59.700200, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 424 [2016/02/28 20:46:59.700228, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x01b8 (440) auth_length : 0x0038 (56) call_id : 0x00000003 (3) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000160 (352) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=416 [0000] 5E 97 F8 84 C2 7E 28 25 91 65 F0 DE B7 A0 11 80 ^....~(% .e...... [0010] 3F 51 80 82 42 AA 07 74 D3 BB CC 28 A7 99 FB EC ?Q..B..t ...(.... [0020] 6A 61 4D 2F EC E8 F9 D3 A5 6E 2D 5D 4F FD 3F 58 jaM/.... .n-]O.?X [0030] 7E 99 5F EC B7 B6 4A B0 42 EA 08 A3 87 58 A1 37 ~._...J. B....X.7 [0040] 39 57 ED 14 BC 11 F2 71 43 60 4F F6 B6 89 AF 32 9W.....q C`O....2 [0050] B7 E4 24 B7 0A AD EC CF 3D 6D 8D 4E 9F 8B 7B 12 ..$..... =m.N..{. [0060] 75 B7 29 AE C9 C0 88 BE 0D 09 3C 6E 27 D9 AD 24 u.)..... ....g [0120] A1 B1 A3 53 DD CD 6A 91 90 9B 5C F4 66 53 1B ED ...S..j. ..\.fS.. [0130] 5C DF 45 C6 FE 36 AA B4 52 5D 1B FE 5C 77 6C 20 \.E..6.. R]..\wl [0140] 14 19 6D 06 04 8F B7 8D 8A 1E 15 02 D5 28 4C BB ..m..... .....(L. [0150] 08 A0 D1 D7 8D 8E B7 EF 05 E4 52 74 CA 12 B9 CF ........ ..Rt.... [0160] 44 06 00 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0170] 9E 50 7C 68 E5 E6 C2 F0 8E 76 F2 49 20 54 AB 51 .P|h.... .v.I T.Q [0180] 74 DD BB CA 17 0D EC 99 74 00 2D 00 53 00 69 00 t....... t.-.S.i. [0190] 74 00 65 00 2D 00 4E 00 61 00 6D 00 65 00 00 00 t.e.-.N. a.m.e... [2016/02/28 20:46:59.700788, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:46:59.700800, 6, pid=29684, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 0 [2016/02/28 20:46:59.700808, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:46:59.700871, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 440, data_len 352, ss_len 0 [2016/02/28 20:46:59.700880, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 440 at offset 0: NT_STATUS_OK [2016/02/28 20:46:59.700894, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 352 bytes. [2016/02/28 20:46:59.700922, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsRGetDCName: struct netr_DsRGetDCName out: struct netr_DsRGetDCName info : * info : * info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : '\\DC.domain.local' dc_address : * dc_address : '\\192.168.28.200' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : 648a62d6-5e24-40dc-a0a7-efc689e00852 domain_name : * domain_name : 'domain.local' forest_name : * forest_name : 'domain.local' dc_flags : 0xe00033fd (3758109693) 1: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 1: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 0: DS_SERVER_DS_8 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'Default-First-Site-Name' client_site_name : * client_site_name : 'Default-First-Site-Name' result : WERR_OK [2016/02/28 20:46:59.701059, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:885(get_dc_name_via_netlogon) dcerpc_netr_GetAnyDCName returned DC.domain.local [2016/02/28 20:46:59.701079, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:46:59.701088, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up DC.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:46:59.701099, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:160(namecache_fetch) no entry for DC.domain.local#20 found. [2016/02/28 20:46:59.701111, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2353(resolve_hosts) resolve_hosts: Attempting host lookup for name DC.domain.local<0x20> [2016/02/28 20:46:59.731925, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:46:59.731952, 5, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:78(namecache_store) namecache_store: storing 1 address for DC.domain.local#20: 192.168.28.200 [2016/02/28 20:46:59.731988, 10, pid=29684, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[NBT/DC.DOMAIN.LOCAL#20] and timeout=[Sun Feb 28 20:57:59 2016 IST] (660 seconds ahead) [2016/02/28 20:46:59.732022, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 1 addresses: 192.168.28.200:0 [2016/02/28 20:46:59.732038, 9, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain DOMAIN server DC.domain.local [2016/02/28 20:46:59.732048, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1525(get_dcs) Retrieved DC DC.domain.local at 192.168.28.200 via netlogon [2016/02/28 20:46:59.732069, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.28.200 at port 445 [2016/02/28 20:46:59.732535, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1023(cm_prepare_connection) cm_prepare_connection: connecting to DC DC.domain.local for domain DOMAIN [2016/02/28 20:46:59.734144, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:46:59.734223, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:46:59.734245, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.734254, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff4431d2e0 [2016/02/28 20:46:59.734263, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff4431d870 [2016/02/28 20:46:59.734273, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff4431d2e0 "ltdb_callback" [2016/02/28 20:46:59.734289, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff4431d870 "ltdb_timeout" [2016/02/28 20:46:59.734299, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff4431d2e0 "ltdb_callback" [2016/02/28 20:46:59.734308, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:46:59.734316, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:46:59.734326, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:46:59.734350, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:46:59.734368, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:46:59.734398, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.734407, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff4431e080 [2016/02/28 20:46:59.734416, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff4431de00 [2016/02/28 20:46:59.734425, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff4431e080 "ltdb_callback" [2016/02/28 20:46:59.734435, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:46:59.734443, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff4431de00 "ltdb_timeout" [2016/02/28 20:46:59.734452, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff4431e080 "ltdb_callback" [2016/02/28 20:46:59.734462, 3, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:46:59.734484, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:46:59.734502, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:46:59.734509, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff4431eaa0 [2016/02/28 20:46:59.734518, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff4431ec80 [2016/02/28 20:46:59.734527, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff4431eaa0 "ltdb_callback" [2016/02/28 20:46:59.734613, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff4431ec80 "ltdb_timeout" [2016/02/28 20:46:59.734624, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff4431eaa0 "ltdb_callback" [2016/02/28 20:46:59.734665, 5, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1116(cm_prepare_connection) connecting to DC.domain.local from URI-VGW-4 with kerberos principal [URI-VGW-4$@CHILD2.DOMAIN.LOCAL] and realm [domain.local] [2016/02/28 20:46:59.734694, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1772(cli_session_setup_spnego_send) Doing spnego session setup (blob length=120) [2016/02/28 20:46:59.734726, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1799(cli_session_setup_spnego_send) got OID=1.3.6.1.4.1.311.2.2.30 got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.2.840.113554.1.2.2.3 got OID=1.3.6.1.4.1.311.2.2.10 [2016/02/28 20:46:59.734741, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1809(cli_session_setup_spnego_send) got principal=not_defined_in_RFC4178@please_ignore [2016/02/28 20:46:59.734749, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1679(cli_session_setup_get_principal) cli_session_setup_spnego: using target hostname not SPNEGO principal [2016/02/28 20:46:59.734766, 3, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1694(cli_session_setup_get_principal) cli_session_setup_spnego: guessed server principal=cifs/DC.domain.local@DOMAIN.LOCAL [2016/02/28 20:46:59.734822, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:217(kerberos_kinit_password_ext) kerberos_kinit_password: as URI-VGW-4$@CHILD2.DOMAIN.LOCAL using [MEMORY:cliconnect] as ccache and config [(null)] [2016/02/28 20:47:00.024259, 2, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1288(cli_session_setup_kerberos_send) Doing kerberos session setup [2016/02/28 20:47:00.071328, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 33 [2016/02/28 20:47:00.071420, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn INTERFACE_VERSION [2016/02/28 20:47:00.071435, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:396(winbindd_interface_version) [29687]: request interface version (version = 27) [2016/02/28 20:47:00.071458, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29687:INTERFACE_VERSION]: delivered response to client [2016/02/28 20:47:00.071492, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2016/02/28 20:47:00.071503, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:429(winbindd_priv_pipe_dir) [29687]: request location of privileged pipe [2016/02/28 20:47:00.071525, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29687:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2016/02/28 20:47:00.071568, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 36 [2016/02/28 20:47:00.071639, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:965(winbind_client_request_read) closing socket 33, client exited [2016/02/28 20:47:00.071671, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29687:GID_TO_SID [2016/02/28 20:47:00.071693, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_gid_to_sid.c:46(winbindd_gid_to_sid_send) gid_to_sid 3 [2016/02/28 20:47:00.071719, 5, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:73(gencache_init) Opening cache file at /var/vol/3/.ctera/samba/cache/gencache.tdb [2016/02/28 20:47:00.071780, 5, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:124(gencache_init) Opening cache file at /var/vol/3/.ctera/samba/lock/gencache_notrans.tdb [2016/02/28 20:47:00.072490, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid in: struct wbint_Gid2Sid gid : 0x0000000000000003 (3) [2016/02/28 20:47:00.072558, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1422(fork_domain_child) fork_domain_child called without domain. [2016/02/28 20:47:00.072829, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1476(fork_domain_child) Child process 29690 [2016/02/28 20:47:00.073134, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 33 - private_data=(nil) [2016/02/28 20:47:00.073154, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 13 - private_data=(nil) [2016/02/28 20:47:00.073171, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:00.073178, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:00.073185, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1029 - private_data=(nil) [2016/02/28 20:47:00.073192, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:00.073199, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1033 - private_data=(nil) [2016/02/28 20:47:00.073205, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:00.073212, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1036 - private_data=(nil) [2016/02/28 20:47:00.073219, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1035 - private_data=(nil) [2016/02/28 20:47:00.073278, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:00.073292, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:00.073299, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:00.073306, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:00.073318, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:47:00.073329, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:461(messaging_register) Overriding messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:47:00.073363, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:566(set_domain_online_request) set_domain_online_request: called for domain CHILD2 [2016/02/28 20:47:00.073377, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:601(set_domain_online_request) set_domain_online_request: domain CHILD2 was globally offline. [2016/02/28 20:47:00.073396, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 8 extra bytes [2016/02/28 20:47:00.073408, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:00.073416, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:00.073426, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_GID2SID (no domain) [2016/02/28 20:47:00.073448, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid in: struct wbint_Gid2Sid gid : 0x0000000000000003 (3) [2016/02/28 20:47:00.073490, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap_util.c:106(idmap_gid_to_sid) idmap_gid_to_sid: gid = [3] [2016/02/28 20:47:00.073528, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:85(idmap_init) idmap_init(): calling static_init_idmap [2016/02/28 20:47:00.073538, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap_tdb.c:439(idmap_tdb_init) calling idmap_tdb_init [2016/02/28 20:47:00.073551, 5, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:239(smb_register_idmap) Successfully added idmap backend 'tdb' [2016/02/28 20:47:00.073566, 5, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:239(smb_register_idmap) Successfully added idmap backend 'passdb' [2016/02/28 20:47:00.073575, 5, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:239(smb_register_idmap) Successfully added idmap backend 'nss' [2016/02/28 20:47:00.073583, 5, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:239(smb_register_idmap) Successfully added idmap backend 'ldap' [2016/02/28 20:47:00.073597, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend smbpasswd [2016/02/28 20:47:00.073612, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'smbpasswd' [2016/02/28 20:47:00.073621, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend tdbsam [2016/02/28 20:47:00.073628, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'tdbsam' [2016/02/28 20:47:00.073636, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend wbc_sam [2016/02/28 20:47:00.073643, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'wbc_sam' [2016/02/28 20:47:00.073651, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend ldapsam [2016/02/28 20:47:00.073659, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'ldapsam' [2016/02/28 20:47:00.073670, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend NDS_ldapsam [2016/02/28 20:47:00.073682, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'NDS_ldapsam' [2016/02/28 20:47:00.073695, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend IPA_ldapsam [2016/02/28 20:47:00.073704, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'IPA_ldapsam' [2016/02/28 20:47:00.073714, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:154(make_pdb_method_name) Attempting to find a passdb backend to match smbpasswd (smbpasswd) [2016/02/28 20:47:00.073723, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:175(make_pdb_method_name) Found pdb backend smbpasswd [2016/02/28 20:47:00.073739, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:186(make_pdb_method_name) pdb backend smbpasswd has a valid init [2016/02/28 20:47:00.073894, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:139(idmap_found_domain_backend) Found idmap domain "child" [2016/02/28 20:47:00.073911, 3, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:282(idmap_init_domain) idmap backend rid not found [2016/02/28 20:47:00.073922, 5, pid=29690, effective(0, 0), real(0, 0)] ../lib/util/modules.c:171(do_smb_load_module) Probing module 'rid' [2016/02/28 20:47:00.073937, 5, pid=29690, effective(0, 0), real(0, 0)] ../lib/util/modules.c:185(do_smb_load_module) Probing module 'rid': Trying to load from //lib/idmap/rid.so [2016/02/28 20:47:00.075641, 2, pid=29690, effective(0, 0), real(0, 0)] ../lib/util/modules.c:196(do_smb_load_module) Module 'rid' loaded [2016/02/28 20:47:00.075664, 5, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:239(smb_register_idmap) Successfully added idmap backend 'rid' [2016/02/28 20:47:00.075705, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:139(idmap_found_domain_backend) Found idmap domain "domain" [2016/02/28 20:47:00.075740, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:139(idmap_found_domain_backend) Found idmap domain "child2" [2016/02/28 20:47:00.075764, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:139(idmap_found_domain_backend) Found idmap domain "*" [2016/02/28 20:47:00.075777, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:519(idmap_backends_unixid_to_sid) idmap_backend_unixid_to_sid: xid = 3 (type 2) [2016/02/28 20:47:00.075885, 10, pid=29690, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/GID2SID/3] and timeout=[Sun Feb 28 20:49:00 2016 IST] (120 seconds ahead) [2016/02/28 20:47:00.075928, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap_util.c:147(idmap_gid_to_sid) gid [3] not mapped [2016/02/28 20:47:00.075938, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid out: struct wbint_Gid2Sid sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:00.075983, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:00.075993, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3508 bytes to parent [2016/02/28 20:47:00.076052, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid out: struct wbint_Gid2Sid sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:00.076103, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_gid_to_sid.c:81(winbindd_gid_to_sid_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:00.076118, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29687:GID_TO_SID]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:00.076144, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29687:GID_TO_SID]: delivered response to client [2016/02/28 20:47:00.079505, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:965(winbind_client_request_read) closing socket 36, client exited [2016/02/28 20:47:00.212812, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 36 [2016/02/28 20:47:00.212873, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn INTERFACE_VERSION [2016/02/28 20:47:00.212885, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:396(winbindd_interface_version) [29695]: request interface version (version = 27) [2016/02/28 20:47:00.212905, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29695:INTERFACE_VERSION]: delivered response to client [2016/02/28 20:47:00.212937, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2016/02/28 20:47:00.212948, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:429(winbindd_priv_pipe_dir) [29695]: request location of privileged pipe [2016/02/28 20:47:00.212969, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29695:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2016/02/28 20:47:00.213006, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 38 [2016/02/28 20:47:00.213026, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:965(winbind_client_request_read) closing socket 36, client exited [2016/02/28 20:47:00.213044, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29695:GID_TO_SID [2016/02/28 20:47:00.213053, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_gid_to_sid.c:46(winbindd_gid_to_sid_send) gid_to_sid 7 [2016/02/28 20:47:00.213077, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid in: struct wbint_Gid2Sid gid : 0x0000000000000007 (7) [2016/02/28 20:47:00.213132, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 8 extra bytes [2016/02/28 20:47:00.213151, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:00.213159, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:00.213167, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_GID2SID (no domain) [2016/02/28 20:47:00.213178, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid in: struct wbint_Gid2Sid gid : 0x0000000000000007 (7) [2016/02/28 20:47:00.213196, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap_util.c:106(idmap_gid_to_sid) idmap_gid_to_sid: gid = [7] [2016/02/28 20:47:00.213210, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:519(idmap_backends_unixid_to_sid) idmap_backend_unixid_to_sid: xid = 7 (type 2) [2016/02/28 20:47:00.213235, 10, pid=29690, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/GID2SID/7] and timeout=[Sun Feb 28 20:49:00 2016 IST] (120 seconds ahead) [2016/02/28 20:47:00.213278, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap_util.c:147(idmap_gid_to_sid) gid [7] not mapped [2016/02/28 20:47:00.213286, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid out: struct wbint_Gid2Sid sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:00.213314, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:00.213322, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3508 bytes to parent [2016/02/28 20:47:00.213370, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid out: struct wbint_Gid2Sid sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:00.213403, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_gid_to_sid.c:81(winbindd_gid_to_sid_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:00.213412, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29695:GID_TO_SID]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:00.213431, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29695:GID_TO_SID]: delivered response to client [2016/02/28 20:47:00.214865, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:965(winbind_client_request_read) closing socket 38, client exited [2016/02/28 20:47:00.766920, 4, pid=29684, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:592(ads_krb5_mk_req) ads_krb5_mk_req: Advancing clock by 28 seconds to cope with clock skew [2016/02/28 20:47:00.766965, 3, pid=29684, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:339(ads_cleanup_expired_creds) ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect] expiration Mon, 29 Feb 2016 06:46:59 IST [2016/02/28 20:47:00.766984, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:606(ads_krb5_mk_req) ads_krb5_mk_req: Ticket (cifs/DC.domain.local@DOMAIN.LOCAL) in ccache (MEMORY:cliconnect) is valid until: (Mon, 29 Feb 2016 06:46:59 IST - 1456721219) [2016/02/28 20:47:00.767094, 10, pid=29684, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:882(get_krb5_smb_session_key) Got KRB5 session key of length 32 [2016/02/28 20:47:00.768658, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:00.768994, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:00.769299, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [DOMAIN], server = [DC.domain.local], expire = [1456771620] [2016/02/28 20:47:00.769332, 10, pid=29684, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[SAF/DOMAIN/DOMAIN] and timeout=[Mon Feb 29 20:47:00 2016 IST] (86400 seconds ahead) [2016/02/28 20:47:00.769373, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [domain.local], server = [DC.domain.local], expire = [1456771620] [2016/02/28 20:47:00.769385, 10, pid=29684, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[SAF/DOMAIN/DOMAIN.LOCAL] and timeout=[Mon Feb 29 20:47:00 2016 IST] (86400 seconds ahead) [2016/02/28 20:47:00.769451, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:3590(set_global_winbindd_state_online) set_global_winbindd_state_online: online requested. [2016/02/28 20:47:00.769466, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:3593(set_global_winbindd_state_online) set_global_winbindd_state_online: rejecting. [2016/02/28 20:47:00.769474, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:480(set_domain_online) set_domain_online: called for domain DOMAIN [2016/02/28 20:47:00.769492, 10, pid=29684, effective(0, 0), real(0, 0)] ../source3/lib/messages_dgm.c:284(messaging_dgm_send) messaging_dgm_send: Sending message to 29680 [2016/02/28 20:47:00.769525, 10, pid=29680, effective(0, 0), real(0, 0)] ../source4/lib/messaging/messaging.c:423(imessaging_dgm_recv) imessaging_dgm_recv: dst 29680 matches my id: 29680, type=0x40b [2016/02/28 20:47:00.769540, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:254(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 7 (num_fds:0) from 29684 [2016/02/28 20:47:00.769554, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:385(winbind_msg_domain_online) Domain DOMAIN is marked as online now. [2016/02/28 20:47:00.769581, 10, pid=29684, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[CURRENT_DCNAME/DOMAIN] and timeout=[Tue Jan 19 05:14:07 2038 IST] (690798427 seconds ahead) [2016/02/28 20:47:00.769619, 5, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2222(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: domain DOMAIN [2016/02/28 20:47:00.769645, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsrEnumerateDomainTrusts: struct netr_DsrEnumerateDomainTrusts in: struct netr_DsrEnumerateDomainTrusts server_name : * server_name : 'Srv.child2.domain.local' trust_flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES [2016/02/28 20:47:00.769711, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000004 (4) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000044 (68) context_id : 0x0000 (0) opnum : 0x0028 (40) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:00.769839, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:00.769892, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:00.769923, 5, pid=29684, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:00.770868, 5, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 536 [2016/02/28 20:47:00.770898, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0228 (552) auth_length : 0x0038 (56) call_id : 0x00000004 (4) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000001c8 (456) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=528 [0000] 4B BF 0B B9 97 78 D0 5C B4 80 12 F3 00 C5 23 BF K....x.\ ......#. [0010] 76 DC 91 C9 EB EC 11 FE 19 F1 FE C7 AE 1A 13 4C v....... .......L [0020] 06 C8 FC C1 14 9C 2E 81 FE C5 7E A0 C2 17 A2 17 ........ ..~..... [0030] B5 95 85 8B 9A 68 52 1C 18 7C 07 75 EC 44 F5 02 .....hR. .|.u.D.. [0040] 9E B4 37 5D 6B 8C 7D AB 7E 52 78 BC 2F 68 29 22 ..7]k.}. ~Rx./h)" [0050] 48 72 68 28 C1 84 CA 75 8A A9 3A 8A 8F A4 09 05 Hrh(...u ..:..... [0060] 40 C9 37 37 EA B7 0D 2B BF EE 6D 5B 79 D9 45 99 @.77...+ ..m[y.E. [0070] E3 B8 97 B8 B3 10 D9 91 8A F4 2D D8 A4 C9 AD 34 ........ ..-....4 [0080] 3B CD 92 D1 79 64 D3 25 E1 91 BC 69 A3 CF 0C 3C ;...yd.% ...i...< [0090] D7 E0 9D CC 8A 26 AC FE 7F D0 12 2B F0 B6 2C E8 .....&.. ...+..,. [00A0] D7 EF 59 C8 C0 46 42 12 A2 6B 19 5C EE A1 DE 39 ..Y..FB. .k.\...9 [00B0] 20 08 9A 87 E9 2D 57 2F 4C 0F AC 05 3A 36 A4 18 ....-W/ L...:6.. [00C0] 01 EB A7 8C F9 AC C2 0B 3D 4F C8 CC 1D A2 EF F1 ........ =O...... [00D0] E4 40 01 80 B8 8A A2 57 02 DA 7A 3A E3 F0 F8 2C .@.....W ..z:..., [00E0] 32 6E D6 EA 10 72 B2 7A AB 69 95 4E C9 22 E4 C9 2n...r.z .i.N.".. [00F0] 96 BE 0F 05 14 C5 D6 C9 F4 05 E5 E2 0A C7 E4 0D ........ ........ [0100] F1 C6 11 4B 68 83 D5 97 F7 BE CD A2 66 B1 51 36 ...Kh... ....f.Q6 [0110] 19 9D C2 91 18 9F A1 34 66 9C 43 8F EC B8 85 C9 .......4 f.C..... [0120] 6C 6D 83 0C 89 57 A7 55 36 AF 4A 01 4C FE 30 EF lm...W.U 6.J.L.0. [0130] 1C 81 94 7E D9 E7 6D 9B BD 36 D4 69 83 13 C9 90 ...~..m. .6.i.... [0140] 99 BF 5D 91 6B 9D 22 F3 D0 92 10 E8 12 F9 A3 C7 ..].k.". ........ [0150] 7C EB 27 5D AC 09 A3 CA 1A 67 5E 9A 79 27 B8 35 |.'].... .g^.y'.5 [0160] F2 30 FF D4 7F 7D D0 95 B1 B7 BA B2 A3 E7 89 34 .0...}.. .......4 [0170] 7B 09 28 8C 9B 15 84 91 9B 69 D9 ED 75 3F 33 0A {.(..... .i..u?3. [0180] 48 7C D8 56 23 6F B9 5D 10 25 34 7D 58 BB E1 FC H|.V#o.] .%4}X... [0190] 45 82 E6 D3 60 32 CA 81 DC C3 4C A5 20 73 A9 31 E...`2.. ..L. s.1 [01A0] 3C 18 F2 0A C1 59 27 E7 5F F7 E0 70 DE 28 A7 EC <....Y'. _..p.(.. [01B0] F4 A1 8B CA 16 28 A1 47 F1 7C DE A5 77 C8 8F A3 .....(.G .|..w... [01C0] D4 44 F4 25 70 C4 00 67 B9 F4 63 2A 94 15 F1 FD .D.%p..g ..c*.... [01D0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [01E0] 2B B9 AE 8E DA 49 21 DF 66 F7 32 DD 64 0D FC 40 +....I!. f.2.d..@ [01F0] 7D 99 09 B7 AB 1D 94 A5 E9 76 1C 7C DC 14 AE 31 }....... .v.|...1 [0200] 99 66 FA 35 C4 AE 74 F0 14 58 E6 95 87 24 DD C0 .f.5..t. .X...$.. [2016/02/28 20:47:00.771563, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:00.771574, 6, pid=29684, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:47:00.771582, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:00.771661, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 552, data_len 456, ss_len 8 [2016/02/28 20:47:00.771669, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 552 at offset 0: NT_STATUS_OK [2016/02/28 20:47:00.771677, 10, pid=29684, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 456 bytes. [2016/02/28 20:47:00.771709, 1, pid=29684, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsrEnumerateDomainTrusts: struct netr_DsrEnumerateDomainTrusts out: struct netr_DsrEnumerateDomainTrusts trusts : * trusts: struct netr_DomainTrustList count : 0x00000003 (3) array : * array: ARRAY(3) array: struct netr_DomainTrust netbios_name : * netbios_name : 'DOMAIN' dns_name : * dns_name : 'domain.local' trust_flags : 0x00000027 (39) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 1: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000020 (32) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 1: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION sid : * sid : S-1-5-21-962387436-534109671-967373764 guid : 648a62d6-5e24-40dc-a0a7-efc689e00852 array: struct netr_DomainTrust netbios_name : * netbios_name : 'CHILD' dns_name : * dns_name : 'child.domain.local' trust_flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000020 (32) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 1: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 guid : a33c6725-bd2a-462b-828b-583a97175a8e array: struct netr_DomainTrust netbios_name : * netbios_name : 'CHILD2' dns_name : * dns_name : 'child2.domain.local' trust_flags : 0x00000019 (25) 1: NETR_TRUST_FLAG_IN_FOREST 0: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 1: NETR_TRUST_FLAG_PRIMARY 1: NETR_TRUST_FLAG_NATIVE 0: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000000 (0) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION sid : * sid : S-1-5-21-733680754-3169875714-4083418759 guid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 result : WERR_OK [2016/02/28 20:47:00.772056, 5, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2309(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: domain DOMAIN is NOT in native mode. [2016/02/28 20:47:00.772066, 5, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2313(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: domain DOMAIN is running active directory. [2016/02/28 20:47:00.772075, 5, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:170(get_cache) get_cache: Setting ADS methods for domain DOMAIN [2016/02/28 20:47:00.772083, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:2910(trusted_domains) trusted_domains: [Cached] - doing backend query for info for domain DOMAIN [2016/02/28 20:47:00.772092, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1554(trusted_domains) ads: trusted_domains [2016/02/28 20:47:00.772226, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:47:00.772346, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:47:00.772369, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:00.772379, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff4431c720 [2016/02/28 20:47:00.772389, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff4431c7e0 [2016/02/28 20:47:00.772398, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff4431c720 "ltdb_callback" [2016/02/28 20:47:00.772416, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff4431c7e0 "ltdb_timeout" [2016/02/28 20:47:00.772426, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff4431c720 "ltdb_callback" [2016/02/28 20:47:00.772435, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:47:00.772442, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:47:00.772462, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:47:00.772475, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:47:00.772492, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:47:00.772513, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:00.772521, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff4431f350 [2016/02/28 20:47:00.772530, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44320380 [2016/02/28 20:47:00.772539, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff4431f350 "ltdb_callback" [2016/02/28 20:47:00.772548, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:47:00.772556, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44320380 "ltdb_timeout" [2016/02/28 20:47:00.772565, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff4431f350 "ltdb_callback" [2016/02/28 20:47:00.772576, 3, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:47:00.772599, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:47:00.772616, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:00.772624, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44320b70 [2016/02/28 20:47:00.772633, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44320d50 [2016/02/28 20:47:00.772642, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44320b70 "ltdb_callback" [2016/02/28 20:47:00.772730, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44320d50 "ltdb_timeout" [2016/02/28 20:47:00.772740, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44320b70 "ltdb_callback" [2016/02/28 20:47:00.772835, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:47:00.772884, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:47:00.772912, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:00.772921, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff443204f0 [2016/02/28 20:47:00.772930, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443205b0 [2016/02/28 20:47:00.772939, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff443204f0 "ltdb_callback" [2016/02/28 20:47:00.772954, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443205b0 "ltdb_timeout" [2016/02/28 20:47:00.772964, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff443204f0 "ltdb_callback" [2016/02/28 20:47:00.772973, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:47:00.772980, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:47:00.772990, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:47:00.773001, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:47:00.773017, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:47:00.773038, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:00.773045, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44320c30 [2016/02/28 20:47:00.773054, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44320840 [2016/02/28 20:47:00.773063, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44320c30 "ltdb_callback" [2016/02/28 20:47:00.773072, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:47:00.773080, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44320840 "ltdb_timeout" [2016/02/28 20:47:00.773089, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44320c30 "ltdb_callback" [2016/02/28 20:47:00.773098, 3, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:47:00.773118, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:47:00.773141, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:00.773150, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44321520 [2016/02/28 20:47:00.773158, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44321700 [2016/02/28 20:47:00.773167, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44321520 "ltdb_callback" [2016/02/28 20:47:00.773252, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44321700 "ltdb_timeout" [2016/02/28 20:47:00.773262, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44321520 "ltdb_callback" [2016/02/28 20:47:00.773289, 5, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1575(trusted_domains) trusted_domains: Could not open a connection to DOMAIN for PIPE_NETLOGON (NT_STATUS_CANT_ACCESS_DOMAIN_INFO) [2016/02/28 20:47:00.773303, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:168(winbindd_dual_list_trusted_domains) winbindd_dual_list_trusted_domains: trusted_domains returned NT_STATUS_UNSUCCESSFUL [2016/02/28 20:47:00.773311, 4, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 20 [2016/02/28 20:47:00.773319, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3496 bytes to parent [2016/02/28 20:47:00.773401, 4, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 51 [2016/02/28 20:47:00.773417, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn INIT_CONNECTION [2016/02/28 20:47:00.773429, 4, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 51 [2016/02/28 20:47:00.773436, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3496 bytes to parent [2016/02/28 20:47:00.773476, 4, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 20 [2016/02/28 20:47:00.773488, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn LIST_TRUSTDOM [2016/02/28 20:47:00.773495, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:161(winbindd_dual_list_trusted_domains) [29680]: list trusted domains [2016/02/28 20:47:00.773505, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:2910(trusted_domains) trusted_domains: [Cached] - doing backend query for info for domain DOMAIN [2016/02/28 20:47:00.773512, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1554(trusted_domains) ads: trusted_domains [2016/02/28 20:47:00.773584, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:47:00.773633, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:47:00.773661, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:00.773671, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44321420 [2016/02/28 20:47:00.773680, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff4431a460 [2016/02/28 20:47:00.773690, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44321420 "ltdb_callback" [2016/02/28 20:47:00.773706, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff4431a460 "ltdb_timeout" [2016/02/28 20:47:00.773715, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44321420 "ltdb_callback" [2016/02/28 20:47:00.773725, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:47:00.773732, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:47:00.773742, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:47:00.773754, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:47:00.773770, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:47:00.773790, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:00.773797, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44321230 [2016/02/28 20:47:00.773806, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443210f0 [2016/02/28 20:47:00.773815, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44321230 "ltdb_callback" [2016/02/28 20:47:00.773824, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:47:00.773832, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443210f0 "ltdb_timeout" [2016/02/28 20:47:00.773841, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44321230 "ltdb_callback" [2016/02/28 20:47:00.773851, 3, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:47:00.773871, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:47:00.773894, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:00.773903, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44321d40 [2016/02/28 20:47:00.773911, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44321f20 [2016/02/28 20:47:00.773937, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44321d40 "ltdb_callback" [2016/02/28 20:47:00.774038, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44321f20 "ltdb_timeout" [2016/02/28 20:47:00.774056, 10, pid=29684, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44321d40 "ltdb_callback" [2016/02/28 20:47:00.774085, 5, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1575(trusted_domains) trusted_domains: Could not open a connection to DOMAIN for PIPE_NETLOGON (NT_STATUS_CANT_ACCESS_DOMAIN_INFO) [2016/02/28 20:47:00.774097, 3, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:168(winbindd_dual_list_trusted_domains) winbindd_dual_list_trusted_domains: trusted_domains returned NT_STATUS_UNSUCCESSFUL [2016/02/28 20:47:00.774104, 4, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 20 [2016/02/28 20:47:00.774111, 10, pid=29684, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3496 bytes to parent [2016/02/28 20:47:00.774139, 1, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:329(trustdom_list_done) Could not receive trustdoms [2016/02/28 20:47:01.280312, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 36 [2016/02/28 20:47:01.280410, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn INTERFACE_VERSION [2016/02/28 20:47:01.280425, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:396(winbindd_interface_version) [29699]: request interface version (version = 27) [2016/02/28 20:47:01.280446, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29699:INTERFACE_VERSION]: delivered response to client [2016/02/28 20:47:01.280476, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2016/02/28 20:47:01.280486, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:429(winbindd_priv_pipe_dir) [29699]: request location of privileged pipe [2016/02/28 20:47:01.280509, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29699:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2016/02/28 20:47:01.280542, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 38 [2016/02/28 20:47:01.280568, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:965(winbind_client_request_read) closing socket 36, client exited [2016/02/28 20:47:01.280622, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29699:LOOKUPRIDS [2016/02/28 20:47:01.280640, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookuprids.c:57(winbindd_lookuprids_send) lookuprids (S-1-5-21-733680754-3169875714-4083418759) [2016/02/28 20:47:01.280656, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-5-21-733680754-3169875714-4083418759) [2016/02/28 20:47:01.280671, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1024(find_lookup_domain_from_sid) calling find_our_domain [2016/02/28 20:47:01.280689, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupRids: struct wbint_LookupRids in: struct wbint_LookupRids domain_sid : * domain_sid : S-1-5-21-733680754-3169875714-4083418759 rids : * rids: struct wbint_RidArray num_rids : 0x00000001 (1) rids: ARRAY(1) rids : 0x00000200 (512) [2016/02/28 20:47:01.280787, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 36 extra bytes [2016/02/28 20:47:01.280806, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.280814, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.280825, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPRIDS (CHILD2) [2016/02/28 20:47:01.280852, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupRids: struct wbint_LookupRids in: struct wbint_LookupRids domain_sid : * domain_sid : S-1-5-21-733680754-3169875714-4083418759 rids : * rids: struct wbint_RidArray num_rids : 0x00000001 (1) rids: ARRAY(1) rids : 0x00000200 (512) [2016/02/28 20:47:01.280909, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1490(sequence_number) ads: fetch sequence_number for CHILD2 [2016/02/28 20:47:01.280918, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:229(ads_cached_connection) ads_cached_connection [2016/02/28 20:47:01.280968, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:01.280981, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:77(ads_dc_name) ads_dc_name: domain=CHILD2 [2016/02/28 20:47:01.280996, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:01.281004, 6, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:408(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'child2.domain.local' [2016/02/28 20:47:01.281015, 8, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child2.domain.local (sitename Default-First-Site-Name) [2016/02/28 20:47:01.281043, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:01.281057, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:01.281074, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#1c (sitename Default-First-Site-Name) [2016/02/28 20:47:01.281094, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name child2.domain.local#1C found. [2016/02/28 20:47:01.281130, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.281139, 8, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:01.281154, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:01.281161, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:01.281172, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:01.281189, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.281204, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.281216, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.281223, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.281231, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:01.281239, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:389 [2016/02/28 20:47:01.281251, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.281259, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:253(ads_try_connect) ads_try_connect: sending CLDAP request to 192.168.82.95 (realm: child2.domain.local) [2016/02/28 20:47:01.282081, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x000031f9 (12793) 1: NBT_SERVER_PDC 0: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 0: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 forest : 'domain.local' dns_domain : 'child2.domain.local' pdc_dns_name : 'Srv.child2.domain.local' domain_name : 'CHILD2' pdc_name : 'SRV' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2016/02/28 20:47:01.282263, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [CHILD2], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:01.282282, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2, we already got it [2016/02/28 20:47:01.282291, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [child2.domain.local], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:01.282302, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:01.282312, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:751(ads_connect) Successfully contacted LDAP server 192.168.82.95 [2016/02/28 20:47:01.282325, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:01.282348, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:211(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2016/02/28 20:47:01.282392, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:874(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /var/vol/3/.ctera/samba/lock/smb_krb5/krb5.conf.CHILD2, realm = child2.domain.local, domain = CHILD2 [2016/02/28 20:47:01.282415, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:01.282427, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:01.282436, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#dcdc (sitename Default-First-Site-Name) [2016/02/28 20:47:01.282455, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2464(resolve_ads) resolve_ads: Attempting to resolve KDCs for child2.domain.local using DNS [2016/02/28 20:47:01.283683, 4, pid=29681, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:435(ads_dns_lookup_srv) ads_dns_lookup_srv: 1 records returned in the answer section. [2016/02/28 20:47:01.283706, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:216(ads_dns_parse_rr_srv) ads_dns_parse_rr_srv: Parsed srv.child2.domain.local [0, 100, 88] [2016/02/28 20:47:01.283717, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.283724, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 1 addresses: 192.168.82.95:88 [2016/02/28 20:47:01.283734, 8, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:01.283752, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:01.283761, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:01.283771, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:01.283796, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.283815, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.283837, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.283850, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.283863, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:01.283875, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:88 [2016/02/28 20:47:01.283884, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:706(get_kdc_ip_string) got 1 addresses from site Default-First-Site-Name search [2016/02/28 20:47:01.283900, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:01.283911, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:01.283920, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#dcdc (sitename (null)) [2016/02/28 20:47:01.283929, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2464(resolve_ads) resolve_ads: Attempting to resolve KDCs for child2.domain.local using DNS [2016/02/28 20:47:01.284682, 4, pid=29681, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:435(ads_dns_lookup_srv) ads_dns_lookup_srv: 1 records returned in the answer section. [2016/02/28 20:47:01.284703, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:216(ads_dns_parse_rr_srv) ads_dns_parse_rr_srv: Parsed srv.child2.domain.local [0, 100, 88] [2016/02/28 20:47:01.284713, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.284720, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 1 addresses: 192.168.82.95:88 [2016/02/28 20:47:01.284730, 8, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:01.284747, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:01.284755, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:01.284766, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:01.284789, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.284803, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.284815, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.284822, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.284830, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:01.284837, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:88 [2016/02/28 20:47:01.284845, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:712(get_kdc_ip_string) got 1 addresses from site-less search [2016/02/28 20:47:01.284853, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:744(get_kdc_ip_string) 0 additional KDCs to test [2016/02/28 20:47:01.284860, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:804(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 192.168.82.95 [2016/02/28 20:47:01.284912, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:966(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /var/vol/3/.ctera/samba/lock/smb_krb5/krb5.conf.CHILD2 with realm CHILD2.DOMAIN.LOCAL KDC list = kdc = 192.168.82.95 [2016/02/28 20:47:01.284932, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:151(ads_dc_name) ads_dc_name: using server='SRV.CHILD2.DOMAIN.LOCAL' IP=192.168.82.95 [2016/02/28 20:47:01.284941, 6, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:485(ads_find_dc) ads_find_dc: (ldap) looking for realm 'child2.domain.local' and falling back to domain '' [2016/02/28 20:47:01.284957, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:01.284984, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:77(ads_dc_name) ads_dc_name: domain= [2016/02/28 20:47:01.284997, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:01.285004, 6, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:408(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'child2.domain.local' [2016/02/28 20:47:01.285011, 8, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child2.domain.local (sitename Default-First-Site-Name) [2016/02/28 20:47:01.285026, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:01.285036, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:01.285045, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#1c (sitename Default-First-Site-Name) [2016/02/28 20:47:01.285055, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name child2.domain.local#1C found. [2016/02/28 20:47:01.285078, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.285087, 8, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:01.285108, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:01.285122, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:01.285134, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:01.285154, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.285167, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.285179, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.285186, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:01.285194, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:01.285201, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:389 [2016/02/28 20:47:01.285213, 9, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:01.285228, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:253(ads_try_connect) ads_try_connect: sending CLDAP request to 192.168.82.95 (realm: child2.domain.local) [2016/02/28 20:47:01.285682, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x000031f9 (12793) 1: NBT_SERVER_PDC 0: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 0: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 forest : 'domain.local' dns_domain : 'child2.domain.local' pdc_dns_name : 'Srv.child2.domain.local' domain_name : 'CHILD2' pdc_name : 'SRV' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2016/02/28 20:47:01.285840, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [CHILD2], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:01.285857, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2, we already got it [2016/02/28 20:47:01.285865, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [child2.domain.local], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:01.285876, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:01.285886, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:751(ads_connect) Successfully contacted LDAP server 192.168.82.95 [2016/02/28 20:47:01.285898, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:01.285910, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:151(ads_dc_name) ads_dc_name: using server='SRV.CHILD2.DOMAIN.LOCAL' IP=192.168.82.95 [2016/02/28 20:47:01.285927, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:253(ads_try_connect) ads_try_connect: sending CLDAP request to 192.168.82.95 (realm: child2.domain.local) [2016/02/28 20:47:01.286388, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x000031f9 (12793) 1: NBT_SERVER_PDC 0: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 0: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 forest : 'domain.local' dns_domain : 'child2.domain.local' pdc_dns_name : 'Srv.child2.domain.local' domain_name : 'CHILD2' pdc_name : 'SRV' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2016/02/28 20:47:01.286543, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [CHILD2], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:01.286560, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2, we already got it [2016/02/28 20:47:01.286569, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [child2.domain.local], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:01.286579, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:01.286590, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:751(ads_connect) Successfully contacted LDAP server 192.168.82.95 [2016/02/28 20:47:01.286599, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:72(ldap_open_with_timeout) Opening connection to LDAP server '192.168.82.95:389', timeout 15 seconds [2016/02/28 20:47:01.287320, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:107(ldap_open_with_timeout) Initialized connection for LDAP server 'ldap://192.168.82.95:389' [2016/02/28 20:47:01.287351, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:794(ads_connect) Connected to LDAP server Srv.child2.domain.local [2016/02/28 20:47:01.287360, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:211(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2016/02/28 20:47:01.287374, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [CHILD2], server = [Srv.child2.domain.local], expire = [1456771621] [2016/02/28 20:47:01.287389, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD2, we already got it [2016/02/28 20:47:01.287398, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [child2.domain.local], server = [Srv.child2.domain.local], expire = [1456771621] [2016/02/28 20:47:01.287410, 10, pid=29681, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD2.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:01.288770, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:3332(ads_current_time) KDC time offset is 27 seconds [2016/02/28 20:47:01.289085, 4, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:1336(ads_sasl_bind) Found SASL mechanism GSS-SPNEGO [2016/02/28 20:47:01.289592, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.30 [2016/02/28 20:47:01.289609, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2 [2016/02/28 20:47:01.289617, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2 [2016/02/28 20:47:01.289624, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2.3 [2016/02/28 20:47:01.289631, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10 [2016/02/28 20:47:01.289641, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:996(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got server principal name = not_defined_in_RFC4178@please_ignore [2016/02/28 20:47:01.289948, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:1017(ads_sasl_spnego_bind) ads_sasl_spnego_krb5_bind failed with: Miscellaneous failure (see text) : Did not find a plugin for ccache_ops, calling kinit [2016/02/28 20:47:01.289999, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:217(kerberos_kinit_password_ext) kerberos_kinit_password: as URI-VGW-4$@CHILD2.DOMAIN.LOCAL using [MEMORY:winbind_ccache] as ccache and config [/var/vol/3/.ctera/samba/lock/smb_krb5/krb5.conf.CHILD2] [2016/02/28 20:47:01.527100, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:665(ads_sasl_spnego_gsskrb5_bind) context (service ticket) valid for 36026 seconds [2016/02/28 20:47:01.527780, 5, pid=29681, effective(0, 0), real(0, 0)] ../source3/libads/ldap_utils.c:81(ads_do_search_retry_internal) Search for (objectclass=*) in <> gave 1 replies [2016/02/28 20:47:01.527835, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:500(wcache_store_seqnum) wcache_store_seqnum: success [CHILD2][122988 @ 1456685221] [2016/02/28 20:47:01.527849, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:01.527881, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:352(msrpc_rids_to_names) msrpc_rids_to_names: domain CHILD2 [2016/02/28 20:47:01.527894, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:01.527994, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:47:01.528090, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:47:01.528116, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:01.528127, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44319820 [2016/02/28 20:47:01.528136, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443198e0 [2016/02/28 20:47:01.528146, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44319820 "ltdb_callback" [2016/02/28 20:47:01.528164, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443198e0 "ltdb_timeout" [2016/02/28 20:47:01.528174, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44319820 "ltdb_callback" [2016/02/28 20:47:01.528184, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:47:01.528191, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:47:01.528202, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:47:01.528214, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:47:01.528231, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:47:01.528251, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:01.528259, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff443278f0 [2016/02/28 20:47:01.528267, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44319d70 [2016/02/28 20:47:01.528276, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff443278f0 "ltdb_callback" [2016/02/28 20:47:01.528286, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:47:01.528312, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44319d70 "ltdb_timeout" [2016/02/28 20:47:01.528323, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff443278f0 "ltdb_callback" [2016/02/28 20:47:01.528344, 3, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:47:01.528370, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:47:01.528388, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:01.528396, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff443282c0 [2016/02/28 20:47:01.528405, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443284a0 [2016/02/28 20:47:01.528414, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff443282c0 "ltdb_callback" [2016/02/28 20:47:01.528503, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443284a0 "ltdb_timeout" [2016/02/28 20:47:01.528513, 10, pid=29681, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff443282c0 "ltdb_callback" [2016/02/28 20:47:01.528564, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.82.95 at port 135 [2016/02/28 20:47:01.528895, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/util/util_net.c:890(print_socket_options) Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 0 SO_BROADCAST = 0 TCP_NODELAY = 0 TCP_KEEPCNT = 3 TCP_KEEPIDLE = 120 TCP_KEEPINTVL = 5 IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_SNDBUF = 22760 SO_RCVBUF = 87380 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 TCP_QUICKACK = 1 TCP_DEFER_ACCEPT = 0 [2016/02/28 20:47:01.529076, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 0, auth_level 1 [2016/02/28 20:47:01.529114, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000010 (16) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:47:01.529248, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:01.529262, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 72 [2016/02/28 20:47:01.529631, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 44 [2016/02/28 20:47:01.529667, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x00000010 (16) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x0002d494 (185492) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] A1 6E .n num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2016/02/28 20:47:01.529828, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 60 at offset 0: NT_STATUS_OK [2016/02/28 20:47:01.529844, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 60 bytes. [2016/02/28 20:47:01.529864, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:47:01.529902, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : * object : 12345778-1234-abcd-ef00-0123456789ab map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. [0010] 00 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0087 (135) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2016/02/28 20:47:01.530216, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000011 (17) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000084 (132) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:01.530315, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:01.530333, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 156 [2016/02/28 20:47:01.530778, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 136 [2016/02/28 20:47:01.530812, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x00000011 (17) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 C3 BA 0F C2 70 CC 97 4C 9A 40 6C 1B ........ p..L.@l. [0010] 4D E8 FC 89 01 00 00 00 01 00 00 00 00 00 00 00 M....... ........ [0020] 01 00 00 00 03 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 57 34 12 34 12 CD AB EF 00 01 .....xW4 .4...... [0040] 23 45 67 89 AB 00 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C0 06 01 00 09 04 00 C0 A8 52 5F 00 00 00 00 00 ........ .R_..... [2016/02/28 20:47:01.531049, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128, ss_len 0 [2016/02/28 20:47:01.531058, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 152 at offset 0: NT_STATUS_OK [2016/02/28 20:47:01.531070, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 128 bytes. [2016/02/28 20:47:01.531105, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : c20fbac3-cc70-4c97-9a40-6c1b4de8fc89 num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. [0010] 00 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc006 (49158) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 192.168.82.95 result : 0x00000000 (0) [2016/02/28 20:47:01.531456, 3, pid=29681, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.82.95 at port 49158 [2016/02/28 20:47:01.531802, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/util/util_net.c:890(print_socket_options) Socket options: SO_KEEPALIVE = 0 SO_REUSEADDR = 0 SO_BROADCAST = 0 TCP_NODELAY = 0 TCP_KEEPCNT = 3 TCP_KEEPIDLE = 120 TCP_KEEPINTVL = 5 IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_SNDBUF = 22760 SO_RCVBUF = 87380 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 TCP_QUICKACK = 1 TCP_DEFER_ACCEPT = 0 [2016/02/28 20:47:01.531863, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:01.531873, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:47:01.531884, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:47:01.531895, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431f140 [2016/02/28 20:47:01.531915, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:47:01.531923, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:01.531930, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:47:01.532051, 5, pid=29681, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:672(gensec_start_mech) Starting GENSEC mechanism schannel [2016/02/28 20:47:01.532079, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 68, auth_level 6 [2016/02/28 20:47:01.532096, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1012(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2016/02/28 20:47:01.532126, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=25 [0000] 00 00 00 00 03 00 00 00 43 48 49 4C 44 32 00 55 ........ CHILD2.U [0010] 52 49 2D 56 47 57 2D 34 00 RI-VGW-4 . [2016/02/28 20:47:01.532190, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0069 (105) auth_length : 0x0019 (25) call_id : 0x00000012 (18) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=33 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 43 48 49 4C 44 32 00 55 52 49 2D 56 47 57 2D 34 CHILD2.U RI-VGW-4 [0020] 00 . [2016/02/28 20:47:01.532372, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:01.532383, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 105 [2016/02/28 20:47:01.532760, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 64 [2016/02/28 20:47:01.532798, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0050 (80) auth_length : 0x000c (12) call_id : 0x00000012 (18) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000393fe (234494) secondary_address_size : 0x0006 (6) secondary_address : '49158' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 6F 00 ..o. [2016/02/28 20:47:01.532954, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 80 at offset 0: NT_STATUS_OK [2016/02/28 20:47:01.532964, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 80 bytes. [2016/02/28 20:47:01.532973, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:47:01.532982, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=12 [0000] 01 00 00 00 00 00 00 00 00 00 6F 00 ........ ..o. [2016/02/28 20:47:01.533033, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:01.533042, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:47:01.533052, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:47:01.533064, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff44319800 [2016/02/28 20:47:01.533091, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:47:01.533104, 5, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:01.533111, 10, pid=29681, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:47:01.533120, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:3195(cli_rpc_pipe_open_schannel_with_creds) cli_rpc_pipe_open_schannel_with_creds: opened pipe lsarpc to machine Srv.child2.domain.local for domain CHILD2 and bound using schannel. [2016/02/28 20:47:01.533135, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:410(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2016/02/28 20:47:01.533154, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-733680754-3169875714-4083418759-512 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:01.533246, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2016/02/28 20:47:01.533358, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000013 (19) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000084 (132) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:01.533453, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:01.533512, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:01.533521, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 232 [2016/02/28 20:47:01.534415, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 248 [2016/02/28 20:47:01.534447, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x00000013 (19) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a4 (164) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=240 [0000] 60 42 80 E6 F9 5D 17 5B C6 DD D7 3B C8 C0 5A 56 `B...].[ ...;..ZV [0010] FC 13 82 80 77 BA 66 DA 56 A6 E5 8B 60 F0 E4 E6 ....w.f. V...`... [0020] 2F E9 A3 4E C8 12 5B 89 86 16 6D D3 7C 88 5D 92 /..N..[. ..m.|.]. [0030] EB D7 0D 7A 22 DE 23 E1 8E 95 1B 49 08 7D 22 4A ...z".#. ...I.}"J [0040] 62 53 C6 58 9E 0A 03 45 1C AA DD 7A 9B 7D D6 BE bS.X...E ...z.}.. [0050] A5 B5 93 CB F4 52 EC BE 10 79 7A 23 A9 A8 95 85 .....R.. .yz#.... [0060] FE B3 A4 71 5E C7 CC DC 04 11 2B D1 0A B0 80 3B ...q^... ..+....; [0070] 89 68 62 20 DD 9E 24 EE 4B 94 31 78 65 96 52 A4 .hb ..$. K.1xe.R. [0080] 2C 35 5A 22 5A 7B 4D D8 58 B1 A5 98 C7 76 45 41 ,5Z"Z{M. X....vEA [0090] BF B3 44 D1 EE A2 FB F1 EF 71 3C AF DA 32 58 F8 ..D..... .q<..2X. [00A0] 86 42 E9 7A A1 DF 3B 91 FB D4 C2 EE 2A 1B C1 06 .B.z..;. ....*... [00B0] 44 06 0C 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] 0C 14 1C 2A BF 2B B5 23 D2 18 8F 18 E0 C5 61 20 ...*.+.# ......a [00D0] DF 22 09 2C A5 2B D5 54 00 00 00 00 00 00 00 00 .".,.+.T ........ [00E0] 15 00 00 00 EC DD 5C 39 E7 DD D5 1F C4 F3 A8 39 ......\9 .......9 [2016/02/28 20:47:01.534806, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:01.534826, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 12 [2016/02/28 20:47:01.534834, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:01.534874, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 164, ss_len 12 [2016/02/28 20:47:01.534882, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 264 at offset 0: NT_STATUS_OK [2016/02/28 20:47:01.534890, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 164 bytes. [2016/02/28 20:47:01.534918, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000c (12) size : 0x000e (14) string : * string : 'CHILD2' sid : * sid : S-1-5-21-733680754-3169875714-4083418759 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_DOM_GRP (2) name: struct lsa_String length : 0x001a (26) size : 0x001a (26) string : * string : 'Domain Admins' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:01.535043, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:253(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2016/02/28 20:47:01.535057, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:01.535065, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:01.535094, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-5-21-733680754-3169875714-4083418759-512 -> CHILD2\Domain Admins (NT_STATUS_OK) [2016/02/28 20:47:01.535122, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupRids: struct wbint_LookupRids out: struct wbint_LookupRids domain_name : * domain_name : * domain_name : 'CHILD2' names : * names: struct wbint_Principals num_principals : 1 principals: ARRAY(1) principals: struct wbint_Principal sid : S-1-5-21-733680754-3169875714-4083418759-512 type : SID_NAME_DOM_GRP (2) name : * name : 'Domain Admins' result : NT_STATUS_OK [2016/02/28 20:47:01.535192, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.535201, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3596 bytes to parent [2016/02/28 20:47:01.535286, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupRids: struct wbint_LookupRids out: struct wbint_LookupRids domain_name : * domain_name : * domain_name : 'CHILD2' names : * names: struct wbint_Principals num_principals : 1 principals: ARRAY(1) principals: struct wbint_Principal sid : S-1-5-21-733680754-3169875714-4083418759-512 type : SID_NAME_DOM_GRP (2) name : * name : 'Domain Admins' result : NT_STATUS_OK [2016/02/28 20:47:01.535378, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29699:LOOKUPRIDS]: NT_STATUS_OK [2016/02/28 20:47:01.535405, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29699:LOOKUPRIDS]: delivered response to client [2016/02/28 20:47:01.544435, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:965(winbind_client_request_read) closing socket 38, client exited [2016/02/28 20:47:01.546301, 1, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:387(winbindd_sig_hup_handler) Reloading services after SIGHUP [2016/02/28 20:47:01.546326, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:3168(wcache_invalidate_cache_noinit) wcache_invalidate_cache: invalidating cache entries for BUILTIN [2016/02/28 20:47:01.546409, 3, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:3714(lp_load_ex) lp_load_ex: refreshing parameters [2016/02/28 20:47:01.546425, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:1296(free_param_opts) Freeing parametrics: [2016/02/28 20:47:01.546492, 3, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:527(init_globals) Initialising global parameters [2016/02/28 20:47:01.546511, 2, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:316(max_open_files) rlimit_max: increasing rlimit_max (193) to minimum Windows limit (16384) [2016/02/28 20:47:01.546585, 3, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:2643(lp_do_section) Processing section "[global]" doing parameter netbios name = uri-vgw-4 doing parameter server string = doing parameter encrypt passwords = yes doing parameter server signing = disabled doing parameter log level = 10 [2016/02/28 20:47:01.546623, 5, pid=29680, effective(0, 0), real(0, 0)] ../lib/util/debug.c:638(debug_dump_status) INFO: Current debug levels: all: 10 tdb: 10 printdrivers: 10 lanman: 10 smb: 10 rpc_parse: 10 rpc_srv: 10 rpc_cli: 10 passdb: 10 sam: 10 auth: 10 winbind: 10 vfs: 10 idmap: 10 quota: 10 acls: 10 locking: 10 msdfs: 10 dmapi: 10 registry: 10 scavenger: 10 dns: 10 ldb: 10 tevent: 10 doing parameter debug pid = yes doing parameter read only = no doing parameter guest account = nobody doing parameter deadtime = 10 doing parameter enable core files = no doing parameter max smbd processes = 30 doing parameter passdb backend = smbpasswd doing parameter socket options = TCP_KEEPIDLE=120 TCP_KEEPCNT=3 TCP_KEEPINTVL=5 doing parameter disable netbios = yes doing parameter restrict anonymous = 2 doing parameter client max protocol = SMB3 doing parameter aio read size = 4096 doing parameter aio write size = 4096 doing parameter security = ads doing parameter workgroup = CHILD2 doing parameter realm = CHILD2.DOMAIN.LOCAL doing parameter kerberos method = secrets only doing parameter machine password timeout = 0 doing parameter allow trusted domains = yes doing parameter winbind use default domain = yes doing parameter winbind additional group sids = S-1-1-0 doing parameter client ldap sasl wrapping = sign doing parameter saf:ttl = 86400 doing parameter winbind max clients = 130 doing parameter idmap config * : backend = passdb doing parameter idmap config * : range = 0-199999 doing parameter idmap config CHILD2:backend = rid doing parameter idmap config CHILD2:range = 200000-4999999 doing parameter idmap config DOMAIN:backend = rid doing parameter idmap config DOMAIN:range = 5000000-9999999 doing parameter idmap config CHILD:backend = rid doing parameter idmap config CHILD:range = 10000000-14999999 doing parameter map to guest = never doing parameter max log size = 10000 doing parameter lock directory = /var/vol/3/.ctera/samba/lock doing parameter state directory = /var/vol/3/.ctera/samba doing parameter cache directory = /var/vol/3/.ctera/samba/cache [2016/02/28 20:47:01.547154, 4, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:3755(lp_load_ex) pm_process() returned Yes [2016/02/28 20:47:01.547170, 7, pid=29680, effective(0, 0), real(0, 0)] ../source3/param/loadparm.c:4071(lp_servicenumber) lp_servicenumber: couldn't find homes [2016/02/28 20:47:01.547233, 2, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/interface.c:341(add_interface) added interface eth0 ip=192.168.91.3 bcast=192.168.95.255 netmask=255.255.248.0 [2016/02/28 20:47:01.752385, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 36 [2016/02/28 20:47:01.752458, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn INTERFACE_VERSION [2016/02/28 20:47:01.752473, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:396(winbindd_interface_version) [29700]: request interface version (version = 27) [2016/02/28 20:47:01.752492, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:INTERFACE_VERSION]: delivered response to client [2016/02/28 20:47:01.752522, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2016/02/28 20:47:01.752544, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:429(winbindd_priv_pipe_dir) [29700]: request location of privileged pipe [2016/02/28 20:47:01.752568, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2016/02/28 20:47:01.752603, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 38 [2016/02/28 20:47:01.752628, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:965(winbind_client_request_read) closing socket 36, client exited [2016/02/28 20:47:01.752655, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29700:GETPWNAM [2016/02/28 20:47:01.752670, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getpwnam.c:56(winbindd_getpwnam_send) getpwnam uri-vgw-4\nobody [2016/02/28 20:47:01.752699, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'URI-VGW-4' name : * name : 'NOBODY' flags : 0x00000008 (8) [2016/02/28 20:47:01.752745, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1420(fork_domain_child) fork_domain_child called for domain 'URI-VGW-4' [2016/02/28 20:47:01.753227, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1476(fork_domain_child) Child process 29704 [2016/02/28 20:47:01.753556, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 33 - private_data=(nil) [2016/02/28 20:47:01.753576, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 13 - private_data=(nil) [2016/02/28 20:47:01.753583, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:01.753590, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:01.753597, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1029 - private_data=(nil) [2016/02/28 20:47:01.753604, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:01.753611, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1033 - private_data=(nil) [2016/02/28 20:47:01.753622, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:01.753630, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1036 - private_data=(nil) [2016/02/28 20:47:01.753637, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1035 - private_data=(nil) [2016/02/28 20:47:01.753704, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:01.753728, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:01.753735, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:01.753742, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:01.753750, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:47:01.753760, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:461(messaging_register) Overriding messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:47:01.753780, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:01.753796, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.753804, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.753815, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:01.754086, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'URI-VGW-4' name : * name : 'NOBODY' flags : 0x00000008 (8) [2016/02/28 20:47:01.754154, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2620(set_dc_type_and_flags) set_dc_type_and_flags: setting up flags for primary or internal domain [2016/02/28 20:47:01.754167, 5, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2357(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: domain URI-VGW-4 [2016/02/28 20:47:01.754332, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:01.754367, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe dssetup [2016/02/28 20:47:01.754378, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe dssetup [2016/02/28 20:47:01.754434, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:01.754477, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection dssetup [2016/02/28 20:47:01.754490, 5, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2393(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo on domain URI-VGW-4 failed: (NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) [2016/02/28 20:47:01.755692, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:01.755725, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:01.755736, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:01.755765, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:01.755807, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : NULL attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:01.755919, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:01.755940, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:01.755951, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:01.755963, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.756237, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000001-0000-0000-d356-a54008740000 result : NT_STATUS_OK [2016/02/28 20:47:01.756302, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 in: struct lsa_QueryInfoPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000001-0000-0000-d356-a54008740000 level : LSA_POLICY_INFO_DNS (12) [2016/02/28 20:47:01.756370, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend smbpasswd [2016/02/28 20:47:01.756389, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'smbpasswd' [2016/02/28 20:47:01.756399, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend tdbsam [2016/02/28 20:47:01.756406, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'tdbsam' [2016/02/28 20:47:01.756414, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend wbc_sam [2016/02/28 20:47:01.756422, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'wbc_sam' [2016/02/28 20:47:01.756430, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend ldapsam [2016/02/28 20:47:01.756438, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'ldapsam' [2016/02/28 20:47:01.756445, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend NDS_ldapsam [2016/02/28 20:47:01.756453, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'NDS_ldapsam' [2016/02/28 20:47:01.756460, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend IPA_ldapsam [2016/02/28 20:47:01.756467, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'IPA_ldapsam' [2016/02/28 20:47:01.756477, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:154(make_pdb_method_name) Attempting to find a passdb backend to match smbpasswd (smbpasswd) [2016/02/28 20:47:01.756485, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:175(make_pdb_method_name) Found pdb backend smbpasswd [2016/02/28 20:47:01.756822, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:186(make_pdb_method_name) pdb backend smbpasswd has a valid init [2016/02/28 20:47:01.756860, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:01.756968, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:01.756981, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:01.756991, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:01.757003, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.757120, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-d356-a54008740000 result : NT_STATUS_OK [2016/02/28 20:47:01.757175, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_QueryInfoPolicy: struct lsa_QueryInfoPolicy in: struct lsa_QueryInfoPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-d356-a54008740000 level : LSA_POLICY_INFO_ACCOUNT_DOMAIN (5) [2016/02/28 20:47:01.757205, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.757231, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_QueryInfoPolicy: struct lsa_QueryInfoPolicy out: struct lsa_QueryInfoPolicy info : * info : * info : union lsa_PolicyInformation(case 5) account_domain: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'URI-VGW-4' sid : * sid : S-1-5-21-1247966704-913105281-4028998813 result : NT_STATUS_OK [2016/02/28 20:47:01.757321, 5, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2596(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: domain URI-VGW-4 is NOT in native mode. [2016/02/28 20:47:01.757332, 5, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2599(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: domain URI-VGW-4 is NOT running active directory. [2016/02/28 20:47:01.757354, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:01.757375, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:01.757387, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:01.757422, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:01.757435, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:01.757444, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:01.757470, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:01.759781, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:01.759897, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:01.759912, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:01.759932, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:01.759943, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.759969, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000003-0000-0000-d356-a54008740000 result : NT_STATUS_OK [2016/02/28 20:47:01.760013, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: URI-VGW-4\NOBODY for domain URI-VGW-4 [2016/02/28 20:47:01.760045, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000003-0000-0000-d356-a54008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'URI-VGW-4\NOBODY' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:01.760114, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.760141, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name URI-VGW-4\NOBODY [2016/02/28 20:47:01.760152, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: URI-VGW-4\NOBODY => domain=[URI-VGW-4], name=[NOBODY] [2016/02/28 20:47:01.760161, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:01.760176, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:1293(smbpasswd_getsampwnam) getsampwnam (smbpasswd): search by name: NOBODY [2016/02/28 20:47:01.760186, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:238(startsmbfilepwent) startsmbfilepwent_internal: opening file /flash/samba/smbpasswd [2016/02/28 20:47:01.760217, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:587(getsmbfilepwent) getsmbfilepwent: end of file reached. [2016/02/28 20:47:01.760240, 7, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:355(endsmbfilepwent) endsmbfilepwent_internal: closed password file. [2016/02/28 20:47:01.760329, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/groupdb/mapping_tdb.c:284(find_map) failed to unpack map [2016/02/28 20:47:01.760369, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:181(lookup_lsa_rids) init_lsa_rids: URI-VGW-4\NOBODY not found [2016/02/28 20:47:01.760378, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.760464, 2, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:328(rpc_name_to_sid) name_to_sid: failed to lookup name: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.760485, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000003-0000-0000-d356-a54008740000 [2016/02/28 20:47:01.760513, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.760538, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.760561, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:01.760568, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:01.760601, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:01.760626, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4772(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Searching for domain URI-VGW-4 [2016/02/28 20:47:01.760659, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4787(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Found domain URI-VGW-4 [2016/02/28 20:47:01.760672, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:991(sam_sequence_number) samr: sequence number [2016/02/28 20:47:01.760704, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested samr [2016/02/28 20:47:01.760717, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe samr [2016/02/28 20:47:01.760724, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe samr [2016/02/28 20:47:01.760752, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe samr [2016/02/28 20:47:01.760799, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_Connect2: struct samr_Connect2 in: struct samr_Connect2 system_name : NULL access_mask : 0x02000000 (33554432) 0: SAMR_ACCESS_CONNECT_TO_SERVER 0: SAMR_ACCESS_SHUTDOWN_SERVER 0: SAMR_ACCESS_INITIALIZE_SERVER 0: SAMR_ACCESS_CREATE_DOMAIN 0: SAMR_ACCESS_ENUM_DOMAINS 0: SAMR_ACCESS_LOOKUP_DOMAIN [2016/02/28 20:47:01.760841, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:3866(_samr_Connect2) _samr_Connect2: 3866 [2016/02/28 20:47:01.760855, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f003f [2016/02/28 20:47:01.760864, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _samr_Connect2: ACCESS should be DENIED (requested: 0x000f003f) but overritten by euid == initial uid [2016/02/28 20:47:01.760874, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _samr_Connect2: access GRANTED (requested: 0x000f003f, granted: 0x000f003f) [2016/02/28 20:47:01.760882, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 04 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.760907, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:3895(_samr_Connect2) _samr_Connect2: 3895 [2016/02/28 20:47:01.760914, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_Connect2: struct samr_Connect2 out: struct samr_Connect2 connect_handle : * connect_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000004-0000-0000-d356-a54008740000 result : NT_STATUS_OK [2016/02/28 20:47:01.760971, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_OpenDomain: struct samr_OpenDomain in: struct samr_OpenDomain connect_handle : * connect_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000004-0000-0000-d356-a54008740000 access_mask : 0x02000000 (33554432) 0: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 0: SAMR_DOMAIN_ACCESS_SET_INFO_1 0: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 0: SAMR_DOMAIN_ACCESS_SET_INFO_2 0: SAMR_DOMAIN_ACCESS_CREATE_USER 0: SAMR_DOMAIN_ACCESS_CREATE_GROUP 0: SAMR_DOMAIN_ACCESS_CREATE_ALIAS 0: SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS 0: SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS 0: SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT 0: SAMR_DOMAIN_ACCESS_SET_INFO_3 sid : * sid : S-1-5-21-1247966704-913105281-4028998813 [2016/02/28 20:47:01.761054, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 04 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.761080, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:522(_policy_handle_find) found handle of type struct samr_connect_info [2016/02/28 20:47:01.761090, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f07ff [2016/02/28 20:47:01.761098, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:84(access_check_object) access_check_object: user rights access mask [0x3f0] [2016/02/28 20:47:01.761106, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _samr_OpenDomain: ACCESS should be DENIED (requested: 0x000f040f) but overritten by euid == initial uid [2016/02/28 20:47:01.761115, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _samr_OpenDomain: access GRANTED (requested: 0x000f040f, granted: 0x000f07ff) [2016/02/28 20:47:01.761124, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.761150, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:500(_samr_OpenDomain) _samr_OpenDomain: 500 [2016/02/28 20:47:01.761158, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_OpenDomain: struct samr_OpenDomain out: struct samr_OpenDomain domain_handle : * domain_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-d356-a54008740000 result : NT_STATUS_OK [2016/02/28 20:47:01.761207, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_QueryDomainInfo: struct samr_QueryDomainInfo in: struct samr_QueryDomainInfo domain_handle : * domain_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-d356-a54008740000 level : DomainModifiedInformation (8) [2016/02/28 20:47:01.761248, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:3499(_samr_QueryDomainInfo) _samr_QueryDomainInfo: 3499 [2016/02/28 20:47:01.761256, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.761287, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:522(_policy_handle_find) found handle of type struct samr_domain_info [2016/02/28 20:47:01.761295, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:3589(_samr_QueryDomainInfo) _samr_QueryDomainInfo: 3589 [2016/02/28 20:47:01.761302, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_QueryDomainInfo: struct samr_QueryDomainInfo out: struct samr_QueryDomainInfo info : * info : * info : union samr_DomainInfo(case 8) info8: struct samr_DomInfo8 sequence_num : 0x0000000056d340a5 (1456685221) domain_create_time : NTTIME(0) result : NT_STATUS_OK [2016/02/28 20:47:01.761360, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:963(rpc_sequence_number) domain_sequence_number: for domain URI-VGW-4 is 1456685221 [2016/02/28 20:47:01.761387, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_Close: struct samr_Close in: struct samr_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-d356-a54008740000 [2016/02/28 20:47:01.761416, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.761441, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:01.761448, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_Close: struct samr_Close out: struct samr_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:01.761480, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection samr [2016/02/28 20:47:01.761509, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:500(wcache_store_seqnum) wcache_store_seqnum: success [URI-VGW-4][1456685221 @ 1456685221] [2016/02/28 20:47:01.761523, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:01.761545, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: URI-VGW-4\NOBODY -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:01.761563, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> URI-VGW-4\nobody (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:01.761572, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.761615, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.761623, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:01.761673, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.761728, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getpwnam.c:137(winbindd_getpwnam_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.761741, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29700:GETPWNAM]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.761764, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:GETPWNAM]: delivered response to client [2016/02/28 20:47:01.761848, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29700:GETPWNAM [2016/02/28 20:47:01.761863, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getpwnam.c:56(winbindd_getpwnam_send) getpwnam URI-VGW-4\nobody [2016/02/28 20:47:01.761880, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'URI-VGW-4' name : * name : 'NOBODY' flags : 0x00000008 (8) [2016/02/28 20:47:01.761931, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:01.761943, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.761951, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.761958, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:01.761970, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'URI-VGW-4' name : * name : 'NOBODY' flags : 0x00000008 (8) [2016/02/28 20:47:01.761999, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:01.762006, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:01.762049, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:01.762062, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:01.762071, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:01.762097, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:01.762116, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:01.762212, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:01.762224, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:01.762234, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:01.762243, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 06 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.762268, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000006-0000-0000-d356-a54008740000 result : NT_STATUS_OK [2016/02/28 20:47:01.762316, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: URI-VGW-4\NOBODY for domain URI-VGW-4 [2016/02/28 20:47:01.762351, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000006-0000-0000-d356-a54008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'URI-VGW-4\NOBODY' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:01.762419, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 06 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.762444, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name URI-VGW-4\NOBODY [2016/02/28 20:47:01.762452, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: URI-VGW-4\NOBODY => domain=[URI-VGW-4], name=[NOBODY] [2016/02/28 20:47:01.762460, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:01.762470, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:1293(smbpasswd_getsampwnam) getsampwnam (smbpasswd): search by name: NOBODY [2016/02/28 20:47:01.762477, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:238(startsmbfilepwent) startsmbfilepwent_internal: opening file /flash/samba/smbpasswd [2016/02/28 20:47:01.762499, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:587(getsmbfilepwent) getsmbfilepwent: end of file reached. [2016/02/28 20:47:01.762514, 7, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:355(endsmbfilepwent) endsmbfilepwent_internal: closed password file. [2016/02/28 20:47:01.762536, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/groupdb/mapping_tdb.c:284(find_map) failed to unpack map [2016/02/28 20:47:01.762557, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:181(lookup_lsa_rids) init_lsa_rids: URI-VGW-4\NOBODY not found [2016/02/28 20:47:01.762565, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.762654, 2, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:328(rpc_name_to_sid) name_to_sid: failed to lookup name: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.762672, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000006-0000-0000-d356-a54008740000 [2016/02/28 20:47:01.762697, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 06 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.762721, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 06 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.762744, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:01.762751, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:01.762782, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:01.762796, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:01.762804, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:01.762819, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: URI-VGW-4\NOBODY -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:01.762833, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> URI-VGW-4\nobody (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:01.762841, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.762878, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.762887, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:01.762920, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.762956, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getpwnam.c:137(winbindd_getpwnam_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.762965, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29700:GETPWNAM]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.762984, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:GETPWNAM]: delivered response to client [2016/02/28 20:47:01.763063, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29700:GETPWNAM [2016/02/28 20:47:01.763077, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getpwnam.c:56(winbindd_getpwnam_send) getpwnam URI-VGW-4\NOBODY [2016/02/28 20:47:01.763094, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'URI-VGW-4' name : * name : 'NOBODY' flags : 0x00000008 (8) [2016/02/28 20:47:01.763144, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:01.763156, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.763163, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.763170, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:01.763182, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'URI-VGW-4' name : * name : 'NOBODY' flags : 0x00000008 (8) [2016/02/28 20:47:01.763211, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:01.763219, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:01.763251, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:01.763272, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:01.763281, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:01.763307, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:01.763326, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:01.763435, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:01.763447, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:01.763457, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:01.763466, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 07 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.763492, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000007-0000-0000-d356-a54008740000 result : NT_STATUS_OK [2016/02/28 20:47:01.763531, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: URI-VGW-4\NOBODY for domain URI-VGW-4 [2016/02/28 20:47:01.763561, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000007-0000-0000-d356-a54008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'URI-VGW-4\NOBODY' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:01.763627, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 07 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.763652, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name URI-VGW-4\NOBODY [2016/02/28 20:47:01.763660, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: URI-VGW-4\NOBODY => domain=[URI-VGW-4], name=[NOBODY] [2016/02/28 20:47:01.763668, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:01.763678, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:1293(smbpasswd_getsampwnam) getsampwnam (smbpasswd): search by name: NOBODY [2016/02/28 20:47:01.763685, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:238(startsmbfilepwent) startsmbfilepwent_internal: opening file /flash/samba/smbpasswd [2016/02/28 20:47:01.763707, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:587(getsmbfilepwent) getsmbfilepwent: end of file reached. [2016/02/28 20:47:01.763721, 7, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:355(endsmbfilepwent) endsmbfilepwent_internal: closed password file. [2016/02/28 20:47:01.763742, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/groupdb/mapping_tdb.c:284(find_map) failed to unpack map [2016/02/28 20:47:01.763763, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:181(lookup_lsa_rids) init_lsa_rids: URI-VGW-4\NOBODY not found [2016/02/28 20:47:01.763771, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.763857, 2, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:328(rpc_name_to_sid) name_to_sid: failed to lookup name: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.763874, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000007-0000-0000-d356-a54008740000 [2016/02/28 20:47:01.763898, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 07 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.763923, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 07 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.763946, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:01.763953, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:01.763984, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:01.763998, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:01.764006, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:01.764022, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: URI-VGW-4\NOBODY -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:01.764035, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> URI-VGW-4\nobody (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:01.764044, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.764073, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.764081, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:01.764121, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.764157, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getpwnam.c:137(winbindd_getpwnam_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.764166, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29700:GETPWNAM]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.764185, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:GETPWNAM]: delivered response to client [2016/02/28 20:47:01.764285, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29700:PING [2016/02/28 20:47:01.764303, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29700:PING]: NT_STATUS_OK [2016/02/28 20:47:01.764319, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:PING]: delivered response to client [2016/02/28 20:47:01.765481, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29700:GID_TO_SID [2016/02/28 20:47:01.765501, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_gid_to_sid.c:46(winbindd_gid_to_sid_send) gid_to_sid 4 [2016/02/28 20:47:01.765520, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid in: struct wbint_Gid2Sid gid : 0x0000000000000004 (4) [2016/02/28 20:47:01.765571, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 8 extra bytes [2016/02/28 20:47:01.765589, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.765597, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.765605, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_GID2SID (no domain) [2016/02/28 20:47:01.765616, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid in: struct wbint_Gid2Sid gid : 0x0000000000000004 (4) [2016/02/28 20:47:01.765634, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap_util.c:106(idmap_gid_to_sid) idmap_gid_to_sid: gid = [4] [2016/02/28 20:47:01.765648, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:519(idmap_backends_unixid_to_sid) idmap_backend_unixid_to_sid: xid = 4 (type 2) [2016/02/28 20:47:01.765686, 10, pid=29690, effective(0, 0), real(0, 0)] ../source3/groupdb/mapping_tdb.c:284(find_map) failed to unpack map [2016/02/28 20:47:01.765716, 10, pid=29690, effective(0, 0), real(0, 0)] ../source3/groupdb/mapping_tdb.c:284(find_map) failed to unpack map [2016/02/28 20:47:01.765752, 10, pid=29690, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/GID2SID/4] and timeout=[Sun Feb 28 20:49:01 2016 IST] (120 seconds ahead) [2016/02/28 20:47:01.765780, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap_util.c:147(idmap_gid_to_sid) gid [4] not mapped [2016/02/28 20:47:01.765789, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid out: struct wbint_Gid2Sid sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.765815, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.765823, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3508 bytes to parent [2016/02/28 20:47:01.765854, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Gid2Sid: struct wbint_Gid2Sid out: struct wbint_Gid2Sid sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.765883, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_gid_to_sid.c:81(winbindd_gid_to_sid_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.765892, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29700:GID_TO_SID]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:01.765910, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:GID_TO_SID]: delivered response to client [2016/02/28 20:47:01.766309, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29700:PING [2016/02/28 20:47:01.766325, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29700:PING]: NT_STATUS_OK [2016/02/28 20:47:01.766355, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:PING]: delivered response to client [2016/02/28 20:47:01.766467, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29700:ALLOCATE_GID [2016/02/28 20:47:01.766480, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_allocate_gid.c:45(winbindd_allocate_gid_send) allocate_gid [2016/02/28 20:47:01.766490, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_AllocateGid: struct wbint_AllocateGid in: struct wbint_AllocateGid [2016/02/28 20:47:01.766521, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.766533, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.766541, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_ALLOCATEGID (no domain) [2016/02/28 20:47:01.766552, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_AllocateGid: struct wbint_AllocateGid in: struct wbint_AllocateGid [2016/02/28 20:47:01.766572, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:424(idmap_find_domain) idmap_find_domain called for domain 'NULL' [2016/02/28 20:47:01.766580, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_AllocateGid: struct wbint_AllocateGid out: struct wbint_AllocateGid gid : * gid : 0x0000000000000000 (0) result : NT_STATUS_NOT_IMPLEMENTED [2016/02/28 20:47:01.766603, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.766611, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3508 bytes to parent [2016/02/28 20:47:01.766637, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_AllocateGid: struct wbint_AllocateGid out: struct wbint_AllocateGid gid : * gid : 0x0000000000000000 (0) result : NT_STATUS_NOT_IMPLEMENTED [2016/02/28 20:47:01.766664, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_allocate_gid.c:83(winbindd_allocate_gid_recv) Could not allocate gid: NT_STATUS_NOT_IMPLEMENTED [2016/02/28 20:47:01.766673, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29700:ALLOCATE_GID]: NT_STATUS_NOT_IMPLEMENTED [2016/02/28 20:47:01.766689, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:ALLOCATE_GID]: delivered response to client [2016/02/28 20:47:01.766988, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29700:SIDS_TO_XIDS [2016/02/28 20:47:01.767002, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_sids_to_xids.c:50(winbindd_sids_to_xids_send) sids_to_xids [2016/02/28 20:47:01.767013, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_sids_to_xids.c:68(winbindd_sids_to_xids_send) num_sids: 5 [2016/02/28 20:47:01.767022, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 0: S-1-5-21-1247966704-913105281-4028998813-501 [2016/02/28 20:47:01.767045, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 1: S-1-5-21-1247966704-913105281-4028998813-514 [2016/02/28 20:47:01.767058, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 2: S-1-1-0 [2016/02/28 20:47:01.767068, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 3: S-1-5-2 [2016/02/28 20:47:01.767079, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 4: S-1-5-32-546 [2016/02/28 20:47:01.767093, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_lookupsids.c:262(wb_lookupsids_bulk) S-1-5-21-1247966704-913105281-4028998813-501 is in our domain [2016/02/28 20:47:01.767104, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-5-21-1247966704-913105281-4028998813-501) [2016/02/28 20:47:01.767118, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1017(find_lookup_domain_from_sid) calling find_domain_from_sid [2016/02/28 20:47:01.767137, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2620(set_dc_type_and_flags) set_dc_type_and_flags: setting up flags for primary or internal domain [2016/02/28 20:47:01.767145, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2357(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: domain URI-VGW-4 [2016/02/28 20:47:01.767249, 4, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:01.767266, 10, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe dssetup [2016/02/28 20:47:01.767277, 10, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe dssetup [2016/02/28 20:47:01.767316, 4, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:01.767361, 10, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection dssetup [2016/02/28 20:47:01.767376, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2393(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo on domain URI-VGW-4 failed: (NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) [2016/02/28 20:47:01.767410, 4, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:01.767421, 10, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:01.767429, 10, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:01.767454, 4, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:01.767481, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : NULL attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:01.767594, 10, pid=29680, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:01.767610, 4, pid=29680, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:01.767622, 4, pid=29680, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:01.767631, 6, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] F0 73 00 00 .s.. [2016/02/28 20:47:01.767656, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000001-0000-0000-d356-a540f0730000 result : NT_STATUS_OK [2016/02/28 20:47:01.767707, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2 in: struct lsa_QueryInfoPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000001-0000-0000-d356-a540f0730000 level : LSA_POLICY_INFO_DNS (12) [2016/02/28 20:47:01.767744, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend smbpasswd [2016/02/28 20:47:01.767759, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'smbpasswd' [2016/02/28 20:47:01.767768, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend tdbsam [2016/02/28 20:47:01.767775, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'tdbsam' [2016/02/28 20:47:01.767783, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend wbc_sam [2016/02/28 20:47:01.767791, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'wbc_sam' [2016/02/28 20:47:01.767799, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend ldapsam [2016/02/28 20:47:01.767807, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'ldapsam' [2016/02/28 20:47:01.767814, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend NDS_ldapsam [2016/02/28 20:47:01.767822, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'NDS_ldapsam' [2016/02/28 20:47:01.767837, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:78(smb_register_passdb) Attempting to register passdb backend IPA_ldapsam [2016/02/28 20:47:01.767845, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:91(smb_register_passdb) Successfully added passdb backend 'IPA_ldapsam' [2016/02/28 20:47:01.767852, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:154(make_pdb_method_name) Attempting to find a passdb backend to match smbpasswd (smbpasswd) [2016/02/28 20:47:01.767860, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:175(make_pdb_method_name) Found pdb backend smbpasswd [2016/02/28 20:47:01.767869, 5, pid=29680, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:186(make_pdb_method_name) pdb backend smbpasswd has a valid init [2016/02/28 20:47:01.767894, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:01.767989, 10, pid=29680, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:01.768000, 4, pid=29680, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:01.768009, 4, pid=29680, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:01.768018, 6, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] F0 73 00 00 .s.. [2016/02/28 20:47:01.768044, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-d356-a540f0730000 result : NT_STATUS_OK [2016/02/28 20:47:01.768094, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_QueryInfoPolicy: struct lsa_QueryInfoPolicy in: struct lsa_QueryInfoPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-d356-a540f0730000 level : LSA_POLICY_INFO_ACCOUNT_DOMAIN (5) [2016/02/28 20:47:01.768123, 6, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] F0 73 00 00 .s.. [2016/02/28 20:47:01.768148, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_QueryInfoPolicy: struct lsa_QueryInfoPolicy out: struct lsa_QueryInfoPolicy info : * info : * info : union lsa_PolicyInformation(case 5) account_domain: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'URI-VGW-4' sid : * sid : S-1-5-21-1247966704-913105281-4028998813 result : NT_STATUS_OK [2016/02/28 20:47:01.768220, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2596(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: domain URI-VGW-4 is NOT in native mode. [2016/02/28 20:47:01.768230, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2599(set_dc_type_and_flags_connect) set_dc_type_and_flags_connect: domain URI-VGW-4 is NOT running active directory. [2016/02/28 20:47:01.768239, 10, pid=29680, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:01.768252, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_lookupsids.c:262(wb_lookupsids_bulk) S-1-5-21-1247966704-913105281-4028998813-514 is in our domain [2016/02/28 20:47:01.768262, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_lookupsids.c:254(wb_lookupsids_bulk) No bulk setup for SID S-1-1-0 with 1 subauths [2016/02/28 20:47:01.768270, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_lookupsids.c:254(wb_lookupsids_bulk) No bulk setup for SID S-1-5-2 with 1 subauths [2016/02/28 20:47:01.768277, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_lookupsids.c:254(wb_lookupsids_bulk) No bulk setup for SID S-1-5-32-546 with 2 subauths [2016/02/28 20:47:01.768289, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupRids: struct wbint_LookupRids in: struct wbint_LookupRids domain_sid : * domain_sid : S-1-5-21-1247966704-913105281-4028998813 rids : * rids: struct wbint_RidArray num_rids : 0x00000002 (2) rids: ARRAY(2) rids : 0x000001f5 (501) rids : 0x00000202 (514) [2016/02/28 20:47:01.768372, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 40 extra bytes [2016/02/28 20:47:01.768387, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.768394, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.768401, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPRIDS (URI-VGW-4) [2016/02/28 20:47:01.768417, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupRids: struct wbint_LookupRids in: struct wbint_LookupRids domain_sid : * domain_sid : S-1-5-21-1247966704-913105281-4028998813 rids : * rids: struct wbint_RidArray num_rids : 0x00000002 (2) rids: ARRAY(2) rids : 0x000001f5 (501) rids : 0x00000202 (514) [2016/02/28 20:47:01.768463, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:688(sam_rids_to_names) sam_rids_to_names for URI-VGW-4 [2016/02/28 20:47:01.768496, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:01.768508, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:01.768517, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:01.768542, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:01.768560, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:01.768773, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:01.768789, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:01.768799, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:01.768808, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 08 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.768834, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000008-0000-0000-d356-a54008740000 result : NT_STATUS_OK [2016/02/28 20:47:01.768875, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:410(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 1 of 2. [2016/02/28 20:47:01.768905, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids in: struct lsa_LookupSids handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000008-0000-0000-d356-a54008740000 sids : * sids: struct lsa_SidArray num_sids : 0x00000002 (2) sids : * sids: ARRAY(2) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-1247966704-913105281-4028998813-501 sids: struct lsa_SidPtr sid : * sid : S-1-5-21-1247966704-913105281-4028998813-514 names : * names: struct lsa_TransNameArray count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:01.768987, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 08 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.769019, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:778(check_dom_sid_to_level) Accepting SID S-1-5-21-1247966704-913105281-4028998813 in level 1 [2016/02/28 20:47:01.769029, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:778(check_dom_sid_to_level) Accepting SID S-1-5-21-1247966704-913105281-4028998813 in level 1 [2016/02/28 20:47:01.769046, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:539(lookup_rids) lookup_rids called for domain sid 'S-1-5-21-1247966704-913105281-4028998813' [2016/02/28 20:47:01.769057, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1748(lookup_global_sam_rid) lookup_global_sam_rid: looking up RID 501. [2016/02/28 20:47:01.769066, 6, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:414(pdb_getsampwsid) pdb_getsampwsid: Building guest account [2016/02/28 20:47:01.769075, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:181(Get_Pwnam_alloc) Finding user nobody [2016/02/28 20:47:01.769083, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:120(Get_Pwnam_internals) Trying _Get_Pwnam(), username as lowercase is nobody [2016/02/28 20:47:01.770622, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:159(Get_Pwnam_internals) Get_Pwnam_internals did find user [nobody]! [2016/02/28 20:47:01.770647, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:570(pdb_set_username) pdb_set_username: setting username nobody, was [2016/02/28 20:47:01.770660, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:639(pdb_set_fullname) pdb_set_full_name: setting full name Linux User, was [2016/02/28 20:47:01.770670, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:593(pdb_set_domain) pdb_set_domain: setting domain URI-VGW-4, was [2016/02/28 20:47:01.770682, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:495(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-1247966704-913105281-4028998813-501 [2016/02/28 20:47:01.770692, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_compat.c:73(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-1247966704-913105281-4028998813-501 from rid 501 [2016/02/28 20:47:01.770707, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1883(pdb_default_lookup_rids) lookup_rids: nobody:1 [2016/02/28 20:47:01.770714, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1748(lookup_global_sam_rid) lookup_global_sam_rid: looking up RID 514. [2016/02/28 20:47:01.770725, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:1339(smbpasswd_getsampwsid) smbpasswd_getsampwrid: search by sid: S-1-5-21-1247966704-913105281-4028998813-514 [2016/02/28 20:47:01.770734, 10, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:238(startsmbfilepwent) startsmbfilepwent_internal: opening file /flash/samba/smbpasswd [2016/02/28 20:47:01.770755, 5, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:587(getsmbfilepwent) getsmbfilepwent: end of file reached. [2016/02/28 20:47:01.770769, 7, pid=29704, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:355(endsmbfilepwent) endsmbfilepwent_internal: closed password file. [2016/02/28 20:47:01.770791, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:896(_lsa_lookup_sids_internal) num_sids 2, mapped_count 1, status STATUS_SOME_UNMAPPED [2016/02/28 20:47:01.770803, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids out: struct lsa_LookupSids domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'URI-VGW-4' sid : * sid : S-1-5-21-1247966704-913105281-4028998813 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray count : 0x00000002 (2) names : * names: ARRAY(2) names: struct lsa_TranslatedName sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x000c (12) size : 0x000c (12) string : * string : 'nobody' sid_index : 0x00000000 (0) names: struct lsa_TranslatedName sid_type : SID_NAME_UNKNOWN (8) name: struct lsa_String length : 0x0058 (88) size : 0x0058 (88) string : * string : 'S-1-5-21-1247966704-913105281-4028998813-514' sid_index : 0xffffffff (4294967295) count : * count : 0x00000001 (1) result : STATUS_SOME_UNMAPPED [2016/02/28 20:47:01.770982, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:253(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'STATUS_SOME_UNMAPPED', mapped count = 1' [2016/02/28 20:47:01.771005, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000008-0000-0000-d356-a54008740000 [2016/02/28 20:47:01.771032, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 08 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.771058, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 08 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:01.771081, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:01.771088, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:01.771130, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:01.771146, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:01.771154, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:01.771180, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-5-21-1247966704-913105281-4028998813-501 -> URI-VGW-4\nobody (NT_STATUS_OK) [2016/02/28 20:47:01.771200, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-5-21-1247966704-913105281-4028998813-514 -> URI-VGW-4\(null) (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:01.771213, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupRids: struct wbint_LookupRids out: struct wbint_LookupRids domain_name : * domain_name : * domain_name : 'URI-VGW-4' names : * names: struct wbint_Principals num_principals : 2 principals: ARRAY(2) principals: struct wbint_Principal sid : S-1-5-21-1247966704-913105281-4028998813-501 type : SID_NAME_USER (1) name : * name : 'nobody' principals: struct wbint_Principal sid : S-1-5-21-1247966704-913105281-4028998813-514 type : SID_NAME_UNKNOWN (8) name : NULL result : NT_STATUS_OK [2016/02/28 20:47:01.771287, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.771296, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3628 bytes to parent [2016/02/28 20:47:01.771350, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupRids: struct wbint_LookupRids out: struct wbint_LookupRids domain_name : * domain_name : * domain_name : 'URI-VGW-4' names : * names: struct wbint_Principals num_principals : 2 principals: ARRAY(2) principals: struct wbint_Principal sid : S-1-5-21-1247966704-913105281-4028998813-501 type : SID_NAME_USER (1) name : * name : 'nobody' principals: struct wbint_Principal sid : S-1-5-21-1247966704-913105281-4028998813-514 type : SID_NAME_UNKNOWN (8) name : NULL result : NT_STATUS_OK [2016/02/28 20:47:01.771437, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-1-0) [2016/02/28 20:47:01.771448, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1024(find_lookup_domain_from_sid) calling find_our_domain [2016/02/28 20:47:01.771459, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-1-0 [2016/02/28 20:47:01.771513, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 12 extra bytes [2016/02/28 20:47:01.771530, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.771538, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.771546, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSID (CHILD2) [2016/02/28 20:47:01.771562, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-1-0 [2016/02/28 20:47:01.771586, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:01.771594, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:01.771605, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1988(sid_to_name) sid_to_name: [Cached] - doing backend query for name for domain CHILD2 [2016/02/28 20:47:01.771614, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:303(msrpc_sid_to_name) msrpc_sid_to_name: S-1-1-0 for domain CHILD2 [2016/02/28 20:47:01.771623, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:01.771637, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:410(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2016/02/28 20:47:01.771655, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-1-0 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:01.771740, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000014 (20) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000038 (56) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:01.771831, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:01.771879, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:01.771889, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 152 [2016/02/28 20:47:01.775358, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 200 [2016/02/28 20:47:01.775393, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00d8 (216) auth_length : 0x0038 (56) call_id : 0x00000014 (20) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000007c (124) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=192 [0000] 58 62 E1 B7 2F A1 DF 59 EF 8A BF A1 D3 50 36 B1 Xb../..Y .....P6. [0010] 74 43 43 30 94 F9 3B D6 3B E0 3B F9 77 57 41 F3 tCC0..;. ;.;.wWA. [0020] A5 D7 D2 1A F8 32 81 C1 C5 E1 0B 65 CB 6F C7 7A .....2.. ...e.o.z [0030] AC F7 A7 C6 56 42 04 04 B8 F9 FB EB D9 0A 66 DF ....VB.. ......f. [0040] E4 1B 31 B8 08 A1 0D 39 85 7B C2 41 A7 42 71 63 ..1....9 .{.A.Bqc [0050] 00 25 15 69 E9 31 32 AA AD 6E C0 8D 45 7B C3 86 .%.i.12. .n..E{.. [0060] B4 86 E3 E3 1D D5 95 3A EF 06 74 44 AB E2 7C 21 .......: ..tD..|! [0070] 7A 44 DF DA 84 31 19 6C CA 11 CD B3 37 BD D3 E6 zD...1.l ....7... [0080] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0090] 54 F0 88 6B CC 59 48 AB 49 E7 F8 B9 3A 2C C5 3B T..k.YH. I...:,.; [00A0] 3B 5F D7 BD A6 7D C3 33 FB D4 C2 EE 2A 1B C1 06 ;_...}.3 ....*... [00B0] 44 06 0C 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [2016/02/28 20:47:01.775700, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:01.775711, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 4 [2016/02/28 20:47:01.775718, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:01.775752, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 216, data_len 124, ss_len 4 [2016/02/28 20:47:01.775760, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 216 at offset 0: NT_STATUS_OK [2016/02/28 20:47:01.775768, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 124 bytes. [2016/02/28 20:47:01.775789, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0000 (0) size : 0x0002 (2) string : * string : '' sid : * sid : S-1-1 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_WKN_GRP (5) name: struct lsa_String length : 0x0010 (16) size : 0x0012 (18) string : * string : 'Everyone' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:01.775916, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:253(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2016/02/28 20:47:01.775927, 5, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:323(msrpc_sid_to_name) Mapped sid to []\[Everyone] [2016/02/28 20:47:01.775937, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:01.775944, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:01.775963, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-1-0 -> \Everyone (NT_STATUS_OK) [2016/02/28 20:47:01.775972, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_WKN_GRP (5) domain : * domain : * domain : '' name : * name : * name : 'Everyone' result : NT_STATUS_OK [2016/02/28 20:47:01.776014, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.776022, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3552 bytes to parent [2016/02/28 20:47:01.776072, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_WKN_GRP (5) domain : * domain : * domain : '' name : * name : * name : 'Everyone' result : NT_STATUS_OK [2016/02/28 20:47:01.776119, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-5-2) [2016/02/28 20:47:01.776129, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1024(find_lookup_domain_from_sid) calling find_our_domain [2016/02/28 20:47:01.776139, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-2 [2016/02/28 20:47:01.776179, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 12 extra bytes [2016/02/28 20:47:01.776200, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.776208, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.776215, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSID (CHILD2) [2016/02/28 20:47:01.776226, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-2 [2016/02/28 20:47:01.776246, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:01.776253, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:01.776266, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1988(sid_to_name) sid_to_name: [Cached] - doing backend query for name for domain CHILD2 [2016/02/28 20:47:01.776274, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:303(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-2 for domain CHILD2 [2016/02/28 20:47:01.776282, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:01.776292, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:410(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2016/02/28 20:47:01.776306, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-2 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:01.776397, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000015 (21) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000038 (56) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:01.776494, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:01.776539, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:01.776549, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 152 [2016/02/28 20:47:01.777107, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 232 [2016/02/28 20:47:01.777137, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00f8 (248) auth_length : 0x0038 (56) call_id : 0x00000015 (21) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000094 (148) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=224 [0000] 9E 62 BB 33 6D 8F 05 AF 63 75 33 42 B0 0E 15 18 .b.3m... cu3B.... [0010] 9C E4 B6 BB 37 57 60 03 71 08 50 A2 25 E0 39 08 ....7W`. q.P.%.9. [0020] 1B FE B9 02 B6 5D 13 E4 43 06 C9 AA 11 49 B3 7E .....].. C....I.~ [0030] 26 DE 0D D4 AB 84 36 0A AB 42 4D 9B 52 E1 81 C4 &.....6. .BM.R... [0040] CB 37 78 9B 9C C3 A5 E1 A2 29 EC 98 98 93 A0 9F .7x..... .)...... [0050] EC 05 7E 91 34 6C 0C 67 9E 7A EC D9 91 29 36 F1 ..~.4l.g .z...)6. [0060] 1B 46 AA 84 29 9C C3 C8 8E A4 91 B2 DB 7B A8 2C .F..)... .....{., [0070] 50 E1 1B 7D 9E EE 39 9B 49 43 81 ED 90 29 78 C7 P..}..9. IC...)x. [0080] 76 36 E5 02 3D 2E 45 8C BA B8 22 2E A8 AB 66 DE v6..=.E. .."...f. [0090] FF 8F A0 99 B5 2E DB DB 6D 15 BA 9E 64 5B D7 1B ........ m...d[.. [00A0] 44 06 0C 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00B0] 79 62 3D 71 3F C0 31 63 16 11 93 25 F8 2E 5D BE yb=q?.1c ...%..]. [00C0] 13 5F EA 7C 34 3F BC 18 D2 18 8F 18 E0 C5 61 20 ._.|4?.. ......a [00D0] DF 22 09 2C A5 2B D5 54 00 00 00 00 00 00 00 00 .".,.+.T ........ [2016/02/28 20:47:01.777481, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:01.777492, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 12 [2016/02/28 20:47:01.777500, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:01.777537, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 248, data_len 148, ss_len 12 [2016/02/28 20:47:01.777545, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 248 at offset 0: NT_STATUS_OK [2016/02/28 20:47:01.777553, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 148 bytes. [2016/02/28 20:47:01.777573, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'NT AUTHORITY' sid : * sid : S-1-5 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_WKN_GRP (5) name: struct lsa_String length : 0x000e (14) size : 0x0010 (16) string : * string : 'NETWORK' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:01.777692, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:253(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2016/02/28 20:47:01.777702, 5, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:323(msrpc_sid_to_name) Mapped sid to [NT AUTHORITY]\[NETWORK] [2016/02/28 20:47:01.777719, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:01.777728, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:01.777750, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-5-2 -> NT AUTHORITY\NETWORK (NT_STATUS_OK) [2016/02/28 20:47:01.777761, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_WKN_GRP (5) domain : * domain : * domain : 'NT AUTHORITY' name : * name : * name : 'NETWORK' result : NT_STATUS_OK [2016/02/28 20:47:01.777802, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.777810, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3560 bytes to parent [2016/02/28 20:47:01.777860, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_WKN_GRP (5) domain : * domain : * domain : 'NT AUTHORITY' name : * name : * name : 'NETWORK' result : NT_STATUS_OK [2016/02/28 20:47:01.777917, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-5-32-546) [2016/02/28 20:47:01.777938, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1017(find_lookup_domain_from_sid) calling find_domain_from_sid [2016/02/28 20:47:01.777953, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-32-546 [2016/02/28 20:47:01.777990, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1420(fork_domain_child) fork_domain_child called for domain 'BUILTIN' [2016/02/28 20:47:01.781379, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1476(fork_domain_child) Child process 29706 [2016/02/28 20:47:01.781683, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 33 - private_data=(nil) [2016/02/28 20:47:01.781702, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 13 - private_data=(nil) [2016/02/28 20:47:01.781710, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:01.781723, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:01.781738, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1029 - private_data=(nil) [2016/02/28 20:47:01.781745, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:01.781752, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1033 - private_data=(nil) [2016/02/28 20:47:01.781758, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:01.781769, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1036 - private_data=(nil) [2016/02/28 20:47:01.781777, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1035 - private_data=(nil) [2016/02/28 20:47:01.781841, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:01.781855, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:01.781862, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:01.781869, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:01.781876, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:47:01.781882, 5, pid=29706, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:461(messaging_register) Overriding messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:47:01.781900, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 16 extra bytes [2016/02/28 20:47:01.781916, 4, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.781924, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.781934, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSID (BUILTIN) [2016/02/28 20:47:01.781960, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-32-546 [2016/02/28 20:47:01.782010, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1988(sid_to_name) sid_to_name: [Cached] - doing backend query for name for domain BUILTIN [2016/02/28 20:47:01.782021, 3, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:609(sam_sid_to_name) sam_sid_to_name [2016/02/28 20:47:01.782116, 4, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:01.782139, 10, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:01.782158, 10, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:01.782204, 4, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:01.782247, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:01.782368, 10, pid=29706, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:01.782388, 4, pid=29706, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:01.782401, 4, pid=29706, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:01.782411, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 0A 74 00 00 .t.. [2016/02/28 20:47:01.782438, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000003-0000-0000-d356-a5400a740000 result : NT_STATUS_OK [2016/02/28 20:47:01.782486, 10, pid=29706, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:410(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2016/02/28 20:47:01.782513, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids in: struct lsa_LookupSids handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000003-0000-0000-d356-a5400a740000 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-32-546 names : * names: struct lsa_TransNameArray count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:01.782599, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 0A 74 00 00 .t.. [2016/02/28 20:47:01.782634, 10, pid=29706, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:778(check_dom_sid_to_level) Accepting SID S-1-5-32 in level 1 [2016/02/28 20:47:01.782644, 10, pid=29706, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:539(lookup_rids) lookup_rids called for domain sid 'S-1-5-32' [2016/02/28 20:47:01.782657, 10, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:896(_lsa_lookup_sids_internal) num_sids 1, mapped_count 1, status NT_STATUS_OK [2016/02/28 20:47:01.782665, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids out: struct lsa_LookupSids domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000e (14) size : 0x0010 (16) string : * string : 'BUILTIN' sid : * sid : S-1-5-32 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName sid_type : SID_NAME_ALIAS (4) name: struct lsa_String length : 0x000c (12) size : 0x000c (12) string : * string : 'Guests' sid_index : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:01.782806, 10, pid=29706, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:253(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2016/02/28 20:47:01.782830, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000003-0000-0000-d356-a5400a740000 [2016/02/28 20:47:01.782856, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 0A 74 00 00 .t.. [2016/02/28 20:47:01.782881, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 0A 74 00 00 .t.. [2016/02/28 20:47:01.782904, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:01.782911, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:01.782944, 10, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:01.782973, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4772(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Searching for domain BUILTIN [2016/02/28 20:47:01.783000, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4787(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Found domain BUILTIN [2016/02/28 20:47:01.783012, 3, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:991(sam_sequence_number) samr: sequence number [2016/02/28 20:47:01.783043, 4, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested samr [2016/02/28 20:47:01.783055, 10, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe samr [2016/02/28 20:47:01.783063, 10, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe samr [2016/02/28 20:47:01.783089, 4, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe samr [2016/02/28 20:47:01.783113, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_Connect2: struct samr_Connect2 in: struct samr_Connect2 system_name : NULL access_mask : 0x02000000 (33554432) 0: SAMR_ACCESS_CONNECT_TO_SERVER 0: SAMR_ACCESS_SHUTDOWN_SERVER 0: SAMR_ACCESS_INITIALIZE_SERVER 0: SAMR_ACCESS_CREATE_DOMAIN 0: SAMR_ACCESS_ENUM_DOMAINS 0: SAMR_ACCESS_LOOKUP_DOMAIN [2016/02/28 20:47:01.783158, 5, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:3866(_samr_Connect2) _samr_Connect2: 3866 [2016/02/28 20:47:01.783172, 10, pid=29706, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f003f [2016/02/28 20:47:01.783180, 4, pid=29706, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _samr_Connect2: ACCESS should be DENIED (requested: 0x000f003f) but overritten by euid == initial uid [2016/02/28 20:47:01.783190, 4, pid=29706, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _samr_Connect2: access GRANTED (requested: 0x000f003f, granted: 0x000f003f) [2016/02/28 20:47:01.783198, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 04 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 0A 74 00 00 .t.. [2016/02/28 20:47:01.783223, 5, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:3895(_samr_Connect2) _samr_Connect2: 3895 [2016/02/28 20:47:01.783230, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_Connect2: struct samr_Connect2 out: struct samr_Connect2 connect_handle : * connect_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000004-0000-0000-d356-a5400a740000 result : NT_STATUS_OK [2016/02/28 20:47:01.783277, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_OpenDomain: struct samr_OpenDomain in: struct samr_OpenDomain connect_handle : * connect_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000004-0000-0000-d356-a5400a740000 access_mask : 0x02000000 (33554432) 0: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 0: SAMR_DOMAIN_ACCESS_SET_INFO_1 0: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 0: SAMR_DOMAIN_ACCESS_SET_INFO_2 0: SAMR_DOMAIN_ACCESS_CREATE_USER 0: SAMR_DOMAIN_ACCESS_CREATE_GROUP 0: SAMR_DOMAIN_ACCESS_CREATE_ALIAS 0: SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS 0: SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS 0: SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT 0: SAMR_DOMAIN_ACCESS_SET_INFO_3 sid : * sid : S-1-5-32 [2016/02/28 20:47:01.783356, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 04 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 0A 74 00 00 .t.. [2016/02/28 20:47:01.783381, 10, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:522(_policy_handle_find) found handle of type struct samr_connect_info [2016/02/28 20:47:01.783390, 10, pid=29706, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f07ff [2016/02/28 20:47:01.783399, 4, pid=29706, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:84(access_check_object) access_check_object: user rights access mask [0x3f0] [2016/02/28 20:47:01.783413, 4, pid=29706, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _samr_OpenDomain: ACCESS should be DENIED (requested: 0x000f040f) but overritten by euid == initial uid [2016/02/28 20:47:01.783424, 4, pid=29706, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _samr_OpenDomain: access GRANTED (requested: 0x000f040f, granted: 0x000f07ff) [2016/02/28 20:47:01.783432, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 0A 74 00 00 .t.. [2016/02/28 20:47:01.783456, 5, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:500(_samr_OpenDomain) _samr_OpenDomain: 500 [2016/02/28 20:47:01.783465, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_OpenDomain: struct samr_OpenDomain out: struct samr_OpenDomain domain_handle : * domain_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-d356-a5400a740000 result : NT_STATUS_OK [2016/02/28 20:47:01.783509, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_QueryDomainInfo: struct samr_QueryDomainInfo in: struct samr_QueryDomainInfo domain_handle : * domain_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-d356-a5400a740000 level : DomainModifiedInformation (8) [2016/02/28 20:47:01.783541, 5, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:3499(_samr_QueryDomainInfo) _samr_QueryDomainInfo: 3499 [2016/02/28 20:47:01.783548, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 0A 74 00 00 .t.. [2016/02/28 20:47:01.783571, 10, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:522(_policy_handle_find) found handle of type struct samr_domain_info [2016/02/28 20:47:01.783583, 5, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/samr/srv_samr_nt.c:3589(_samr_QueryDomainInfo) _samr_QueryDomainInfo: 3589 [2016/02/28 20:47:01.783591, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_QueryDomainInfo: struct samr_QueryDomainInfo out: struct samr_QueryDomainInfo info : * info : * info : union samr_DomainInfo(case 8) info8: struct samr_DomInfo8 sequence_num : 0x0000000056d340a5 (1456685221) domain_create_time : NTTIME(0) result : NT_STATUS_OK [2016/02/28 20:47:01.783633, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:963(rpc_sequence_number) domain_sequence_number: for domain BUILTIN is 1456685221 [2016/02/28 20:47:01.783653, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_Close: struct samr_Close in: struct samr_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-d356-a5400a740000 [2016/02/28 20:47:01.783686, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 D3 56 A5 40 ........ .....V.@ [0010] 0A 74 00 00 .t.. [2016/02/28 20:47:01.783710, 6, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:01.783717, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) samr_Close: struct samr_Close out: struct samr_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:01.783749, 10, pid=29706, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection samr [2016/02/28 20:47:01.783776, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:500(wcache_store_seqnum) wcache_store_seqnum: success [BUILTIN][1456685221 @ 1456685221] [2016/02/28 20:47:01.783789, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: BUILTIN seq number is now 1456685221 [2016/02/28 20:47:01.783810, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-5-32-546 -> BUILTIN\Guests (NT_STATUS_OK) [2016/02/28 20:47:01.783821, 1, pid=29706, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_ALIAS (4) domain : * domain : * domain : 'BUILTIN' name : * name : * name : 'Guests' result : NT_STATUS_OK [2016/02/28 20:47:01.783862, 4, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.783870, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3552 bytes to parent [2016/02/28 20:47:01.783918, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_ALIAS (4) domain : * domain : * domain : 'BUILTIN' name : * name : * name : 'Guests' result : NT_STATUS_OK [2016/02/28 20:47:01.783989, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs in: struct wbint_Sids2UnixIDs domains : * domains: struct lsa_RefDomainList count : 0x00000004 (4) domains : * domains: ARRAY(4) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'URI-VGW-4' sid : * sid : S-1-5-21-1247966704-913105281-4028998813 domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0000 (0) size : 0x0002 (2) string : * string : '' sid : * sid : S-1-1 domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'NT AUTHORITY' sid : * sid : S-1-5 domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000e (14) size : 0x0010 (16) string : * string : 'BUILTIN' sid : * sid : S-1-5-32 max_size : 0x00000020 (32) ids : * ids: struct wbint_TransIDArray num_ids : 0x00000005 (5) ids: ARRAY(5) ids: struct wbint_TransID type : ID_TYPE_UID (1) domain_index : 0x00000000 (0) rid : 0x000001f5 (501) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_UID (1) ids: struct wbint_TransID type : ID_TYPE_NOT_SPECIFIED (0) domain_index : 0x00000000 (0) rid : 0x00000202 (514) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000001 (1) rid : 0x00000000 (0) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000002 (2) rid : 0x00000002 (2) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000003 (3) rid : 0x00000222 (546) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) [2016/02/28 20:47:01.784309, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 346 extra bytes [2016/02/28 20:47:01.784325, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:01.784333, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:01.784352, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_SIDS2UNIXIDS (no domain) [2016/02/28 20:47:01.784394, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs in: struct wbint_Sids2UnixIDs domains : * domains: struct lsa_RefDomainList count : 0x00000004 (4) domains : * domains: ARRAY(4) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'URI-VGW-4' sid : * sid : S-1-5-21-1247966704-913105281-4028998813 domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0000 (0) size : 0x0002 (2) string : * string : '' sid : * sid : S-1-1 domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'NT AUTHORITY' sid : * sid : S-1-5 domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000e (14) size : 0x0010 (16) string : * string : 'BUILTIN' sid : * sid : S-1-5-32 max_size : 0x00000020 (32) ids : * ids: struct wbint_TransIDArray num_ids : 0x00000005 (5) ids: ARRAY(5) ids: struct wbint_TransID type : ID_TYPE_UID (1) domain_index : 0x00000000 (0) rid : 0x000001f5 (501) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_UID (1) ids: struct wbint_TransID type : ID_TYPE_NOT_SPECIFIED (0) domain_index : 0x00000000 (0) rid : 0x00000202 (514) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000001 (1) rid : 0x00000000 (0) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000002 (2) rid : 0x00000002 (2) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000003 (3) rid : 0x00000222 (546) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) [2016/02/28 20:47:01.784681, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1748(lookup_global_sam_rid) lookup_global_sam_rid: looking up RID 501. [2016/02/28 20:47:01.784694, 6, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:414(pdb_getsampwsid) pdb_getsampwsid: Building guest account [2016/02/28 20:47:01.784703, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/username.c:181(Get_Pwnam_alloc) Finding user nobody [2016/02/28 20:47:01.784712, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/username.c:120(Get_Pwnam_internals) Trying _Get_Pwnam(), username as lowercase is nobody [2016/02/28 20:47:01.785049, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/username.c:159(Get_Pwnam_internals) Get_Pwnam_internals did find user [nobody]! [2016/02/28 20:47:01.785067, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:570(pdb_set_username) pdb_set_username: setting username nobody, was [2016/02/28 20:47:01.785078, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:639(pdb_set_fullname) pdb_set_full_name: setting full name Linux User, was [2016/02/28 20:47:01.785095, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:593(pdb_set_domain) pdb_set_domain: setting domain URI-VGW-4, was [2016/02/28 20:47:01.785106, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_get_set.c:495(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-1247966704-913105281-4028998813-501 [2016/02/28 20:47:01.785117, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_compat.c:73(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-1247966704-913105281-4028998813-501 from rid 501 [2016/02/28 20:47:01.785131, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/username.c:181(Get_Pwnam_alloc) Finding user nobody [2016/02/28 20:47:01.785139, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/username.c:120(Get_Pwnam_internals) Trying _Get_Pwnam(), username as lowercase is nobody [2016/02/28 20:47:01.785161, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/username.c:159(Get_Pwnam_internals) Get_Pwnam_internals did find user [nobody]! [2016/02/28 20:47:01.785182, 10, pid=29690, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-1247966704-913105281-4028998813-501] and timeout=[Sun Mar 6 20:47:01 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:01.785211, 10, pid=29690, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/UID2SID/4] and timeout=[Sun Mar 6 20:47:01 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:01.785231, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1748(lookup_global_sam_rid) lookup_global_sam_rid: looking up RID 514. [2016/02/28 20:47:01.785242, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:1339(smbpasswd_getsampwsid) smbpasswd_getsampwrid: search by sid: S-1-5-21-1247966704-913105281-4028998813-514 [2016/02/28 20:47:01.785252, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:238(startsmbfilepwent) startsmbfilepwent_internal: opening file /flash/samba/smbpasswd [2016/02/28 20:47:01.785273, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:587(getsmbfilepwent) getsmbfilepwent: end of file reached. [2016/02/28 20:47:01.785286, 7, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_smbpasswd.c:355(endsmbfilepwent) endsmbfilepwent_internal: closed password file. [2016/02/28 20:47:01.785302, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1824(lookup_global_sam_rid) Can't find a unix id for an unmapped group [2016/02/28 20:47:01.785309, 5, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1534(pdb_default_sid_to_id) SID S-1-5-21-1247966704-913105281-4028998813-514 belongs to our domain, but there is no corresponding object in the database. [2016/02/28 20:47:01.785319, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_srv.c:198(_wbint_Sids2UnixIDs) sids_to_unixids returned NT_STATUS_OK [2016/02/28 20:47:01.785355, 10, pid=29690, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/SID2XID/S-1-1-0] and timeout=[Sun Mar 6 20:47:01 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:01.785381, 10, pid=29690, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/GID2SID/3] and timeout=[Sun Mar 6 20:47:01 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:01.785396, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_srv.c:198(_wbint_Sids2UnixIDs) sids_to_unixids returned NT_STATUS_OK [2016/02/28 20:47:01.785418, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1562(pdb_default_sid_to_id) Could not find map for sid S-1-5-2 [2016/02/28 20:47:01.785427, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_srv.c:198(_wbint_Sids2UnixIDs) sids_to_unixids returned NT_STATUS_OK [2016/02/28 20:47:01.785437, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1562(pdb_default_sid_to_id) Could not find map for sid S-1-5-32-546 [2016/02/28 20:47:01.785445, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_srv.c:198(_wbint_Sids2UnixIDs) sids_to_unixids returned NT_STATUS_OK [2016/02/28 20:47:01.785453, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs out: struct wbint_Sids2UnixIDs ids : * ids: struct wbint_TransIDArray num_ids : 0x00000005 (5) ids: ARRAY(5) ids: struct wbint_TransID type : ID_TYPE_UID (1) domain_index : 0x00000000 (0) rid : 0x000001f5 (501) xid: struct unixid id : 0x00000004 (4) type : ID_TYPE_UID (1) ids: struct wbint_TransID type : ID_TYPE_NOT_SPECIFIED (0) domain_index : 0x00000000 (0) rid : 0x00000202 (514) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000001 (1) rid : 0x00000000 (0) xid: struct unixid id : 0x00000003 (3) type : ID_TYPE_GID (2) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000002 (2) rid : 0x00000002 (2) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000003 (3) rid : 0x00000222 (546) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) result : NT_STATUS_OK [2016/02/28 20:47:01.785600, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:01.785609, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3608 bytes to parent [2016/02/28 20:47:01.785651, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs out: struct wbint_Sids2UnixIDs ids : * ids: struct wbint_TransIDArray num_ids : 0x00000005 (5) ids: ARRAY(5) ids: struct wbint_TransID type : ID_TYPE_UID (1) domain_index : 0x00000000 (0) rid : 0x000001f5 (501) xid: struct unixid id : 0x00000004 (4) type : ID_TYPE_UID (1) ids: struct wbint_TransID type : ID_TYPE_NOT_SPECIFIED (0) domain_index : 0x00000000 (0) rid : 0x00000202 (514) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000001 (1) rid : 0x00000000 (0) xid: struct unixid id : 0x00000003 (3) type : ID_TYPE_GID (2) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000002 (2) rid : 0x00000002 (2) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000003 (3) rid : 0x00000222 (546) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) result : NT_STATUS_OK [2016/02/28 20:47:01.785805, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for IDMAP/SID2XID/S-1-5-21-1247966704-913105281-4028998813-501, we already got it [2016/02/28 20:47:01.785818, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for IDMAP/UID2SID/4, we already got it [2016/02/28 20:47:01.785831, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-1247966704-913105281-4028998813-514] and timeout=[Sun Feb 28 20:49:01 2016 IST] (120 seconds ahead) [2016/02/28 20:47:01.785863, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for IDMAP/SID2XID/S-1-1-0, we already got it [2016/02/28 20:47:01.785875, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for IDMAP/GID2SID/3, we already got it [2016/02/28 20:47:01.785886, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/SID2XID/S-1-5-2] and timeout=[Sun Feb 28 20:49:01 2016 IST] (120 seconds ahead) [2016/02/28 20:47:01.785915, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/SID2XID/S-1-5-32-546] and timeout=[Sun Feb 28 20:49:01 2016 IST] (120 seconds ahead) [2016/02/28 20:47:01.785939, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29700:SIDS_TO_XIDS]: NT_STATUS_OK [2016/02/28 20:47:01.785963, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29700:SIDS_TO_XIDS]: delivered response to client [2016/02/28 20:47:03.558800, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:304(check_domain_online_handler) check_domain_online_handler: called for domain CHILD2 (online = True) [2016/02/28 20:47:03.559377, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1030 - private_data=(nil) [2016/02/28 20:47:03.559427, 5, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1031 - private_data=(nil) [2016/02/28 20:47:03.559836, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 33 - private_data=(nil) [2016/02/28 20:47:03.559912, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 13 - private_data=(nil) [2016/02/28 20:47:03.559922, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:03.559930, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:03.559937, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1029 - private_data=(nil) [2016/02/28 20:47:03.559944, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:03.559951, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1033 - private_data=(nil) [2016/02/28 20:47:03.559957, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:03.559964, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1036 - private_data=(nil) [2016/02/28 20:47:03.559971, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1035 - private_data=(nil) [2016/02/28 20:47:03.560057, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:03.560077, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:77(ads_dc_name) ads_dc_name: domain=CHILD2 [2016/02/28 20:47:03.560095, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:03.560103, 6, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:408(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'child2.domain.local' [2016/02/28 20:47:03.560125, 8, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child2.domain.local (sitename Default-First-Site-Name) [2016/02/28 20:47:03.560150, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:03.560163, 3, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:03.560175, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#1c (sitename Default-First-Site-Name) [2016/02/28 20:47:03.560191, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name child2.domain.local#1C found. [2016/02/28 20:47:03.560247, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.560259, 8, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:03.560275, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:03.560282, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:03.560293, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:03.560311, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.560331, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.560357, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.560365, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.560374, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:03.560381, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:389 [2016/02/28 20:47:03.560393, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.560401, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:253(ads_try_connect) ads_try_connect: sending CLDAP request to 192.168.82.95 (realm: child2.domain.local) [2016/02/28 20:47:03.561289, 1, pid=29712, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x000031f9 (12793) 1: NBT_SERVER_PDC 0: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 0: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 forest : 'domain.local' dns_domain : 'child2.domain.local' pdc_dns_name : 'Srv.child2.domain.local' domain_name : 'CHILD2' pdc_name : 'SRV' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2016/02/28 20:47:03.561488, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [CHILD2], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:03.561507, 10, pid=29712, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2, we already got it [2016/02/28 20:47:03.561516, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [child2.domain.local], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:03.561527, 10, pid=29712, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:03.561538, 3, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:751(ads_connect) Successfully contacted LDAP server 192.168.82.95 [2016/02/28 20:47:03.561553, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:03.561564, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:211(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2016/02/28 20:47:03.561581, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:874(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /var/vol/3/.ctera/samba/lock/smb_krb5/krb5.conf.CHILD2, realm = child2.domain.local, domain = CHILD2 [2016/02/28 20:47:03.561602, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:03.561622, 3, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:03.561631, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#dcdc (sitename Default-First-Site-Name) [2016/02/28 20:47:03.561644, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2464(resolve_ads) resolve_ads: Attempting to resolve KDCs for child2.domain.local using DNS [2016/02/28 20:47:03.567213, 4, pid=29712, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:435(ads_dns_lookup_srv) ads_dns_lookup_srv: 1 records returned in the answer section. [2016/02/28 20:47:03.567238, 10, pid=29712, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:216(ads_dns_parse_rr_srv) ads_dns_parse_rr_srv: Parsed srv.child2.domain.local [0, 100, 88] [2016/02/28 20:47:03.567250, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.567258, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 1 addresses: 192.168.82.95:88 [2016/02/28 20:47:03.567268, 8, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:03.567288, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:03.567296, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:03.567307, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:03.567332, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.567359, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.567372, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.567379, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.567387, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:03.567394, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:88 [2016/02/28 20:47:03.567404, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:706(get_kdc_ip_string) got 1 addresses from site Default-First-Site-Name search [2016/02/28 20:47:03.567418, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:03.567428, 3, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:03.567437, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#dcdc (sitename (null)) [2016/02/28 20:47:03.567457, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2464(resolve_ads) resolve_ads: Attempting to resolve KDCs for child2.domain.local using DNS [2016/02/28 20:47:03.578102, 4, pid=29712, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:435(ads_dns_lookup_srv) ads_dns_lookup_srv: 1 records returned in the answer section. [2016/02/28 20:47:03.578123, 10, pid=29712, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:216(ads_dns_parse_rr_srv) ads_dns_parse_rr_srv: Parsed srv.child2.domain.local [0, 100, 88] [2016/02/28 20:47:03.578134, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.578141, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 1 addresses: 192.168.82.95:88 [2016/02/28 20:47:03.578150, 8, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:03.578169, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:03.578177, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:03.578188, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:03.578211, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.578225, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.578237, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.578244, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.578252, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:03.578259, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:88 [2016/02/28 20:47:03.578267, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:712(get_kdc_ip_string) got 1 addresses from site-less search [2016/02/28 20:47:03.578275, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:744(get_kdc_ip_string) 0 additional KDCs to test [2016/02/28 20:47:03.578282, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:804(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 192.168.82.95 [2016/02/28 20:47:03.578365, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:966(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /var/vol/3/.ctera/samba/lock/smb_krb5/krb5.conf.CHILD2 with realm CHILD2.DOMAIN.LOCAL KDC list = kdc = 192.168.82.95 [2016/02/28 20:47:03.578390, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:151(ads_dc_name) ads_dc_name: using server='SRV.CHILD2.DOMAIN.LOCAL' IP=192.168.82.95 [2016/02/28 20:47:03.578405, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:03.578421, 8, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child2.domain.local (sitename Default-First-Site-Name) [2016/02/28 20:47:03.578437, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:03.578448, 3, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:03.578457, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#1c (sitename Default-First-Site-Name) [2016/02/28 20:47:03.578468, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name child2.domain.local#1C found. [2016/02/28 20:47:03.578492, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.578500, 8, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:03.578513, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:03.578521, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:03.578531, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:03.578546, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.578558, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.578569, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.578577, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.578584, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:03.578591, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:389 [2016/02/28 20:47:03.578605, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server 192.168.82.95 [2016/02/28 20:47:03.578614, 8, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child2.domain.local (sitename NULL) [2016/02/28 20:47:03.578627, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:03.578637, 3, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:03.578652, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#1c (sitename (null)) [2016/02/28 20:47:03.578664, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name child2.domain.local#1C found. [2016/02/28 20:47:03.578682, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.578689, 8, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:03.578702, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:03.578709, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:03.578719, 5, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:03.578733, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.578745, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.578756, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:03.578763, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:03.578771, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:03.578778, 4, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:389 [2016/02/28 20:47:03.578789, 9, pid=29712, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server 192.168.82.95 [2016/02/28 20:47:03.578804, 10, pid=29712, effective(0, 0), real(0, 0)] ../source3/lib/messages_dgm.c:284(messaging_dgm_send) messaging_dgm_send: Sending message to 29680 [2016/02/28 20:47:03.578832, 10, pid=29680, effective(0, 0), real(0, 0)] ../source4/lib/messaging/messaging.c:423(imessaging_dgm_recv) imessaging_dgm_recv: dst 29680 matches my id: 29680, type=0x406 [2016/02/28 20:47:03.578844, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:254(messaging_recv_cb) messaging_recv_cb: Received message 0x406 len 7 (num_fds:0) from 29712 [2016/02/28 20:47:03.578859, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:160(msg_try_to_go_online) msg_try_to_go_online: received for domain CHILD2. [2016/02/28 20:47:03.578875, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:172(msg_try_to_go_online) msg_try_to_go_online: domain CHILD2 already online. [2016/02/28 20:47:03.579147, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:579(winbind_child_died) Already reaped child 29712 died [2016/02/28 20:47:05.076959, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:304(check_domain_online_handler) check_domain_online_handler: called for domain CHILD2 (online = True) [2016/02/28 20:47:05.077476, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1030 - private_data=(nil) [2016/02/28 20:47:05.077518, 5, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1031 - private_data=(nil) [2016/02/28 20:47:05.077887, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:05.077919, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:05.077927, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:05.077934, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:05.078015, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:05.078034, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:77(ads_dc_name) ads_dc_name: domain=CHILD2 [2016/02/28 20:47:05.078052, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:05.078066, 6, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:408(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'child2.domain.local' [2016/02/28 20:47:05.078077, 8, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child2.domain.local (sitename Default-First-Site-Name) [2016/02/28 20:47:05.078101, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:05.078113, 3, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:05.078126, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#1c (sitename Default-First-Site-Name) [2016/02/28 20:47:05.078141, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name child2.domain.local#1C found. [2016/02/28 20:47:05.078185, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.078195, 8, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:05.078209, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:05.078218, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:05.078228, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:05.078246, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.078276, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.078289, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.078297, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.078305, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:05.078312, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:389 [2016/02/28 20:47:05.078324, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.078333, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:253(ads_try_connect) ads_try_connect: sending CLDAP request to 192.168.82.95 (realm: child2.domain.local) [2016/02/28 20:47:05.079197, 1, pid=29713, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x000031f9 (12793) 1: NBT_SERVER_PDC 0: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 0: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 forest : 'domain.local' dns_domain : 'child2.domain.local' pdc_dns_name : 'Srv.child2.domain.local' domain_name : 'CHILD2' pdc_name : 'SRV' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2016/02/28 20:47:05.079394, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [CHILD2], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:05.079414, 10, pid=29713, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2, we already got it [2016/02/28 20:47:05.079423, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [child2.domain.local], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:05.079435, 10, pid=29713, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD2.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:05.079446, 3, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:751(ads_connect) Successfully contacted LDAP server 192.168.82.95 [2016/02/28 20:47:05.079460, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:05.079471, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:211(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2016/02/28 20:47:05.079489, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:874(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /var/vol/3/.ctera/samba/lock/smb_krb5/krb5.conf.CHILD2, realm = child2.domain.local, domain = CHILD2 [2016/02/28 20:47:05.079509, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:05.079520, 3, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:05.079529, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#dcdc (sitename Default-First-Site-Name) [2016/02/28 20:47:05.079541, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2464(resolve_ads) resolve_ads: Attempting to resolve KDCs for child2.domain.local using DNS [2016/02/28 20:47:05.112247, 4, pid=29713, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:435(ads_dns_lookup_srv) ads_dns_lookup_srv: 1 records returned in the answer section. [2016/02/28 20:47:05.112274, 10, pid=29713, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:216(ads_dns_parse_rr_srv) ads_dns_parse_rr_srv: Parsed srv.child2.domain.local [0, 100, 88] [2016/02/28 20:47:05.112287, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.112295, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 1 addresses: 192.168.82.95:88 [2016/02/28 20:47:05.112305, 8, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:05.112325, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:05.112354, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:05.112368, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:05.112405, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.112421, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.112434, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.112441, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.112449, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:05.112456, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:88 [2016/02/28 20:47:05.112464, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:706(get_kdc_ip_string) got 1 addresses from site Default-First-Site-Name search [2016/02/28 20:47:05.112479, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:05.112489, 3, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:05.112498, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#dcdc (sitename (null)) [2016/02/28 20:47:05.112507, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2464(resolve_ads) resolve_ads: Attempting to resolve KDCs for child2.domain.local using DNS [2016/02/28 20:47:05.164428, 4, pid=29713, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:435(ads_dns_lookup_srv) ads_dns_lookup_srv: 1 records returned in the answer section. [2016/02/28 20:47:05.164459, 10, pid=29713, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:216(ads_dns_parse_rr_srv) ads_dns_parse_rr_srv: Parsed srv.child2.domain.local [0, 100, 88] [2016/02/28 20:47:05.164472, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.164481, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 1 addresses: 192.168.82.95:88 [2016/02/28 20:47:05.164491, 8, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:05.164515, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:05.164523, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:05.164535, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:05.164562, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.164577, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.164602, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.164611, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.164619, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:05.164626, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:88 [2016/02/28 20:47:05.164635, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:712(get_kdc_ip_string) got 1 addresses from site-less search [2016/02/28 20:47:05.164643, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:744(get_kdc_ip_string) 0 additional KDCs to test [2016/02/28 20:47:05.164650, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:804(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 192.168.82.95 [2016/02/28 20:47:05.164724, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:966(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /var/vol/3/.ctera/samba/lock/smb_krb5/krb5.conf.CHILD2 with realm CHILD2.DOMAIN.LOCAL KDC list = kdc = 192.168.82.95 [2016/02/28 20:47:05.164749, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:151(ads_dc_name) ads_dc_name: using server='SRV.CHILD2.DOMAIN.LOCAL' IP=192.168.82.95 [2016/02/28 20:47:05.164765, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child2.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:05.164772, 8, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child2.domain.local (sitename Default-First-Site-Name) [2016/02/28 20:47:05.164787, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:05.164799, 3, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:05.164808, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#1c (sitename Default-First-Site-Name) [2016/02/28 20:47:05.164819, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name child2.domain.local#1C found. [2016/02/28 20:47:05.164844, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.164852, 8, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:05.164866, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:05.164873, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:05.164884, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:05.164910, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.164924, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.164936, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.164943, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.164996, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:05.165008, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:389 [2016/02/28 20:47:05.165026, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server 192.168.82.95 [2016/02/28 20:47:05.165035, 8, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child2.domain.local (sitename NULL) [2016/02/28 20:47:05.165049, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "child2.domain.local" domain [2016/02/28 20:47:05.165060, 3, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "Srv.child2.domain.local, *" [2016/02/28 20:47:05.165068, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child2.domain.local#1c (sitename (null)) [2016/02/28 20:47:05.165079, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name child2.domain.local#1C found. [2016/02/28 20:47:05.165100, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.165108, 8, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 1 DC's from auto lookup [2016/02/28 20:47:05.165121, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:05.165128, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:05.165138, 5, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:05.165153, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.165165, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.165176, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child2.domain.local server 192.168.82.95 [2016/02/28 20:47:05.165183, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:05.165199, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 1 ip addresses in an ordered list [2016/02/28 20:47:05.165207, 4, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.82.95:389 [2016/02/28 20:47:05.165219, 9, pid=29713, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server 192.168.82.95 [2016/02/28 20:47:05.165236, 10, pid=29713, effective(0, 0), real(0, 0)] ../source3/lib/messages_dgm.c:284(messaging_dgm_send) messaging_dgm_send: Sending message to 29690 [2016/02/28 20:47:05.165271, 10, pid=29690, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:254(messaging_recv_cb) messaging_recv_cb: Received message 0x406 len 7 (num_fds:0) from 29713 [2016/02/28 20:47:05.165287, 5, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:160(msg_try_to_go_online) msg_try_to_go_online: received for domain CHILD2. [2016/02/28 20:47:05.165297, 5, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:172(msg_try_to_go_online) msg_try_to_go_online: domain CHILD2 already online. [2016/02/28 20:47:05.165308, 10, pid=29690, effective(0, 0), real(0, 0)] ../source4/lib/messaging/messaging.c:435(imessaging_dgm_recv) imessaging_dgm_recv: Ignoring type=0x406 dst 29690, I am 29680, [2016/02/28 20:47:47.288916, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 36 [2016/02/28 20:47:47.289000, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn INTERFACE_VERSION [2016/02/28 20:47:47.289014, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:396(winbindd_interface_version) [29727]: request interface version (version = 27) [2016/02/28 20:47:47.289034, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:INTERFACE_VERSION]: delivered response to client [2016/02/28 20:47:47.289064, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:758(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2016/02/28 20:47:47.289074, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_misc.c:429(winbindd_priv_pipe_dir) [29727]: request location of privileged pipe [2016/02/28 20:47:47.289095, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2016/02/28 20:47:47.289129, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:916(new_connection) accepted socket 42 [2016/02/28 20:47:47.289159, 6, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:965(winbind_client_request_read) closing socket 36, client exited [2016/02/28 20:47:47.289187, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:GETPWNAM [2016/02/28 20:47:47.289198, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getpwnam.c:56(winbindd_getpwnam_send) getpwnam child\childuser1 [2016/02/28 20:47:47.289225, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD' name : * name : 'CHILDUSER1' flags : 0x00000008 (8) [2016/02/28 20:47:47.289312, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:47.289329, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:47.289350, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:47.289358, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (CHILD2) [2016/02/28 20:47:47.289378, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD' name : * name : 'CHILDUSER1' flags : 0x00000008 (8) [2016/02/28 20:47:47.289413, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:47.289421, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:47.289434, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain CHILD2 [2016/02/28 20:47:47.289443, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:253(msrpc_name_to_sid) msrpc_name_to_sid: name=CHILD\CHILDUSER1 [2016/02/28 20:47:47.289450, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:267(msrpc_name_to_sid) name_to_sid [rpc] CHILD\CHILDUSER1 for domain CHILD [2016/02/28 20:47:47.289458, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:47.289485, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames4: struct lsa_LookupNames4 in: struct lsa_LookupNames4 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'CHILD\CHILDUSER1' sids : * sids: struct lsa_TransSidArray3 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:47.289562, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000016 (22) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000054 (84) context_id : 0x0000 (0) opnum : 0x004d (77) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:47.289663, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:47.289717, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:47.289728, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 184 [2016/02/28 20:47:47.291938, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 232 [2016/02/28 20:47:47.291970, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00f8 (248) auth_length : 0x0038 (56) call_id : 0x00000016 (22) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000098 (152) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=224 [0000] E3 AC 9D EA 8E 88 04 AF 5F 1C 32 DF 53 BC 12 B8 ........ _.2.S... [0010] 2A 5B EC 86 CF 85 15 4B D2 1F FB 0F 98 FD 95 FD *[.....K ........ [0020] 2D AB 9E 38 01 B3 A2 2E A9 97 47 4D DF BD FF 78 -..8.... ..GM...x [0030] A1 5E 39 86 E5 E1 F2 30 8B B8 E5 E8 F2 B2 BB A9 .^9....0 ........ [0040] 83 6F 48 33 19 88 70 63 5C 8A 4F 85 42 7D 70 3C .oH3..pc \.O.B}p< [0050] 26 83 8D 0A DA 67 4D 49 DD D8 E1 77 77 29 BF 40 &....gMI ...ww).@ [0060] 76 E7 7A 6B E4 AD 67 F4 A1 4C 92 3A 10 CF EE BD v.zk..g. .L.:.... [0070] 98 54 F5 CB C6 CF A7 E6 8C 13 DD 0B 45 EE AC 75 .T...... ....E..u [0080] FA 90 2D 64 82 BE C9 2C A2 AC 7C C0 57 28 7B FA ..-d..., ..|.W({. [0090] 4F 2D 36 A2 3E 7D 84 41 53 6E 85 1A F8 32 A6 72 O-6.>}.A Sn...2.r [00A0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00B0] 0A 9A 83 F2 D4 86 D7 05 A5 E6 E1 6F FC 08 72 60 ........ ...o..r` [00C0] A4 D8 68 7C FE E5 AD 96 69 00 6E 00 2E 00 6C 00 ..h|.... i.n...l. [00D0] 6F 00 63 00 61 00 6C 00 00 00 00 00 00 00 00 00 o.c.a.l. ........ [2016/02/28 20:47:47.292307, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:47.292317, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:47:47.292325, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:47.292371, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 248, data_len 152, ss_len 8 [2016/02/28 20:47:47.292381, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 248 at offset 0: NT_STATUS_OK [2016/02/28 20:47:47.292390, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 152 bytes. [2016/02/28 20:47:47.292413, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames4: struct lsa_LookupNames4 out: struct lsa_LookupNames4 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) sids : * sids: struct lsa_TransSidArray3 count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid3 sid_type : SID_NAME_USER (1) sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-1147 sid_index : 0x00000000 (0) flags : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:47.292532, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:47.292548, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:47.292579, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: CHILD\CHILDUSER1 -> S-1-5-21-3518453233-2884963923-3703870538-1147 (NT_STATUS_OK) [2016/02/28 20:47:47.292604, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-5-21-3518453233-2884963923-3703870538-1147 -> CHILD\childuser1 (NT_STATUS_OK) [2016/02/28 20:47:47.292614, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USER (1) sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-1147 result : NT_STATUS_OK [2016/02/28 20:47:47.292647, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:47.292655, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3532 bytes to parent [2016/02/28 20:47:47.292710, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USER (1) sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-1147 result : NT_STATUS_OK [2016/02/28 20:47:47.292756, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_QueryUser: struct wbint_QueryUser in: struct wbint_QueryUser sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-1147 [2016/02/28 20:47:47.292785, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1420(fork_domain_child) fork_domain_child called for domain 'CHILD' [2016/02/28 20:47:47.293258, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1476(fork_domain_child) Child process 29728 [2016/02/28 20:47:47.293585, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 33 - private_data=(nil) [2016/02/28 20:47:47.293603, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 13 - private_data=(nil) [2016/02/28 20:47:47.293611, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:47.293618, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:47.293625, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1029 - private_data=(nil) [2016/02/28 20:47:47.293631, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:47.293638, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1033 - private_data=(nil) [2016/02/28 20:47:47.293653, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:47.293660, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1036 - private_data=(nil) [2016/02/28 20:47:47.293667, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1035 - private_data=(nil) [2016/02/28 20:47:47.293732, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1028 - private_data=(nil) [2016/02/28 20:47:47.293745, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1027 - private_data=(nil) [2016/02/28 20:47:47.293752, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1280 - private_data=(nil) [2016/02/28 20:47:47.293759, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1 - private_data=(nil) [2016/02/28 20:47:47.293767, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:446(messaging_register) Registering messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:47:47.293774, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:461(messaging_register) Overriding messaging pointer for type 1034 - private_data=(nil) [2016/02/28 20:47:47.293785, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:566(set_domain_online_request) set_domain_online_request: called for domain CHILD [2016/02/28 20:47:47.293796, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:601(set_domain_online_request) set_domain_online_request: domain CHILD was globally offline. [2016/02/28 20:47:47.293804, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:566(set_domain_online_request) set_domain_online_request: called for domain CHILD2 [2016/02/28 20:47:47.293811, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:601(set_domain_online_request) set_domain_online_request: domain CHILD2 was globally offline. [2016/02/28 20:47:47.293829, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 28 extra bytes [2016/02/28 20:47:47.293839, 4, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:47.293847, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:47.293857, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_QUERYUSER (CHILD) [2016/02/28 20:47:47.293884, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_QueryUser: struct wbint_QueryUser in: struct wbint_QueryUser sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-1147 [2016/02/28 20:47:47.293938, 3, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2118(connection_ok) connection_ok: Connection to (null) for domain CHILD is not connected [2016/02/28 20:47:47.293949, 5, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2222(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: domain CHILD [2016/02/28 20:47:47.293965, 3, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2118(connection_ok) connection_ok: Connection to (null) for domain CHILD2 is not connected [2016/02/28 20:47:47.293973, 3, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2253(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: No connection to our domain! [2016/02/28 20:47:47.294021, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:210(saf_fetch) saf_fetch: failed to find server for "CHILD" domain [2016/02/28 20:47:47.294033, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1917(cm_open_connection) cm_open_connection: dcname is '' for domain CHILD [2016/02/28 20:47:47.294045, 3, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2118(connection_ok) connection_ok: Connection to (null) for domain CHILD2 is not connected [2016/02/28 20:47:47.294065, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "Srv.child2.domain.local" for "CHILD2" domain [2016/02/28 20:47:47.294077, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server Srv.child2.domain.local [2016/02/28 20:47:47.294085, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1876(cm_open_connection) cm_open_connection: saf_servername is 'Srv.child2.domain.local' for domain CHILD2 [2016/02/28 20:47:47.294096, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1917(cm_open_connection) cm_open_connection: dcname is 'Srv.child2.domain.local' for domain CHILD2 [2016/02/28 20:47:47.294106, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD2 server Srv.child2.domain.local [2016/02/28 20:47:47.294119, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:47.294129, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up Srv.child2.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:47.294143, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name Srv.child2.domain.local#20 found. [2016/02/28 20:47:47.294184, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.294225, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.82.95 at port 445 [2016/02/28 20:47:47.294601, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1023(cm_prepare_connection) cm_prepare_connection: connecting to DC Srv.child2.domain.local for domain CHILD2 [2016/02/28 20:47:47.296847, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:47:47.296923, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:47:47.296946, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:47.296957, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff4431c740 [2016/02/28 20:47:47.296975, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff4431bf70 [2016/02/28 20:47:47.296985, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff4431c740 "ltdb_callback" [2016/02/28 20:47:47.297006, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff4431bf70 "ltdb_timeout" [2016/02/28 20:47:47.297017, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff4431c740 "ltdb_callback" [2016/02/28 20:47:47.297026, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:47:47.297034, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:47:47.297045, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:47:47.297057, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:47:47.297074, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:47:47.297094, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:47.297102, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff4431cb70 [2016/02/28 20:47:47.297110, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff4431c8f0 [2016/02/28 20:47:47.297119, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff4431cb70 "ltdb_callback" [2016/02/28 20:47:47.297128, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:47:47.297136, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff4431c8f0 "ltdb_timeout" [2016/02/28 20:47:47.297145, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff4431cb70 "ltdb_callback" [2016/02/28 20:47:47.297158, 3, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:47:47.297191, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:47:47.297210, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:47.297218, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff4431be20 [2016/02/28 20:47:47.297233, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff4431bbf0 [2016/02/28 20:47:47.297243, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff4431be20 "ltdb_callback" [2016/02/28 20:47:47.297344, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff4431bbf0 "ltdb_timeout" [2016/02/28 20:47:47.297356, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff4431be20 "ltdb_callback" [2016/02/28 20:47:47.297391, 5, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1116(cm_prepare_connection) connecting to Srv.child2.domain.local from URI-VGW-4 with kerberos principal [URI-VGW-4$@CHILD2.DOMAIN.LOCAL] and realm [child2.domain.local] [2016/02/28 20:47:47.297424, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1772(cli_session_setup_spnego_send) Doing spnego session setup (blob length=120) [2016/02/28 20:47:47.297459, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1799(cli_session_setup_spnego_send) got OID=1.3.6.1.4.1.311.2.2.30 got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.2.840.113554.1.2.2.3 got OID=1.3.6.1.4.1.311.2.2.10 [2016/02/28 20:47:47.297475, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1809(cli_session_setup_spnego_send) got principal=not_defined_in_RFC4178@please_ignore [2016/02/28 20:47:47.297482, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1679(cli_session_setup_get_principal) cli_session_setup_spnego: using target hostname not SPNEGO principal [2016/02/28 20:47:47.297491, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1694(cli_session_setup_get_principal) cli_session_setup_spnego: guessed server principal=cifs/Srv.child2.domain.local@CHILD2.DOMAIN.LOCAL [2016/02/28 20:47:47.298292, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:217(kerberos_kinit_password_ext) kerberos_kinit_password: as URI-VGW-4$@CHILD2.DOMAIN.LOCAL using [MEMORY:cliconnect] as ccache and config [(null)] [2016/02/28 20:47:47.542244, 2, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1288(cli_session_setup_kerberos_send) Doing kerberos session setup [2016/02/28 20:47:47.552393, 4, pid=29728, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:592(ads_krb5_mk_req) ads_krb5_mk_req: Advancing clock by 27 seconds to cope with clock skew [2016/02/28 20:47:47.552431, 3, pid=29728, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:339(ads_cleanup_expired_creds) ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect] expiration Mon, 29 Feb 2016 06:47:47 IST [2016/02/28 20:47:47.552454, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:606(ads_krb5_mk_req) ads_krb5_mk_req: Ticket (cifs/Srv.child2.domain.local@CHILD2.DOMAIN.LOCAL) in ccache (MEMORY:cliconnect) is valid until: (Mon, 29 Feb 2016 06:47:47 IST - 1456721267) [2016/02/28 20:47:47.552517, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:882(get_krb5_smb_session_key) Got KRB5 session key of length 32 [2016/02/28 20:47:47.554076, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:47.554409, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:47.554746, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [CHILD2], server = [Srv.child2.domain.local], expire = [1456771667] [2016/02/28 20:47:47.554792, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD2, we already got it [2016/02/28 20:47:47.554804, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [child2.domain.local], server = [Srv.child2.domain.local], expire = [1456771667] [2016/02/28 20:47:47.554816, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD2.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:47.554847, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:480(set_domain_online) set_domain_online: called for domain CHILD2 [2016/02/28 20:47:47.554861, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1030 - private_data=(nil) [2016/02/28 20:47:47.554871, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:493(messaging_deregister) Deregistering messaging pointer for type 1031 - private_data=(nil) [2016/02/28 20:47:47.554883, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages_dgm.c:284(messaging_dgm_send) messaging_dgm_send: Sending message to 29680 [2016/02/28 20:47:47.554918, 10, pid=29680, effective(0, 0), real(0, 0)] ../source4/lib/messaging/messaging.c:423(imessaging_dgm_recv) imessaging_dgm_recv: dst 29680 matches my id: 29680, type=0x40b [2016/02/28 20:47:47.554938, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:254(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 7 (num_fds:0) from 29728 [2016/02/28 20:47:47.554951, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:385(winbind_msg_domain_online) Domain CHILD2 is marked as online now. [2016/02/28 20:47:47.554977, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for CURRENT_DCNAME/CHILD2, we already got it [2016/02/28 20:47:47.555074, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:47:47.555135, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:47:47.555156, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:47.555166, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff4431ff40 [2016/02/28 20:47:47.555175, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44320000 [2016/02/28 20:47:47.555185, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff4431ff40 "ltdb_callback" [2016/02/28 20:47:47.555201, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44320000 "ltdb_timeout" [2016/02/28 20:47:47.555211, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff4431ff40 "ltdb_callback" [2016/02/28 20:47:47.555221, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:47:47.555228, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:47:47.555247, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:47:47.555260, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:47:47.555277, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:47:47.555298, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:47.555306, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44320710 [2016/02/28 20:47:47.555315, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44320490 [2016/02/28 20:47:47.555324, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44320710 "ltdb_callback" [2016/02/28 20:47:47.555345, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:47:47.555354, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44320490 "ltdb_timeout" [2016/02/28 20:47:47.555364, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44320710 "ltdb_callback" [2016/02/28 20:47:47.555374, 3, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:47:47.555400, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:47:47.555418, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:47.555426, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44321150 [2016/02/28 20:47:47.555435, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44321330 [2016/02/28 20:47:47.555444, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44321150 "ltdb_callback" [2016/02/28 20:47:47.555532, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44321330 "ltdb_timeout" [2016/02/28 20:47:47.555543, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44321150 "ltdb_callback" [2016/02/28 20:47:47.555676, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_netlogon.c:177(rpccli_setup_netlogon_creds) rpccli_setup_netlogon_creds: using cached netlogon_creds cli[URI-VGW-4$/URI-VGW-4] to Srv.child2.domain.local [2016/02/28 20:47:47.555740, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:47.556224, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:47.556246, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:47:47.556260, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:47:47.556272, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431b120 [2016/02/28 20:47:47.556327, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:47:47.556351, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:47.556359, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:47:47.556411, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'gssapi_spnego' registered [2016/02/28 20:47:47.556427, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'gssapi_krb5' registered [2016/02/28 20:47:47.556434, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'gssapi_krb5_sasl' registered [2016/02/28 20:47:47.556443, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'spnego' registered [2016/02/28 20:47:47.556450, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'schannel' registered [2016/02/28 20:47:47.556459, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'naclrpc_as_system' registered [2016/02/28 20:47:47.556468, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'sasl-EXTERNAL' registered [2016/02/28 20:47:47.556477, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'ntlmssp' registered [2016/02/28 20:47:47.556485, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'http_basic' registered [2016/02/28 20:47:47.556494, 3, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:899(gensec_register) GENSEC backend 'http_ntlm' registered [2016/02/28 20:47:47.556637, 5, pid=29728, effective(0, 0), real(0, 0)] ../auth/gensec/gensec_start.c:672(gensec_start_mech) Starting GENSEC mechanism schannel [2016/02/28 20:47:47.556660, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1747(rpc_pipe_bind_send) Bind RPC Pipe: host Srv.child2.domain.local auth_type 68, auth_level 6 [2016/02/28 20:47:47.556677, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1012(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2016/02/28 20:47:47.556774, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=25 [0000] 00 00 00 00 03 00 00 00 43 48 49 4C 44 32 00 55 ........ CHILD2.U [0010] 52 49 2D 56 47 57 2D 34 00 RI-VGW-4 . [2016/02/28 20:47:47.556856, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0069 (105) auth_length : 0x0019 (25) call_id : 0x00000001 (1) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=33 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 43 48 49 4C 44 32 00 55 52 49 2D 56 47 57 2D 34 CHILD2.U RI-VGW-4 [0020] 00 . [2016/02/28 20:47:47.557024, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:47.557059, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:47.557502, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 72 [2016/02/28 20:47:47.557537, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0058 (88) auth_length : 0x000c (12) call_id : 0x00000001 (1) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00039400 (234496) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] D0 11 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 A8 00 C0 .... [2016/02/28 20:47:47.557703, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 88 at offset 0: NT_STATUS_OK [2016/02/28 20:47:47.557717, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 88 bytes. [2016/02/28 20:47:47.557727, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:1618(check_bind_response) check_bind_response: accepted! [2016/02/28 20:47:47.557736, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=12 [0000] 01 00 00 00 00 00 00 00 00 A8 00 C0 ........ .... [2016/02/28 20:47:47.557787, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:47.557796, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:47:47.557806, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:47:47.557817, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431eb00 [2016/02/28 20:47:47.557834, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:47:47.557842, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:47.557849, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:47:47.557863, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:47.557870, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:47:47.557880, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:47:47.557896, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff443203e0 [2016/02/28 20:47:47.557910, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:47:47.557918, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:47.557925, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:47:47.557944, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:146(netlogon_creds_step) seed b775147b:3936d1bd [2016/02/28 20:47:47.557955, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:151(netlogon_creds_step) seed+time 0e48554e:3936d1bd [2016/02/28 20:47:47.557968, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:156(netlogon_creds_step) CLIENT b74722b1:33a450a9 [2016/02/28 20:47:47.557975, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:162(netlogon_creds_step) seed+time+1 0e48554f:3936d1bd [2016/02/28 20:47:47.557982, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/auth/credentials.c:167(netlogon_creds_step) SERVER 4ec630b0:bfaaa14c [2016/02/28 20:47:47.558000, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_LogonGetCapabilities: struct netr_LogonGetCapabilities in: struct netr_LogonGetCapabilities server_name : * server_name : '\\Srv.child2.domain.local' computer_name : * computer_name : 'URI-VGW-4' credential : * credential: struct netr_Authenticator cred: struct netr_Credential data : b12247b7a950a433 timestamp : Sun Feb 28 20:47:47 2016 IST return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : 0000000000000000 timestamp : (time_t)0 query_level : 0x00000001 (1) [2016/02/28 20:47:47.558086, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2016/02/28 20:47:47.558194, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000002 (2) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x000000bc (188) context_id : 0x0000 (0) opnum : 0x0015 (21) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:47.558281, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:47.558355, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:47.558386, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:47.558938, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 104 [2016/02/28 20:47:47.558965, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0078 (120) auth_length : 0x0038 (56) call_id : 0x00000002 (2) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000018 (24) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=96 [0000] F0 46 35 68 B7 D5 64 EE 7D 91 79 AB 75 D2 28 5E .F5h..d. }.y.u.(^ [0010] D1 50 B9 B8 84 E4 D2 5F E1 2A 39 C4 4E 9C AC 46 .P....._ .*9.N..F [0020] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0030] FF E0 C5 B9 1B 5E 3B AE 10 AF 0F 7D FD 88 FF E3 .....^;. ...}.... [0040] 2A D2 FD 67 69 A1 C9 C8 5C 8A 4F 85 42 7D 70 3C *..gi... \.O.B}p< [0050] 26 83 8D 0A DA 67 4D 49 DD D8 E1 77 77 29 BF 40 &....gMI ...ww).@ [2016/02/28 20:47:47.559165, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:47.559175, 6, pid=29728, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:47:47.559182, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:47.559201, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 120, data_len 24, ss_len 8 [2016/02/28 20:47:47.559209, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 120 at offset 0: NT_STATUS_OK [2016/02/28 20:47:47.559217, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 24 bytes. [2016/02/28 20:47:47.559235, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_LogonGetCapabilities: struct netr_LogonGetCapabilities out: struct netr_LogonGetCapabilities return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : b030c64e4ca1aabf timestamp : (time_t)0 capabilities : * capabilities : union netr_Capabilities(case 1) server_capabilities : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC result : NT_STATUS_OK [2016/02/28 20:47:47.559394, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:47:47.559405, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/flash/samba/netlogon_creds_cli.tdb 3: [2016/02/28 20:47:47.559415, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:47:47.559426, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431f4b0 [2016/02/28 20:47:47.559444, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:47:47.559454, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /flash/samba/netlogon_creds_cli.tdb [2016/02/28 20:47:47.559461, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:47:47.559470, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:178(dbwrap_check_lock_order) check lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:47.559477, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2:/var/vol/3/.ctera/samba/lock/g_lock.tdb 3: [2016/02/28 20:47:47.559486, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 434C495B5552492D5647 [2016/02/28 20:47:47.559495, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7eff4431f320 [2016/02/28 20:47:47.559510, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 434C495B5552492D5647 [2016/02/28 20:47:47.559518, 5, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 2 for /var/vol/3/.ctera/samba/lock/g_lock.tdb [2016/02/28 20:47:47.559525, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2016/02/28 20:47:47.559539, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:3195(cli_rpc_pipe_open_schannel_with_creds) cli_rpc_pipe_open_schannel_with_creds: opened pipe netlogon to machine Srv.child2.domain.local for domain CHILD2 and bound using schannel. [2016/02/28 20:47:47.559558, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsRGetDCName: struct netr_DsRGetDCName in: struct netr_DsRGetDCName server_unc : * server_unc : 'Srv.child2.domain.local' domain_name : * domain_name : 'CHILD' domain_guid : NULL site_guid : NULL flags : 0x40000000 (1073741824) 0: DS_FORCE_REDISCOVERY 0: DS_DIRECTORY_SERVICE_REQUIRED 0: DS_DIRECTORY_SERVICE_PREFERRED 0: DS_GC_SERVER_REQUIRED 0: DS_PDC_REQUIRED 0: DS_BACKGROUND_ONLY 0: DS_IP_REQUIRED 0: DS_KDC_REQUIRED 0: DS_TIMESERV_REQUIRED 0: DS_WRITABLE_REQUIRED 0: DS_GOOD_TIMESERV_PREFERRED 0: DS_AVOID_SELF 0: DS_ONLY_LDAP_NEEDED 0: DS_IS_FLAT_NAME 0: DS_IS_DNS_NAME 0: DS_TRY_NEXTCLOSEST_SITE 0: DS_DIRECTORY_SERVICE_6_REQUIRED 0: DS_WEB_SERVICE_REQUIRED 1: DS_RETURN_DNS_NAME 0: DS_RETURN_FLAT_NAME [2016/02/28 20:47:47.559662, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000003 (3) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000068 (104) context_id : 0x0000 (0) opnum : 0x0014 (20) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:47.559751, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:47.559801, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:47.559836, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:47.560794, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 456 [2016/02/28 20:47:47.560822, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x01d8 (472) auth_length : 0x0038 (56) call_id : 0x00000003 (3) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000017c (380) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=448 [0000] 66 62 76 38 92 03 D7 0A 8E 6B B8 FB FD 30 00 9E fbv8.... .k...0.. [0010] D3 B8 93 F8 09 10 5B DB 40 63 26 6D 29 07 20 71 ......[. @c&m). q [0020] 61 DD 53 82 DD C5 9B AB 2A A3 55 B6 2C 56 70 CB a.S..... *.U.,Vp. [0030] C4 04 1C 3C 38 E9 01 05 44 BD D7 6A 0B A9 10 8E ...<8... D..j.... [0040] BB C6 A6 09 78 FE 11 F3 AB 96 0A 82 A9 ED 60 2A ....x... ......`* [0050] FC E0 23 BF A8 E8 75 5A 59 F8 8D 62 5B 1A F0 49 ..#...uZ Y..b[..I [0060] 7D 90 E8 00 86 FF B2 B2 FB 22 C7 0C C3 9D 70 40 }....... ."....p@ [0070] 57 8C 88 88 0B 04 AF BB 17 EB 3B 54 8B DD 05 1F W....... ..;T.... [0080] BE AF 22 84 43 2F 7C E5 42 39 78 53 B2 54 3B FE ..".C/|. B9xS.T;. [0090] EE 15 13 70 FC 57 63 4D D1 A4 75 97 D3 A1 A2 A8 ...p.WcM ..u..... [00A0] 5D BB 83 B6 24 A5 C2 3F 1D 71 E0 B9 B6 34 E0 D4 ]...$..? .q...4.. [00B0] BB 19 7D 1F E3 A9 C7 C7 5A 3E EA 1A 4A 13 B4 B9 ..}..... Z>..J... [00C0] C6 8B 15 FD C1 24 9C 67 62 94 6C 28 51 D0 4D 21 .....$.g b.l(Q.M! [00D0] 0F DB 61 DE DB 1C FF CA 73 87 45 F2 30 9B EF 72 ..a..... s.E.0..r [00E0] 28 79 D5 80 9A 49 05 F7 51 91 C3 34 C9 A5 01 29 (y...I.. Q..4...) [00F0] F8 C4 67 3F 35 42 E0 BF B1 E0 60 52 B6 70 01 E3 ..g?5B.. ..`R.p.. [0100] 5E 55 2F 95 54 03 61 8A 20 0B 6A 10 21 0F 8C 06 ^U/.T.a. .j.!... [0110] 1A 2B B0 A5 14 BD B4 92 58 3A F5 47 38 63 D0 4C .+...... X:.G8c.L [0120] 76 97 A7 57 DA 3A 4B 7C 04 6D 2F CE 2F 24 EA 1B v..W.:K| .m/./$.. [0130] B4 5D 75 B5 35 3E 41 25 88 DF F6 C9 0D E9 B3 DC .]u.5>A% ........ [0140] D0 53 0F CB ED 98 0A 15 DE 61 C1 E1 FF C4 D4 87 .S...... .a...... [0150] 9D C5 B1 EB 15 D9 62 CA EB 7D F3 DE F9 7E D7 2B ......b. .}...~.+ [0160] 52 53 3E EF 86 BC 50 E6 E8 5D 19 12 F4 06 AE 25 RS>...P. .].....% [0170] BD CB 8E 58 CF C8 2A DC 96 26 93 B6 FF E6 03 79 ...X..*. .&.....y [0180] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0190] 33 AA A5 5D D5 F9 81 D8 8A B8 03 8C 33 EC 31 D0 3..].... ....3.1. [01A0] 6A B1 59 F4 50 DE 51 4A 00 00 00 00 00 00 00 00 j.Y.P.QJ ........ [01B0] 18 00 00 00 00 00 00 00 44 00 65 00 66 00 61 00 ........ D.e.f.a. [2016/02/28 20:47:47.561400, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:47.561410, 6, pid=29728, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 4 [2016/02/28 20:47:47.561418, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:47.561485, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 472, data_len 380, ss_len 4 [2016/02/28 20:47:47.561494, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 472 at offset 0: NT_STATUS_OK [2016/02/28 20:47:47.561501, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 380 bytes. [2016/02/28 20:47:47.561524, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsRGetDCName: struct netr_DsRGetDCName out: struct netr_DsRGetDCName info : * info : * info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : '\\DC01.child.domain.local' dc_address : * dc_address : '\\192.168.27.200' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : a33c6725-bd2a-462b-828b-583a97175a8e domain_name : * domain_name : 'child.domain.local' forest_name : * forest_name : 'domain.local' dc_flags : 0xe000f1fd (3758158333) 1: DS_SERVER_PDC 1: DS_SERVER_GC 1: DS_SERVER_LDAP 1: DS_SERVER_DS 1: DS_SERVER_KDC 1: DS_SERVER_TIMESERV 1: DS_SERVER_CLOSEST 1: DS_SERVER_WRITABLE 0: DS_SERVER_GOOD_TIMESERV 0: DS_SERVER_NDNC 0: DS_SERVER_SELECT_SECRET_DOMAIN_6 1: DS_SERVER_FULL_SECRET_DOMAIN_6 1: DS_SERVER_WEBSERV 1: DS_SERVER_DS_8 1: DS_DNS_CONTROLLER 1: DS_DNS_DOMAIN 1: DS_DNS_FOREST_ROOT dc_site_name : * dc_site_name : 'Default-First-Site-Name' client_site_name : * client_site_name : 'Default-First-Site-Name' result : WERR_OK [2016/02/28 20:47:47.561667, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:885(get_dc_name_via_netlogon) dcerpc_netr_GetAnyDCName returned DC01.child.domain.local [2016/02/28 20:47:47.561687, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:47.561696, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up DC01.child.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:47.561707, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:160(namecache_fetch) no entry for DC01.child.domain.local#20 found. [2016/02/28 20:47:47.561719, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2353(resolve_hosts) resolve_hosts: Attempting host lookup for name DC01.child.domain.local<0x20> [2016/02/28 20:47:47.569547, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.569567, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:78(namecache_store) namecache_store: storing 1 address for DC01.child.domain.local#20: 192.168.27.200 [2016/02/28 20:47:47.569589, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[NBT/DC01.CHILD.DOMAIN.LOCAL#20] and timeout=[Sun Feb 28 20:58:47 2016 IST] (660 seconds ahead) [2016/02/28 20:47:47.569625, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 1 addresses: 192.168.27.200:0 [2016/02/28 20:47:47.569642, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain CHILD server DC01.child.domain.local [2016/02/28 20:47:47.569661, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1525(get_dcs) Retrieved DC DC01.child.domain.local at 192.168.27.200 via netlogon [2016/02/28 20:47:47.569681, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/util_sock.c:515(open_socket_out_send) Connecting to 192.168.27.200 at port 445 [2016/02/28 20:47:47.570111, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1023(cm_prepare_connection) cm_prepare_connection: connecting to DC DC01.child.domain.local for domain CHILD [2016/02/28 20:47:47.571496, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:210(samba_ldb_connect) [2016/02/28 20:47:47.571586, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: @MODULES scope: base expr: (@LIST=*) attr: @LIST control: [2016/02/28 20:47:47.571608, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:47.571618, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44324f80 [2016/02/28 20:47:47.571627, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44325040 [2016/02/28 20:47:47.571636, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44324f80 "ltdb_callback" [2016/02/28 20:47:47.571652, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44325040 "ltdb_timeout" [2016/02/28 20:47:47.571662, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44324f80 "ltdb_callback" [2016/02/28 20:47:47.571671, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: no modules required by the db [2016/02/28 20:47:47.571679, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: No modules specified for this database [2016/02/28 20:47:47.571689, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: REGISTER_CONTROL 1.2.840.113556.1.4.1413 control: [2016/02/28 20:47:47.571700, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: unable to find module or backend to handle operation: request [2016/02/28 20:47:47.571716, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: scope: base expr: (objectClass=*) attr: rootDomainNamingContext attr: configurationNamingContext attr: schemaNamingContext attr: defaultNamingContext control: [2016/02/28 20:47:47.571736, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:47.571744, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44325750 [2016/02/28 20:47:47.571753, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff443254d0 [2016/02/28 20:47:47.571761, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44325750 "ltdb_callback" [2016/02/28 20:47:47.571780, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search [2016/02/28 20:47:47.571789, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff443254d0 "ltdb_timeout" [2016/02/28 20:47:47.571798, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44325750 "ltdb_callback" [2016/02/28 20:47:47.571808, 3, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:321(ldb_wrap_connect) ldb_wrap open of secrets.ldb [2016/02/28 20:47:47.571829, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: SEARCH dn: cn=Primary Domains scope: sub expr: (&(flatname=CHILD2)(objectclass=primaryDomain)) attr: control: [2016/02/28 20:47:47.571846, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: ldb_trace_request: (tdb)->search [2016/02/28 20:47:47.571854, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_callback": 0x7eff44326190 [2016/02/28 20:47:47.571863, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Added timed event "ltdb_timeout": 0x7eff44326370 [2016/02/28 20:47:47.571872, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Running timer event 0x7eff44326190 "ltdb_callback" [2016/02/28 20:47:47.571958, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Destroying timer event 0x7eff44326370 "ltdb_timeout" [2016/02/28 20:47:47.571969, 10, pid=29728, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:72(ldb_wrap_debug) ldb: Ending timer event 0x7eff44326190 "ltdb_callback" [2016/02/28 20:47:47.571998, 5, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:1116(cm_prepare_connection) connecting to DC01.child.domain.local from URI-VGW-4 with kerberos principal [URI-VGW-4$@CHILD2.DOMAIN.LOCAL] and realm [child.domain.local] [2016/02/28 20:47:47.572023, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1772(cli_session_setup_spnego_send) Doing spnego session setup (blob length=120) [2016/02/28 20:47:47.572055, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1799(cli_session_setup_spnego_send) got OID=1.3.6.1.4.1.311.2.2.30 got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.2.840.113554.1.2.2.3 got OID=1.3.6.1.4.1.311.2.2.10 [2016/02/28 20:47:47.572070, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1809(cli_session_setup_spnego_send) got principal=not_defined_in_RFC4178@please_ignore [2016/02/28 20:47:47.572078, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1679(cli_session_setup_get_principal) cli_session_setup_spnego: using target hostname not SPNEGO principal [2016/02/28 20:47:47.572086, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1694(cli_session_setup_get_principal) cli_session_setup_spnego: guessed server principal=cifs/DC01.child.domain.local@CHILD.DOMAIN.LOCAL [2016/02/28 20:47:47.572135, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:217(kerberos_kinit_password_ext) kerberos_kinit_password: as URI-VGW-4$@CHILD2.DOMAIN.LOCAL using [MEMORY:cliconnect] as ccache and config [(null)] [2016/02/28 20:47:47.822106, 2, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/cliconnect.c:1288(cli_session_setup_kerberos_send) Doing kerberos session setup [2016/02/28 20:47:47.899126, 4, pid=29728, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:592(ads_krb5_mk_req) ads_krb5_mk_req: Advancing clock by 28 seconds to cope with clock skew [2016/02/28 20:47:47.899164, 3, pid=29728, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:339(ads_cleanup_expired_creds) ads_cleanup_expired_creds: Ticket in ccache[MEMORY:cliconnect] expiration Mon, 29 Feb 2016 06:47:47 IST [2016/02/28 20:47:47.899182, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:606(ads_krb5_mk_req) ads_krb5_mk_req: Ticket (cifs/DC01.child.domain.local@CHILD.DOMAIN.LOCAL) in ccache (MEMORY:cliconnect) is valid until: (Mon, 29 Feb 2016 06:47:47 IST - 1456721267) [2016/02/28 20:47:47.899284, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/krb5_wrap/krb5_samba.c:882(get_krb5_smb_session_key) Got KRB5 session key of length 32 [2016/02/28 20:47:47.900760, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:47.901318, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:47.901654, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [CHILD], server = [DC01.child.domain.local], expire = [1456771667] [2016/02/28 20:47:47.901695, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[SAF/DOMAIN/CHILD] and timeout=[Mon Feb 29 20:47:47 2016 IST] (86400 seconds ahead) [2016/02/28 20:47:47.901724, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [child.domain.local], server = [DC01.child.domain.local], expire = [1456771667] [2016/02/28 20:47:47.901736, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[SAF/DOMAIN/CHILD.DOMAIN.LOCAL] and timeout=[Mon Feb 29 20:47:47 2016 IST] (86400 seconds ahead) [2016/02/28 20:47:47.901783, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:3590(set_global_winbindd_state_online) set_global_winbindd_state_online: online requested. [2016/02/28 20:47:47.901796, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:3593(set_global_winbindd_state_online) set_global_winbindd_state_online: rejecting. [2016/02/28 20:47:47.901803, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:480(set_domain_online) set_domain_online: called for domain CHILD [2016/02/28 20:47:47.901822, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/lib/messages_dgm.c:284(messaging_dgm_send) messaging_dgm_send: Sending message to 29680 [2016/02/28 20:47:47.901848, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[CURRENT_DCNAME/CHILD] and timeout=[Tue Jan 19 05:14:07 2038 IST] (690798380 seconds ahead) [2016/02/28 20:47:47.901880, 5, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2222(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: domain CHILD [2016/02/28 20:47:47.901902, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsrEnumerateDomainTrusts: struct netr_DsrEnumerateDomainTrusts in: struct netr_DsrEnumerateDomainTrusts server_name : * server_name : 'Srv.child2.domain.local' trust_flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES [2016/02/28 20:47:47.901984, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000004 (4) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000044 (68) context_id : 0x0000 (0) opnum : 0x0028 (40) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:47.902078, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:47.902126, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:47.902153, 5, pid=29728, effective(0, 0), real(0, 0)] ../libcli/smb/smb2_signing.c:92(smb2_signing_sign_pdu) signed SMB2 message [2016/02/28 20:47:47.902219, 10, pid=29680, effective(0, 0), real(0, 0)] ../source4/lib/messaging/messaging.c:423(imessaging_dgm_recv) imessaging_dgm_recv: dst 29680 matches my id: 29680, type=0x40b [2016/02/28 20:47:47.902240, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:254(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 6 (num_fds:0) from 29728 [2016/02/28 20:47:47.902255, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:385(winbind_msg_domain_online) Domain CHILD is marked as online now. [2016/02/28 20:47:47.902954, 5, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 536 [2016/02/28 20:47:47.902983, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0228 (552) auth_length : 0x0038 (56) call_id : 0x00000004 (4) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000001c8 (456) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=528 [0000] 7A 10 DA E5 BE 25 86 A1 97 2C 05 DB 70 71 D5 71 z....%.. .,..pq.q [0010] 08 27 A3 C5 47 D2 F7 16 1A 35 A6 64 BC BF 34 9F .'..G... .5.d..4. [0020] 2E 2E EB 08 E2 BF 43 04 98 95 40 75 0F 03 9D F4 ......C. ..@u.... [0030] F7 57 11 4A FE 5E C4 7F E2 33 F8 AD F8 50 A1 DE .W.J.^.. .3...P.. [0040] FB 32 E5 94 A9 9A C0 C6 61 B5 20 05 C4 56 95 31 .2...... a. ..V.1 [0050] 8B F1 0F AA 43 CA E3 60 0C 4C DD 47 0E D3 77 84 ....C..` .L.G..w. [0060] D4 E4 06 5E D0 22 02 69 E1 2D CF 2F 63 C5 F3 EC ...^.".i .-./c... [0070] 42 0C DB 1C 76 A5 76 17 C0 3F 2B 8B B4 F1 6C AA B...v.v. .?+...l. [0080] 52 AC 62 C7 75 16 68 75 6A 00 88 AC B9 CC 03 89 R.b.u.hu j....... [0090] 98 0B 1B 90 85 EE 2F 6F CB 90 46 6C C1 AE CC D0 ....../o ..Fl.... [00A0] 11 FA 52 62 42 23 C3 9E 26 CE 53 E6 C1 D7 F2 93 ..RbB#.. &.S..... [00B0] CF 09 2C 18 DF E7 A8 1B 76 58 8D EA 9A 35 2D 11 ..,..... vX...5-. [00C0] 51 C7 21 21 CF 53 47 D2 17 7C 5F 5A F7 F8 62 7F Q.!!.SG. .|_Z..b. [00D0] FF FC 9F E7 03 F8 62 21 1F 8A 74 EA 31 7A 64 4C ......b! ..t.1zdL [00E0] 92 5B FA BF 73 C3 2C F0 09 CC 21 86 F2 83 9F EF .[..s.,. ..!..... [00F0] 75 6B 5A B4 13 C8 25 E4 29 7B DE 86 26 1E 12 BE ukZ...%. ){..&... [0100] FA 93 91 B6 E1 6B 8E DC 49 0E 1D 2A 3C 2B 4B 2C .....k.. I..*<+K, [0110] DC 45 38 4E 50 B5 CF 67 1F BE 6A B1 A9 E4 EB 59 .E8NP..g ..j....Y [0120] 72 42 B4 9F 0D 04 A1 2C E9 C8 C4 1E C6 2C A1 94 rB....., .....,.. [0130] 94 FC C9 B7 20 84 B1 98 E7 26 E3 C8 82 D4 C0 ED .... ... .&...... [0140] 3C 7C 50 54 35 1F AA F6 D4 67 7D D3 BD 7B 2D 66 <|PT5... .g}..{-f [0150] E3 F8 D8 0F 87 33 25 CE A2 ED B2 FF B4 04 E1 56 .....3%. .......V [0160] 5A 18 3B 81 47 B9 E2 77 20 9F 97 24 FC 7B 28 30 Z.;.G..w ..$.{(0 [0170] 3C 2F FE E3 5B B9 3E 7F FC 36 65 C3 AA 94 21 99 . .6e...!. [0180] 62 3D AD 26 D9 F1 BD 97 CC EC 61 EB 2C B8 16 12 b=.&.... ..a.,... [0190] 9A 31 D5 E5 6C 46 D9 01 37 E4 74 86 D5 46 C4 B1 .1..lF.. 7.t..F.. [01A0] 63 51 ED 7A CA 6B B7 63 87 5D 61 C0 0A F0 CE BB cQ.z.k.c .]a..... [01B0] F1 75 9E 48 A4 93 49 1F 0C 9A 9F A7 24 7A 1F 0E .u.H..I. ....$z.. [01C0] 51 64 CE B6 22 D9 85 7F 16 EC 58 1F 90 E4 F9 48 Qd.."... ..X....H [01D0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [01E0] 58 99 DB FB 3F 24 34 F8 F0 2D 0D 88 75 CB 05 04 X...?$4. .-..u... [01F0] 6C 01 8C 51 61 F5 3B 11 E9 76 1C 7C DC 14 AE 31 l..Qa.;. .v.|...1 [0200] 99 66 FA 35 C4 AE 74 F0 14 58 E6 95 87 24 DD C0 .f.5..t. .X...$.. [2016/02/28 20:47:47.903644, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:47.903655, 6, pid=29728, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:47:47.903663, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:47.903741, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 552, data_len 456, ss_len 8 [2016/02/28 20:47:47.903756, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 552 at offset 0: NT_STATUS_OK [2016/02/28 20:47:47.903765, 10, pid=29728, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 456 bytes. [2016/02/28 20:47:47.903796, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) netr_DsrEnumerateDomainTrusts: struct netr_DsrEnumerateDomainTrusts out: struct netr_DsrEnumerateDomainTrusts trusts : * trusts: struct netr_DomainTrustList count : 0x00000003 (3) array : * array: ARRAY(3) array: struct netr_DomainTrust netbios_name : * netbios_name : 'DOMAIN' dns_name : * dns_name : 'domain.local' trust_flags : 0x00000027 (39) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 1: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000020 (32) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 1: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION sid : * sid : S-1-5-21-962387436-534109671-967373764 guid : 648a62d6-5e24-40dc-a0a7-efc689e00852 array: struct netr_DomainTrust netbios_name : * netbios_name : 'CHILD' dns_name : * dns_name : 'child.domain.local' trust_flags : 0x00000023 (35) 1: NETR_TRUST_FLAG_IN_FOREST 1: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 0: NETR_TRUST_FLAG_PRIMARY 0: NETR_TRUST_FLAG_NATIVE 1: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000020 (32) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 1: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 guid : a33c6725-bd2a-462b-828b-583a97175a8e array: struct netr_DomainTrust netbios_name : * netbios_name : 'CHILD2' dns_name : * dns_name : 'child2.domain.local' trust_flags : 0x00000019 (25) 1: NETR_TRUST_FLAG_IN_FOREST 0: NETR_TRUST_FLAG_OUTBOUND 0: NETR_TRUST_FLAG_TREEROOT 1: NETR_TRUST_FLAG_PRIMARY 1: NETR_TRUST_FLAG_NATIVE 0: NETR_TRUST_FLAG_INBOUND 0: NETR_TRUST_FLAG_MIT_KRB5 0: NETR_TRUST_FLAG_AES parent_index : 0x00000000 (0) trust_type : LSA_TRUST_TYPE_UPLEVEL (2) trust_attributes : 0x00000000 (0) 0: LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY 0: LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0: LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0: LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0: LSA_TRUST_ATTRIBUTE_WITHIN_FOREST 0: LSA_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0: LSA_TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION sid : * sid : S-1-5-21-733680754-3169875714-4083418759 guid : 280f0c6f-e231-4cae-afad-5a7cfc8a04b0 result : WERR_OK [2016/02/28 20:47:47.904138, 5, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2309(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: domain CHILD is NOT in native mode. [2016/02/28 20:47:47.904148, 5, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2313(set_dc_type_and_flags_trustinfo) set_dc_type_and_flags_trustinfo: domain CHILD is running active directory. [2016/02/28 20:47:47.904158, 5, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:170(get_cache) get_cache: Setting ADS methods for domain CHILD [2016/02/28 20:47:47.904185, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4772(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Searching for domain CHILD [2016/02/28 20:47:47.904222, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4787(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Found domain CHILD [2016/02/28 20:47:47.904235, 3, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:1490(sequence_number) ads: fetch sequence_number for CHILD [2016/02/28 20:47:47.904244, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4772(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Searching for domain CHILD [2016/02/28 20:47:47.904257, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4787(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Found domain CHILD [2016/02/28 20:47:47.904265, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:229(ads_cached_connection) ads_cached_connection [2016/02/28 20:47:47.904308, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:102(sitename_fetch) sitename_fetch: No stored sitename for child.domain.local [2016/02/28 20:47:47.904318, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:77(ads_dc_name) ads_dc_name: domain=CHILD [2016/02/28 20:47:47.904333, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:102(sitename_fetch) sitename_fetch: No stored sitename for child.domain.local [2016/02/28 20:47:47.904353, 6, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:408(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'child.domain.local' [2016/02/28 20:47:47.904364, 8, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child.domain.local (sitename NULL) [2016/02/28 20:47:47.904381, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "DC01.child.domain.local" for "child.domain.local" domain [2016/02/28 20:47:47.904392, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "DC01.child.domain.local, *" [2016/02/28 20:47:47.904401, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child.domain.local#1c (sitename (null)) [2016/02/28 20:47:47.904413, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:160(namecache_fetch) no entry for child.domain.local#1C found. [2016/02/28 20:47:47.904425, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2455(resolve_ads) resolve_ads: Attempting to resolve DCs for child.domain.local using DNS [2016/02/28 20:47:47.908298, 4, pid=29728, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:435(ads_dns_lookup_srv) ads_dns_lookup_srv: 1 records returned in the answer section. [2016/02/28 20:47:47.908318, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:216(ads_dns_parse_rr_srv) ads_dns_parse_rr_srv: Parsed dc01.child.domain.local [0, 100, 389] [2016/02/28 20:47:47.908332, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.908350, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:78(namecache_store) namecache_store: storing 2 addresses for child.domain.local#1c: 192.168.27.200,[2001:0:9d38:90d7:2010:2fdb:3f57:e437] [2016/02/28 20:47:47.908376, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[NBT/CHILD.DOMAIN.LOCAL#1C] and timeout=[Sun Feb 28 20:58:47 2016 IST] (660 seconds ahead) [2016/02/28 20:47:47.908400, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 2 addresses: 192.168.27.200:389 2001:0:9d38:90d7:2010:2fdb:3f57:e437:389 [2016/02/28 20:47:47.908420, 8, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 2 DC's from auto lookup [2016/02/28 20:47:47.908437, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:47.908445, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up DC01.child.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:47.908454, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name DC01.child.domain.local#20 found. [2016/02/28 20:47:47.908485, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.908499, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 192.168.27.200 [2016/02/28 20:47:47.908511, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 192.168.27.200 [2016/02/28 20:47:47.908523, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 2001:0:9d38:90d7:2010:2fdb:3f57:e437 [2016/02/28 20:47:47.908531, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.908539, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 2 ip addresses in an ordered list [2016/02/28 20:47:47.908546, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.27.200:389 2001:0:9d38:90d7:2010:2fdb:3f57:e437:389 [2016/02/28 20:47:47.908559, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 192.168.27.200 [2016/02/28 20:47:47.908568, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:253(ads_try_connect) ads_try_connect: sending CLDAP request to 192.168.27.200 (realm: child.domain.local) [2016/02/28 20:47:47.909201, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0000f1fd (61949) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : a33c6725-bd2a-462b-828b-583a97175a8e forest : 'domain.local' dns_domain : 'child.domain.local' pdc_dns_name : 'DC01.child.domain.local' domain_name : 'CHILD' pdc_name : 'DC01' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2016/02/28 20:47:47.909387, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [CHILD], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:47.909406, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[AD_SITENAME/DOMAIN/CHILD] and timeout=[67768036191676799 seconds since the Epoch] (629237932 seconds ahead) [2016/02/28 20:47:47.909434, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [child.domain.local], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:47.909445, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[AD_SITENAME/DOMAIN/CHILD.DOMAIN.LOCAL] and timeout=[67768036191676799 seconds since the Epoch] (629237932 seconds ahead) [2016/02/28 20:47:47.909468, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:751(ads_connect) Successfully contacted LDAP server 192.168.27.200 [2016/02/28 20:47:47.909481, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:47.909490, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:47.909500, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:388(gencache_del) Deleting cache entry (key=[NBT/CHILD.DOMAIN.LOCAL#1C]) [2016/02/28 20:47:47.909512, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[NBT/CHILD.DOMAIN.LOCAL#1C] and timeout=[Thu Jan 1 02:00:00 1970 IST] (-1456685267 seconds in the past) [2016/02/28 20:47:47.909530, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:388(gencache_del) Deleting cache entry (key=[NBT/CHILD#1C]) [2016/02/28 20:47:47.909542, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:77(ads_dc_name) ads_dc_name: domain=CHILD [2016/02/28 20:47:47.909552, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:47.909559, 6, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:408(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'child.domain.local' [2016/02/28 20:47:47.909574, 8, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child.domain.local (sitename Default-First-Site-Name) [2016/02/28 20:47:47.909589, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "DC01.child.domain.local" for "child.domain.local" domain [2016/02/28 20:47:47.909599, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "DC01.child.domain.local, *" [2016/02/28 20:47:47.909608, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child.domain.local#1c (sitename Default-First-Site-Name) [2016/02/28 20:47:47.909618, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:160(namecache_fetch) no entry for child.domain.local#1C found. [2016/02/28 20:47:47.909627, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2455(resolve_ads) resolve_ads: Attempting to resolve DCs for child.domain.local using DNS [2016/02/28 20:47:47.911428, 4, pid=29728, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:435(ads_dns_lookup_srv) ads_dns_lookup_srv: 1 records returned in the answer section. [2016/02/28 20:47:47.911448, 10, pid=29728, effective(0, 0), real(0, 0)] ../lib/addns/dnsquery.c:216(ads_dns_parse_rr_srv) ads_dns_parse_rr_srv: Parsed dc01.child.domain.local [0, 100, 389] [2016/02/28 20:47:47.911460, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.911468, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:78(namecache_store) namecache_store: storing 2 addresses for child.domain.local#1c: 192.168.27.200,[2001:0:9d38:90d7:2010:2fdb:3f57:e437] [2016/02/28 20:47:47.911491, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[NBT/CHILD.DOMAIN.LOCAL#1C] and timeout=[Sun Feb 28 20:58:47 2016 IST] (660 seconds ahead) [2016/02/28 20:47:47.911511, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2823(internal_resolve_name) internal_resolve_name: returning 2 addresses: 192.168.27.200:389 2001:0:9d38:90d7:2010:2fdb:3f57:e437:389 [2016/02/28 20:47:47.911522, 8, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 2 DC's from auto lookup [2016/02/28 20:47:47.911536, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:47.911543, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up DC01.child.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:47.911553, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name DC01.child.domain.local#20 found. [2016/02/28 20:47:47.911577, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.911591, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 192.168.27.200 [2016/02/28 20:47:47.911602, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 192.168.27.200 [2016/02/28 20:47:47.911613, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 2001:0:9d38:90d7:2010:2fdb:3f57:e437 [2016/02/28 20:47:47.911630, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.911639, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 2 ip addresses in an ordered list [2016/02/28 20:47:47.911646, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.27.200:389 2001:0:9d38:90d7:2010:2fdb:3f57:e437:389 [2016/02/28 20:47:47.911661, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 192.168.27.200 [2016/02/28 20:47:47.911669, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:253(ads_try_connect) ads_try_connect: sending CLDAP request to 192.168.27.200 (realm: child.domain.local) [2016/02/28 20:47:47.912200, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0000f1fd (61949) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : a33c6725-bd2a-462b-828b-583a97175a8e forest : 'domain.local' dns_domain : 'child.domain.local' pdc_dns_name : 'DC01.child.domain.local' domain_name : 'CHILD' pdc_name : 'DC01' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2016/02/28 20:47:47.912369, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [CHILD], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:47.912385, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD, we already got it [2016/02/28 20:47:47.912402, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [child.domain.local], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:47.912413, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:47.912424, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:751(ads_connect) Successfully contacted LDAP server 192.168.27.200 [2016/02/28 20:47:47.912435, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:47.912448, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:151(ads_dc_name) ads_dc_name: using server='DC01.CHILD.DOMAIN.LOCAL' IP=192.168.27.200 [2016/02/28 20:47:47.912456, 6, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:485(ads_find_dc) ads_find_dc: (ldap) looking for realm 'child.domain.local' and falling back to domain '' [2016/02/28 20:47:47.912467, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:47.912475, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:77(ads_dc_name) ads_dc_name: domain= [2016/02/28 20:47:47.912484, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:47.912491, 6, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:408(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'child.domain.local' [2016/02/28 20:47:47.912498, 8, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3346(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name child.domain.local (sitename Default-First-Site-Name) [2016/02/28 20:47:47.912511, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:213(saf_fetch) saf_fetch: Returning "DC01.child.domain.local" for "child.domain.local" domain [2016/02/28 20:47:47.912521, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3151(get_dc_list) get_dc_list: preferred server list: "DC01.child.domain.local, *" [2016/02/28 20:47:47.912530, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up child.domain.local#1c (sitename Default-First-Site-Name) [2016/02/28 20:47:47.912540, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name child.domain.local#1C found. [2016/02/28 20:47:47.912573, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.912582, 8, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3173(get_dc_list) Adding 2 DC's from auto lookup [2016/02/28 20:47:47.912595, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for CHILD2.DOMAIN.LOCAL: "Default-First-Site-Name" [2016/02/28 20:47:47.912602, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:2644(internal_resolve_name) internal_resolve_name: looking up DC01.child.domain.local#20 (sitename Default-First-Site-Name) [2016/02/28 20:47:47.912612, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namecache.c:165(namecache_fetch) name DC01.child.domain.local#20 found. [2016/02/28 20:47:47.912636, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.912650, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 192.168.27.200 [2016/02/28 20:47:47.912662, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 192.168.27.200 [2016/02/28 20:47:47.912673, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 2001:0:9d38:90d7:2010:2fdb:3f57:e437 [2016/02/28 20:47:47.912681, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:1141(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2016/02/28 20:47:47.912689, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3296(get_dc_list) get_dc_list: returning 2 ip addresses in an ordered list [2016/02/28 20:47:47.912696, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:3297(get_dc_list) get_dc_list: 192.168.27.200:389 2001:0:9d38:90d7:2010:2fdb:3f57:e437:389 [2016/02/28 20:47:47.912709, 9, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/conncache.c:150(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain child.domain.local server 192.168.27.200 [2016/02/28 20:47:47.912717, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:253(ads_try_connect) ads_try_connect: sending CLDAP request to 192.168.27.200 (realm: child.domain.local) [2016/02/28 20:47:47.913172, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0000f1fd (61949) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : a33c6725-bd2a-462b-828b-583a97175a8e forest : 'domain.local' dns_domain : 'child.domain.local' pdc_dns_name : 'DC01.child.domain.local' domain_name : 'CHILD' pdc_name : 'DC01' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2016/02/28 20:47:47.913347, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [CHILD], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:47.913364, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD, we already got it [2016/02/28 20:47:47.913373, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [child.domain.local], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:47.913383, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:47.913393, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:751(ads_connect) Successfully contacted LDAP server 192.168.27.200 [2016/02/28 20:47:47.913404, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:105(sitename_fetch) sitename_fetch: Returning sitename for child.domain.local: "Default-First-Site-Name" [2016/02/28 20:47:47.913416, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery_dc.c:151(ads_dc_name) ads_dc_name: using server='DC01.CHILD.DOMAIN.LOCAL' IP=192.168.27.200 [2016/02/28 20:47:47.913424, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:253(ads_try_connect) ads_try_connect: sending CLDAP request to 192.168.27.200 (realm: child.domain.local) [2016/02/28 20:47:47.913866, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0000f1fd (61949) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : a33c6725-bd2a-462b-828b-583a97175a8e forest : 'domain.local' dns_domain : 'child.domain.local' pdc_dns_name : 'DC01.child.domain.local' domain_name : 'CHILD' pdc_name : 'DC01' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2016/02/28 20:47:47.914028, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [CHILD], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:47.914044, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD, we already got it [2016/02/28 20:47:47.914052, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sitename_cache.c:70(sitename_store) sitename_store: realm = [child.domain.local], sitename = [Default-First-Site-Name], expire = [2085923199] [2016/02/28 20:47:47.914062, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for AD_SITENAME/DOMAIN/CHILD.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:47.914072, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:751(ads_connect) Successfully contacted LDAP server 192.168.27.200 [2016/02/28 20:47:47.914081, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:72(ldap_open_with_timeout) Opening connection to LDAP server '192.168.27.200:389', timeout 15 seconds [2016/02/28 20:47:47.914753, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:107(ldap_open_with_timeout) Initialized connection for LDAP server 'ldap://192.168.27.200:389' [2016/02/28 20:47:47.914770, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:794(ads_connect) Connected to LDAP server DC01.child.domain.local [2016/02/28 20:47:47.914778, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:211(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2016/02/28 20:47:47.914789, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [CHILD], server = [DC01.child.domain.local], expire = [1456771667] [2016/02/28 20:47:47.914802, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD, we already got it [2016/02/28 20:47:47.914811, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/namequery.c:88(saf_store) saf_store: domain = [child.domain.local], server = [DC01.child.domain.local], expire = [1456771667] [2016/02/28 20:47:47.914820, 10, pid=29728, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:302(gencache_set_data_blob) Did not store value for SAF/DOMAIN/CHILD.DOMAIN.LOCAL, we already got it [2016/02/28 20:47:47.916155, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap.c:3332(ads_current_time) KDC time offset is 28 seconds [2016/02/28 20:47:47.916479, 4, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:1336(ads_sasl_bind) Found SASL mechanism GSS-SPNEGO [2016/02/28 20:47:47.917051, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.30 [2016/02/28 20:47:47.917067, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2 [2016/02/28 20:47:47.917075, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2 [2016/02/28 20:47:47.917082, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2.3 [2016/02/28 20:47:47.917098, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:987(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10 [2016/02/28 20:47:47.917108, 3, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:996(ads_sasl_spnego_bind) ads_sasl_spnego_bind: got server principal name = not_defined_in_RFC4178@please_ignore [2016/02/28 20:47:47.917408, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:1017(ads_sasl_spnego_bind) ads_sasl_spnego_krb5_bind failed with: Miscellaneous failure (see text) : Did not find a plugin for ccache_ops, calling kinit [2016/02/28 20:47:47.917462, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/kerberos.c:217(kerberos_kinit_password_ext) kerberos_kinit_password: as URI-VGW-4$@CHILD2.DOMAIN.LOCAL using [MEMORY:winbind_ccache] as ccache and config [(null)] [2016/02/28 20:47:48.178984, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/sasl.c:665(ads_sasl_spnego_gsskrb5_bind) context (service ticket) valid for 36026 seconds [2016/02/28 20:47:48.179628, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap_utils.c:81(ads_do_search_retry_internal) Search for (objectclass=*) in <> gave 1 replies [2016/02/28 20:47:48.179690, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:500(wcache_store_seqnum) wcache_store_seqnum: success [CHILD][348775 @ 1456685268] [2016/02/28 20:47:48.179704, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD seq number is now 348775 [2016/02/28 20:47:48.179720, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:2375(query_user) query_user: [Cached] - doing backend query for info for domain CHILD [2016/02/28 20:47:48.179730, 3, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:623(query_user) ads: query_user [2016/02/28 20:47:48.179746, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/libsmb/samlogon_cache.c:227(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3518453233-2884963923-3703870538-1147] [2016/02/28 20:47:48.179761, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4772(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Searching for domain CHILD [2016/02/28 20:47:48.179783, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4787(wcache_tdc_fetch_domain) wcache_tdc_fetch_domain: Found domain CHILD [2016/02/28 20:47:48.179793, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:229(ads_cached_connection) ads_cached_connection [2016/02/28 20:47:48.179801, 7, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:61(ads_cached_connection_reuse) Current tickets expire in 36026 seconds (at 1456721294, time is now 1456685268) [2016/02/28 20:47:48.181172, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/libads/ldap_utils.c:81(ads_do_search_retry_internal) Search for (objectSid=\01\05\00\00\00\00\00\05\15\00\00\00\F1U\B7\D1S\0E\F5\ABJ\94\C4\DC{\04\00\00) in gave 1 replies [2016/02/28 20:47:48.181222, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD time ok [2016/02/28 20:47:48.181231, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD seq number is now 348775 [2016/02/28 20:47:48.181245, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/winbindd/nss_info.c:318(nss_get_info) nss_get_info called for sid [S-1-5-21-3518453233-2884963923-3703870538-1147] in domain 'CHILD' [2016/02/28 20:47:48.181278, 5, pid=29728, effective(0, 0), real(0, 0)] ../source3/winbindd/nss_info.c:80(smb_register_idmap_nss) smb_register_idmap_nss: Successfully added idmap nss backend 'template' [2016/02/28 20:47:48.181291, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/winbindd/nss_info.c:191(nss_init) parsed backend = 'template', domain = '(null)' [2016/02/28 20:47:48.181300, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/winbindd/nss_info.c:231(nss_init) nss_init: using 'template' as default backend. [2016/02/28 20:47:48.181307, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/winbindd/nss_info.c:147(nss_domain_list_add_domain) Added domain '(null)' with backend 'template' to nss_domain_list. [2016/02/28 20:47:48.181315, 10, pid=29728, effective(0, 0), real(0, 0)] ../source3/winbindd/nss_info.c:147(nss_domain_list_add_domain) Added domain 'CHILD' with backend 'template' to nss_domain_list. [2016/02/28 20:47:48.181323, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4922(nss_get_info_cached) nss_get_info returned NT_STATUS_OK [2016/02/28 20:47:48.181331, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4925(nss_get_info_cached) result: homedir = '/home/%D/%U' shell = '/bin/false' gecos = '(null)' gid = '4294967295' [2016/02/28 20:47:48.181367, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:4878(wcache_save_user_pwinfo) wcache_save_user_pwinfo: S-1-5-21-3518453233-2884963923-3703870538-1147 [2016/02/28 20:47:48.181377, 3, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_ads.c:759(query_user) ads query_user gave childuser1 [2016/02/28 20:47:48.181387, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD time ok [2016/02/28 20:47:48.181394, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD seq number is now 348775 [2016/02/28 20:47:48.181414, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1023(wcache_save_user) wcache_save_user: S-1-5-21-3518453233-2884963923-3703870538-1147 (acct_name childuser1) [2016/02/28 20:47:48.181426, 1, pid=29728, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_QueryUser: struct wbint_QueryUser out: struct wbint_QueryUser info : * info: struct wbint_userinfo acct_name : * acct_name : 'childuser1' full_name : * full_name : 'Child User1' homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' primary_gid : 0x00000000ffffffff (4294967295) user_sid : S-1-5-21-3518453233-2884963923-3703870538-1147 group_sid : S-1-5-21-3518453233-2884963923-3703870538-513 result : NT_STATUS_OK [2016/02/28 20:47:48.181507, 4, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.181516, 10, pid=29728, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3676 bytes to parent [2016/02/28 20:47:48.181617, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_QueryUser: struct wbint_QueryUser out: struct wbint_QueryUser info : * info: struct wbint_userinfo acct_name : * acct_name : 'childuser1' full_name : * full_name : 'Child User1' homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' primary_gid : 0x00000000ffffffff (4294967295) user_sid : S-1-5-21-3518453233-2884963923-3703870538-1147 group_sid : S-1-5-21-3518453233-2884963923-3703870538-513 result : NT_STATUS_OK [2016/02/28 20:47:48.181713, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 0: S-1-5-21-3518453233-2884963923-3703870538-1147 [2016/02/28 20:47:48.181745, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-5-21-3518453233-2884963923-3703870538-1147) [2016/02/28 20:47:48.181756, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1024(find_lookup_domain_from_sid) calling find_our_domain [2016/02/28 20:47:48.181769, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSids: struct wbint_LookupSids in: struct wbint_LookupSids sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-1147 [2016/02/28 20:47:48.181857, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:48.181876, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.181884, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.181892, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSIDS (CHILD2) [2016/02/28 20:47:48.181908, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSids: struct wbint_LookupSids in: struct wbint_LookupSids sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-1147 [2016/02/28 20:47:48.181952, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:48.181976, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-1147 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:48.182065, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000017 (23) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:48.182158, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:48.182210, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:48.182221, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 168 [2016/02/28 20:47:48.184032, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 232 [2016/02/28 20:47:48.184065, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00f8 (248) auth_length : 0x0038 (56) call_id : 0x00000017 (23) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000009c (156) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=224 [0000] DE A7 DE 88 D3 61 46 88 96 C6 8E 5B A6 48 85 FB .....aF. ...[.H.. [0010] 58 E9 1F 5A E5 45 F7 F4 EB AF AE D7 3D 17 E1 AE X..Z.E.. ....=... [0020] 44 C0 12 0E BE 28 F1 4C 42 0F 37 27 B6 20 EE 40 D....(.L B.7'. .@ [0030] 13 A2 60 E7 25 C0 87 0D E9 8D 9A AC AF E5 90 21 ..`.%... .......! [0040] CC BC 1B 29 8F F6 EA D8 AD 62 19 24 DD 5D 4E B6 ...).... .b.$.]N. [0050] 46 FD 2B 9F 1E E9 69 2F 93 41 61 23 7F F3 D8 1B F.+...i/ .Aa#.... [0060] 67 80 72 8F 0E A6 1A A0 59 81 B7 0D 19 45 D4 74 g.r..... Y....E.t [0070] 10 7B 85 F2 4D A8 4C 6C 4C 2E CD 63 54 9D 5A D1 .{..M.Ll L..cT.Z. [0080] B3 51 06 79 E0 0B 4F 77 F0 F3 D9 2A 86 7F 9D C7 .Q.y..Ow ...*.... [0090] 29 9D 0A D4 F4 A4 C5 A4 03 5F A9 A8 2C 9F FB 0D )....... ._..,... [00A0] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00B0] 07 45 0B 7B 04 15 72 43 B9 DD C2 BA C8 FF CB 75 .E.{..rC .......u [00C0] 8D 99 4E 07 01 A9 E1 3B CD CA DF 3D 73 A5 6E EC ..N....; ...=s.n. [00D0] 10 06 0A 00 01 00 00 00 05 04 06 FF 00 10 00 1C ........ ........ [2016/02/28 20:47:48.184413, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:48.184425, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 4 [2016/02/28 20:47:48.184433, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:48.184470, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 248, data_len 156, ss_len 4 [2016/02/28 20:47:48.184479, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 248 at offset 0: NT_STATUS_OK [2016/02/28 20:47:48.184487, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 156 bytes. [2016/02/28 20:47:48.184509, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'childuser1' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:48.184641, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSids: struct wbint_LookupSids out: struct wbint_LookupSids domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'childuser1' sid_index : 0x00000000 (0) result : NT_STATUS_OK [2016/02/28 20:47:48.184755, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.184765, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3640 bytes to parent [2016/02/28 20:47:48.184831, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSids: struct wbint_LookupSids out: struct wbint_LookupSids domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'childuser1' sid_index : 0x00000000 (0) result : NT_STATUS_OK [2016/02/28 20:47:48.184960, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs in: struct wbint_Sids2UnixIDs domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) ids : * ids: struct wbint_TransIDArray num_ids : 0x00000001 (1) ids: ARRAY(1) ids: struct wbint_TransID type : ID_TYPE_UID (1) domain_index : 0x00000000 (0) rid : 0x0000047b (1147) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_UID (1) [2016/02/28 20:47:48.185098, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 106 extra bytes [2016/02/28 20:47:48.185118, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.185127, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.185134, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_SIDS2UNIXIDS (no domain) [2016/02/28 20:47:48.185160, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs in: struct wbint_Sids2UnixIDs domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) ids : * ids: struct wbint_TransIDArray num_ids : 0x00000001 (1) ids: ARRAY(1) ids: struct wbint_TransID type : ID_TYPE_UID (1) domain_index : 0x00000000 (0) rid : 0x0000047b (1147) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_UID (1) [2016/02/28 20:47:48.185265, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:424(idmap_find_domain) idmap_find_domain called for domain 'CHILD' [2016/02/28 20:47:48.185278, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_srv.c:198(_wbint_Sids2UnixIDs) sids_to_unixids returned NT_STATUS_OK [2016/02/28 20:47:48.185287, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs out: struct wbint_Sids2UnixIDs ids : * ids: struct wbint_TransIDArray num_ids : 0x00000001 (1) ids: ARRAY(1) ids: struct wbint_TransID type : ID_TYPE_UID (1) domain_index : 0x00000000 (0) rid : 0x0000047b (1147) xid: struct unixid id : 0x00989afb (10001147) type : ID_TYPE_BOTH (3) result : NT_STATUS_OK [2016/02/28 20:47:48.185353, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.185364, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3528 bytes to parent [2016/02/28 20:47:48.185400, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs out: struct wbint_Sids2UnixIDs ids : * ids: struct wbint_TransIDArray num_ids : 0x00000001 (1) ids: ARRAY(1) ids: struct wbint_TransID type : ID_TYPE_UID (1) domain_index : 0x00000000 (0) rid : 0x0000047b (1147) xid: struct unixid id : 0x00989afb (10001147) type : ID_TYPE_BOTH (3) result : NT_STATUS_OK [2016/02/28 20:47:48.185478, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3518453233-2884963923-3703870538-1147] and timeout=[Sun Mar 6 20:47:48 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:48.185525, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/UID2SID/10001147] and timeout=[Sun Mar 6 20:47:48 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:48.185548, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/GID2SID/10001147] and timeout=[Sun Mar 6 20:47:48 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:48.185570, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-5-21-3518453233-2884963923-3703870538-513) [2016/02/28 20:47:48.185582, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1024(find_lookup_domain_from_sid) calling find_our_domain [2016/02/28 20:47:48.185593, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-513 [2016/02/28 20:47:48.185643, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 28 extra bytes [2016/02/28 20:47:48.185657, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.185664, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.185671, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSID (CHILD2) [2016/02/28 20:47:48.185682, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-513 [2016/02/28 20:47:48.185706, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.185713, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.185725, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1988(sid_to_name) sid_to_name: [Cached] - doing backend query for name for domain CHILD2 [2016/02/28 20:47:48.185734, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:303(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3518453233-2884963923-3703870538-513 for domain CHILD2 [2016/02/28 20:47:48.185743, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:48.185762, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:410(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2016/02/28 20:47:48.185778, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-513 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:48.185851, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000018 (24) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:48.185941, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:48.185987, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:48.185997, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 168 [2016/02/28 20:47:48.187511, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 232 [2016/02/28 20:47:48.187552, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00f8 (248) auth_length : 0x0038 (56) call_id : 0x00000018 (24) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a0 (160) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=224 [0000] 64 0D A0 06 7B A3 C0 EC 39 1C A6 35 0A EA 20 CA d...{... 9..5.. . [0010] DB B5 81 85 63 20 B6 D6 9F 5C BA 79 23 86 77 93 ....c .. .\.y#.w. [0020] 20 D1 73 39 71 89 B4 BD B9 47 13 E4 C0 97 41 A9 .s9q... .G....A. [0030] 18 A8 73 28 FF 6F 13 4E F6 BB 64 F8 76 AE 27 1D ..s(.o.N ..d.v.'. [0040] AC 4F 54 22 65 CE B1 B9 1B D2 3F E3 DA 96 44 5D .OT"e... ..?...D] [0050] 79 C8 90 00 B4 E7 5B 22 A8 2D 70 2D 68 60 13 DA y.....[" .-p-h`.. [0060] B9 B0 63 22 77 1B 01 24 B1 AC 6B 00 FC 9C 91 E2 ..c"w..$ ..k..... [0070] BE 76 D1 80 72 4E A3 3E 3B D1 BD 9C 71 10 39 E9 .v..rN.> ;...q.9. [0080] 17 07 DE 40 C7 3F 95 D6 B5 43 AD 59 B0 F4 49 08 ...@.?.. .C.Y..I. [0090] 59 45 DC FA 94 D6 75 1F C6 F6 EE 5B 41 80 B6 B5 YE....u. ...[A... [00A0] 44 06 00 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00B0] 78 2B 25 6A 48 31 B7 AE F8 B0 DC 06 B0 FD A2 5D x+%jH1.. .......] [00C0] 3F 7E 27 46 75 96 F2 E1 29 E6 9E E0 9B 41 86 0D ?~'Fu... )....A.. [00D0] 10 06 0C 00 01 00 00 00 05 04 06 FF 00 10 00 1C ........ ........ [2016/02/28 20:47:48.187878, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:48.187887, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 0 [2016/02/28 20:47:48.187894, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:48.187931, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 248, data_len 160, ss_len 0 [2016/02/28 20:47:48.187939, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 248 at offset 0: NT_STATUS_OK [2016/02/28 20:47:48.187947, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 160 bytes. [2016/02/28 20:47:48.187966, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_DOM_GRP (2) name: struct lsa_String length : 0x0018 (24) size : 0x0018 (24) string : * string : 'Domain Users' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:48.188096, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:253(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2016/02/28 20:47:48.188107, 5, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:323(msrpc_sid_to_name) Mapped sid to [CHILD]\[Domain Users] [2016/02/28 20:47:48.188117, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.188124, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.188148, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-5-21-3518453233-2884963923-3703870538-513 -> CHILD\Domain Users (NT_STATUS_OK) [2016/02/28 20:47:48.188160, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_DOM_GRP (2) domain : * domain : * domain : 'CHILD' name : * name : * name : 'Domain Users' result : NT_STATUS_OK [2016/02/28 20:47:48.188202, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.188210, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3560 bytes to parent [2016/02/28 20:47:48.188269, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_DOM_GRP (2) domain : * domain : * domain : 'CHILD' name : * name : * name : 'Domain Users' result : NT_STATUS_OK [2016/02/28 20:47:48.188318, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 0: S-1-5-21-3518453233-2884963923-3703870538-513 [2016/02/28 20:47:48.188351, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-5-21-3518453233-2884963923-3703870538-513) [2016/02/28 20:47:48.188363, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1024(find_lookup_domain_from_sid) calling find_our_domain [2016/02/28 20:47:48.188374, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSids: struct wbint_LookupSids in: struct wbint_LookupSids sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-513 [2016/02/28 20:47:48.188444, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:48.188459, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.188466, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.188473, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSIDS (CHILD2) [2016/02/28 20:47:48.188485, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSids: struct wbint_LookupSids in: struct wbint_LookupSids sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-513 [2016/02/28 20:47:48.188522, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:48.188538, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-513 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:48.188616, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000019 (25) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:48.188706, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:48.188752, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:48.188761, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 168 [2016/02/28 20:47:48.190342, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 232 [2016/02/28 20:47:48.190374, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00f8 (248) auth_length : 0x0038 (56) call_id : 0x00000019 (25) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a0 (160) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=224 [0000] C3 25 E7 AC 44 8F 81 8A 38 31 1F AD 04 AD EE 8F .%..D... 81...... [0010] C5 6C A3 4A 57 8E EE 8C 4C BC 18 FE 29 9E 6B E2 .l.JW... L...).k. [0020] 7A 7E E8 0C 09 6D 4E E7 85 82 FE 12 75 DE FA C6 z~...mN. ....u... [0030] 8D E6 BF 0E 14 61 DE 75 55 19 BB D3 8F 6F 9F 5E .....a.u U....o.^ [0040] 1F A9 F4 5A F8 BA E8 D5 A4 0E 5F CD 2B A1 82 0E ...Z.... .._.+... [0050] A0 B3 8E B3 54 27 7B B2 9F A2 04 9E 97 CF F0 FB ....T'{. ........ [0060] 3A 0E 68 38 8F AE 75 D2 EF C7 4C 19 6A 4A 83 C7 :.h8..u. ..L.jJ.. [0070] B4 52 75 6E BD 7D 77 22 52 28 BE D1 39 3C FF 58 .Run.}w" R(..9<.X [0080] E1 BC D1 BF B8 1B AD AD 8A 12 0F 29 BE C4 36 7B ........ ...)..6{ [0090] 76 5E E0 B6 E0 09 BE 87 A0 66 CC A6 87 FD AF 01 v^...... .f...... [00A0] 44 06 00 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00B0] 21 E7 15 C5 2C 01 B2 81 C5 2D D1 FD 01 67 32 68 !...,... .-...g2h [00C0] 28 11 BA 12 3E C4 DA B9 A1 74 D1 5A 38 D2 E2 75 (...>... .t.Z8..u [00D0] 10 06 0C 00 01 00 00 00 05 04 06 FF 00 10 00 1C ........ ........ [2016/02/28 20:47:48.190710, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:48.190720, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 0 [2016/02/28 20:47:48.190727, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:48.190764, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 248, data_len 160, ss_len 0 [2016/02/28 20:47:48.190773, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 248 at offset 0: NT_STATUS_OK [2016/02/28 20:47:48.190780, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 160 bytes. [2016/02/28 20:47:48.190800, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_DOM_GRP (2) name: struct lsa_String length : 0x0018 (24) size : 0x0018 (24) string : * string : 'Domain Users' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:48.190928, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSids: struct wbint_LookupSids out: struct wbint_LookupSids domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName sid_type : SID_NAME_DOM_GRP (2) name: struct lsa_String length : 0x0018 (24) size : 0x0018 (24) string : * string : 'Domain Users' sid_index : 0x00000000 (0) result : NT_STATUS_OK [2016/02/28 20:47:48.191038, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.191046, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3644 bytes to parent [2016/02/28 20:47:48.191100, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSids: struct wbint_LookupSids out: struct wbint_LookupSids domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName sid_type : SID_NAME_DOM_GRP (2) name: struct lsa_String length : 0x0018 (24) size : 0x0018 (24) string : * string : 'Domain Users' sid_index : 0x00000000 (0) result : NT_STATUS_OK [2016/02/28 20:47:48.191225, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs in: struct wbint_Sids2UnixIDs domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) ids : * ids: struct wbint_TransIDArray num_ids : 0x00000001 (1) ids: ARRAY(1) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000000 (0) rid : 0x00000201 (513) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) [2016/02/28 20:47:48.191355, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 106 extra bytes [2016/02/28 20:47:48.191371, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.191379, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.191386, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_SIDS2UNIXIDS (no domain) [2016/02/28 20:47:48.191400, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs in: struct wbint_Sids2UnixIDs domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000a (10) size : 0x000c (12) string : * string : 'CHILD' sid : * sid : S-1-5-21-3518453233-2884963923-3703870538 max_size : 0x00000020 (32) ids : * ids: struct wbint_TransIDArray num_ids : 0x00000001 (1) ids: ARRAY(1) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000000 (0) rid : 0x00000201 (513) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) [2016/02/28 20:47:48.191502, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:424(idmap_find_domain) idmap_find_domain called for domain 'CHILD' [2016/02/28 20:47:48.191513, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_srv.c:198(_wbint_Sids2UnixIDs) sids_to_unixids returned NT_STATUS_OK [2016/02/28 20:47:48.191522, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs out: struct wbint_Sids2UnixIDs ids : * ids: struct wbint_TransIDArray num_ids : 0x00000001 (1) ids: ARRAY(1) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000000 (0) rid : 0x00000201 (513) xid: struct unixid id : 0x00989881 (10000513) type : ID_TYPE_BOTH (3) result : NT_STATUS_OK [2016/02/28 20:47:48.191572, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.191580, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3528 bytes to parent [2016/02/28 20:47:48.191616, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs out: struct wbint_Sids2UnixIDs ids : * ids: struct wbint_TransIDArray num_ids : 0x00000001 (1) ids: ARRAY(1) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000000 (0) rid : 0x00000201 (513) xid: struct unixid id : 0x00989881 (10000513) type : ID_TYPE_BOTH (3) result : NT_STATUS_OK [2016/02/28 20:47:48.191692, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3518453233-2884963923-3703870538-513] and timeout=[Sun Mar 6 20:47:48 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:48.191722, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/UID2SID/10000513] and timeout=[Sun Mar 6 20:47:48 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:48.191743, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/GID2SID/10000513] and timeout=[Sun Mar 6 20:47:48 2016 IST] (604800 seconds ahead) [2016/02/28 20:47:48.191791, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:GETPWNAM]: NT_STATUS_OK [2016/02/28 20:47:48.194350, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:GETPWNAM]: delivered response to client [2016/02/28 20:47:48.195267, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:PING [2016/02/28 20:47:48.195286, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:PING]: NT_STATUS_OK [2016/02/28 20:47:48.195303, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:PING]: delivered response to client [2016/02/28 20:47:48.195474, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:GETPWUID [2016/02/28 20:47:48.195490, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_getpwuid.c:47(winbindd_getpwuid_send) getpwuid 10001147 [2016/02/28 20:47:48.195507, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_uid2sid.c:52(wb_uid2sid_send) idmap_cache_find_uid2sid found 10001147 [2016/02/28 20:47:48.195527, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_QueryUser: struct wbint_QueryUser in: struct wbint_QueryUser sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-1147 [2016/02/28 20:47:48.195571, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_QueryUser: struct wbint_QueryUser out: struct wbint_QueryUser info : * info: struct wbint_userinfo acct_name : * acct_name : 'childuser1' full_name : * full_name : 'Child User1' homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' primary_gid : 0x00000000ffffffff (4294967295) user_sid : S-1-5-21-3518453233-2884963923-3703870538-1147 group_sid : S-1-5-21-3518453233-2884963923-3703870538-513 result : NT_STATUS_OK [2016/02/28 20:47:48.195644, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 0: S-1-5-21-3518453233-2884963923-3703870538-1147 [2016/02/28 20:47:48.195662, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/idmap_cache.c:56(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3518453233-2884963923-3703870538-1147]: value=[10001147:B] [2016/02/28 20:47:48.195672, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/idmap_cache.c:75(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3518453233-2884963923-3703870538-1147]: id=[10001147], endptr=[:B] [2016/02/28 20:47:48.195684, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-5-21-3518453233-2884963923-3703870538-513) [2016/02/28 20:47:48.195695, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1024(find_lookup_domain_from_sid) calling find_our_domain [2016/02/28 20:47:48.195705, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3518453233-2884963923-3703870538-513 [2016/02/28 20:47:48.195740, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_DOM_GRP (2) domain : * domain : * domain : 'CHILD' name : * name : * name : 'Domain Users' result : NT_STATUS_OK [2016/02/28 20:47:48.195782, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 0: S-1-5-21-3518453233-2884963923-3703870538-513 [2016/02/28 20:47:48.195797, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/idmap_cache.c:56(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3518453233-2884963923-3703870538-513]: value=[10000513:B] [2016/02/28 20:47:48.195805, 10, pid=29680, effective(0, 0), real(0, 0)] ../source3/lib/idmap_cache.c:75(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3518453233-2884963923-3703870538-513]: id=[10000513], endptr=[:B] [2016/02/28 20:47:48.195830, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:GETPWUID]: NT_STATUS_OK [2016/02/28 20:47:48.195852, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:GETPWUID]: delivered response to client [2016/02/28 20:47:48.196120, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:PING [2016/02/28 20:47:48.196136, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:PING]: NT_STATUS_OK [2016/02/28 20:47:48.196151, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:PING]: delivered response to client [2016/02/28 20:47:48.196242, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:ALLOCATE_GID [2016/02/28 20:47:48.196254, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_allocate_gid.c:45(winbindd_allocate_gid_send) allocate_gid [2016/02/28 20:47:48.196274, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_AllocateGid: struct wbint_AllocateGid in: struct wbint_AllocateGid [2016/02/28 20:47:48.196308, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.196320, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.196327, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_ALLOCATEGID (no domain) [2016/02/28 20:47:48.196349, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_AllocateGid: struct wbint_AllocateGid in: struct wbint_AllocateGid [2016/02/28 20:47:48.196362, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:424(idmap_find_domain) idmap_find_domain called for domain 'NULL' [2016/02/28 20:47:48.196370, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_AllocateGid: struct wbint_AllocateGid out: struct wbint_AllocateGid gid : * gid : 0x0000000000000000 (0) result : NT_STATUS_NOT_IMPLEMENTED [2016/02/28 20:47:48.196394, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.196401, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3508 bytes to parent [2016/02/28 20:47:48.196430, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_AllocateGid: struct wbint_AllocateGid out: struct wbint_AllocateGid gid : * gid : 0x0000000000000000 (0) result : NT_STATUS_NOT_IMPLEMENTED [2016/02/28 20:47:48.196458, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_allocate_gid.c:83(winbindd_allocate_gid_recv) Could not allocate gid: NT_STATUS_NOT_IMPLEMENTED [2016/02/28 20:47:48.196467, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:ALLOCATE_GID]: NT_STATUS_NOT_IMPLEMENTED [2016/02/28 20:47:48.196483, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:ALLOCATE_GID]: delivered response to client [2016/02/28 20:47:48.196845, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:SIDS_TO_XIDS [2016/02/28 20:47:48.196859, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_sids_to_xids.c:50(winbindd_sids_to_xids_send) sids_to_xids [2016/02/28 20:47:48.196869, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_sids_to_xids.c:68(winbindd_sids_to_xids_send) num_sids: 2 [2016/02/28 20:47:48.196878, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 0: S-1-18-1 [2016/02/28 20:47:48.196894, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_sids2xids.c:106(wb_sids2xids_send) SID 1: S-1-5-11 [2016/02/28 20:47:48.196907, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_lookupsids.c:254(wb_lookupsids_bulk) No bulk setup for SID S-1-18-1 with 1 subauths [2016/02/28 20:47:48.196923, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/wb_lookupsids.c:254(wb_lookupsids_bulk) No bulk setup for SID S-1-5-11 with 1 subauths [2016/02/28 20:47:48.196933, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-18-1) [2016/02/28 20:47:48.196942, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1024(find_lookup_domain_from_sid) calling find_our_domain [2016/02/28 20:47:48.196953, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-18-1 [2016/02/28 20:47:48.197002, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 12 extra bytes [2016/02/28 20:47:48.197016, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.197024, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.197031, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSID (CHILD2) [2016/02/28 20:47:48.197041, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-18-1 [2016/02/28 20:47:48.197062, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.197070, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.197080, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1988(sid_to_name) sid_to_name: [Cached] - doing backend query for name for domain CHILD2 [2016/02/28 20:47:48.197088, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:303(msrpc_sid_to_name) msrpc_sid_to_name: S-1-18-1 for domain CHILD2 [2016/02/28 20:47:48.197096, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:48.197107, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:410(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2016/02/28 20:47:48.197121, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-18-1 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:48.197203, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001a (26) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000038 (56) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:48.197292, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:48.197349, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:48.197361, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 152 [2016/02/28 20:47:48.198924, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 168 [2016/02/28 20:47:48.198956, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00b8 (184) auth_length : 0x0038 (56) call_id : 0x0000001a (26) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000054 (84) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=160 [0000] E5 9D D5 CB 05 2D 69 6C 4C 35 EF 38 D9 CF 5D 19 .....-il L5.8..]. [0010] 4A 88 01 66 EB 99 20 D1 50 98 86 7D BB 0F 12 74 J..f.. . P..}...t [0020] 44 F7 7D AA 23 58 94 F7 5E CD FD 2F C8 EB 4B F1 D.}.#X.. ^../..K. [0030] 4B 37 F1 6A 05 D7 62 3C 18 2F E9 5D BE E1 9E 2F K7.j..b< ./.].../ [0040] 45 14 5D CD E8 00 F2 5F 4B 05 70 7B 01 86 40 28 E.]...._ K.p{..@( [0050] C7 9A D6 F7 2A 87 17 34 D7 4E 50 4C 6A 16 8D A8 ....*..4 .NPLj... [0060] 44 06 0C 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0070] CD F6 2E C9 D9 78 34 97 63 AC CC 51 91 49 F5 78 .....x4. c..Q.I.x [0080] 1D C1 1C 20 B3 BF BE C8 05 04 06 FF 00 10 00 1C ... .... ........ [0090] 00 00 00 00 7E 78 9F FE 0F 28 A9 99 03 BB 30 20 ....~x.. .(....0 [2016/02/28 20:47:48.199225, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:48.199235, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 12 [2016/02/28 20:47:48.199243, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:48.199271, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 184, data_len 84, ss_len 12 [2016/02/28 20:47:48.199280, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 184 at offset 0: NT_STATUS_OK [2016/02/28 20:47:48.199287, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 84 bytes. [2016/02/28 20:47:48.199305, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_UNKNOWN (8) name: struct lsa_String length : 0x0010 (16) size : 0x0012 (18) string : * string : 'S-1-18-1' sid_index : 0xffffffff (4294967295) unknown : 0x00000000 (0) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.199457, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:253(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_NONE_MAPPED', mapped count = 0' [2016/02/28 20:47:48.199480, 2, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:314(msrpc_sid_to_name) msrpc_sid_to_name: failed to lookup sids: STATUS_SOME_UNMAPPED [2016/02/28 20:47:48.199495, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.199503, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.199511, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USE_NONE (0) domain : * domain : NULL name : * name : NULL result : STATUS_SOME_UNMAPPED [2016/02/28 20:47:48.199547, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.199555, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.199600, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USE_NONE (0) domain : * domain : NULL name : * name : NULL result : STATUS_SOME_UNMAPPED [2016/02/28 20:47:48.199646, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1014(find_lookup_domain_from_sid) find_lookup_domain_from_sid(S-1-5-11) [2016/02/28 20:47:48.199657, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_util.c:1024(find_lookup_domain_from_sid) calling find_our_domain [2016/02/28 20:47:48.199667, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-11 [2016/02/28 20:47:48.199714, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 12 extra bytes [2016/02/28 20:47:48.199727, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.199734, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.199742, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSID (CHILD2) [2016/02/28 20:47:48.199751, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-11 [2016/02/28 20:47:48.199772, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.199787, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.199799, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1988(sid_to_name) sid_to_name: [Cached] - doing backend query for name for domain CHILD2 [2016/02/28 20:47:48.199807, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:303(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-11 for domain CHILD2 [2016/02/28 20:47:48.199815, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:48.199838, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:410(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2016/02/28 20:47:48.199855, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-11 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:48.199926, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001b (27) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000038 (56) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:48.200015, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:48.200067, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:48.200076, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 152 [2016/02/28 20:47:48.200645, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 248 [2016/02/28 20:47:48.200676, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x0000001b (27) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000ac (172) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=240 [0000] 55 CC 5A 0F 28 5A AB E7 13 50 C8 BD 68 08 74 C7 U.Z.(Z.. .P..h.t. [0010] A3 2F 05 8D 2C 37 13 89 CC 2E 9C E2 D0 B7 E8 73 ./..,7.. .......s [0020] 4B 09 4E 73 6E 92 32 49 C2 A4 66 1B A0 EE E1 03 K.Nsn.2I ..f..... [0030] B8 D5 E3 6A A6 9D 89 1B 28 6B 33 81 26 3F 71 60 ...j.... (k3.&?q` [0040] 8E CF 38 F4 44 69 18 03 0F EC 11 BB FF 42 3B 04 ..8.Di.. .....B;. [0050] 6A 9C 1C 46 E5 FF CE C2 CC D2 EB B8 1E 7F 04 F7 j..F.... ........ [0060] D6 19 A4 53 14 39 6C 7A E0 4D 1D 3A 1C BD 80 1F ...S.9lz .M.:.... [0070] F7 5F 00 F4 3D C8 38 9F B5 EB AC AA 26 A3 3F 5F ._..=.8. ....&.?_ [0080] 41 00 6B D3 83 09 3C AF 18 B7 ED BA 5F 29 45 47 A.k...<. ...._)EG [0090] CB 94 C5 E2 40 4B EB 9E FC 4F BD 84 9A C4 13 1C ....@K.. .O...... [00A0] DA 82 97 F1 9F A2 69 5B C2 1F E9 EF A8 7D 07 68 ......i[ .....}.h [00B0] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] 09 3A 8B C8 D0 30 AE 82 8F 19 46 E1 83 99 07 3B .:...0.. ..F....; [00D0] FE CF E9 B9 57 98 1C 7A 05 04 06 FF 00 10 00 1C ....W..z ........ [00E0] 00 00 00 00 7E 78 9F FD 73 32 6C F6 92 5A DC A9 ....~x.. s2l..Z.. [2016/02/28 20:47:48.201017, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:48.201025, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 4 [2016/02/28 20:47:48.201033, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:48.201071, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 172, ss_len 4 [2016/02/28 20:47:48.201088, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 264 at offset 0: NT_STATUS_OK [2016/02/28 20:47:48.201096, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 172 bytes. [2016/02/28 20:47:48.201115, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'NT AUTHORITY' sid : * sid : S-1-5 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_WKN_GRP (5) name: struct lsa_String length : 0x0026 (38) size : 0x0028 (40) string : * string : 'Authenticated Users' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:48.201236, 10, pid=29681, effective(0, 0), real(0, 0)] ../source3/rpc_client/cli_lsarpc.c:253(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2016/02/28 20:47:48.201247, 5, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:323(msrpc_sid_to_name) Mapped sid to [NT AUTHORITY]\[Authenticated Users] [2016/02/28 20:47:48.201257, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.201264, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.201284, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-5-11 -> NT AUTHORITY\Authenticated Users (NT_STATUS_OK) [2016/02/28 20:47:48.201294, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_WKN_GRP (5) domain : * domain : * domain : 'NT AUTHORITY' name : * name : * name : 'Authenticated Users' result : NT_STATUS_OK [2016/02/28 20:47:48.201354, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.201363, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3572 bytes to parent [2016/02/28 20:47:48.201410, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_WKN_GRP (5) domain : * domain : * domain : 'NT AUTHORITY' name : * name : * name : 'Authenticated Users' result : NT_STATUS_OK [2016/02/28 20:47:48.201464, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs in: struct wbint_Sids2UnixIDs domains : * domains: struct lsa_RefDomainList count : 0x00000002 (2) domains : * domains: ARRAY(2) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0000 (0) size : 0x0002 (2) string : * string : '' sid : * sid : S-1-18 domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'NT AUTHORITY' sid : * sid : S-1-5 max_size : 0x00000020 (32) ids : * ids: struct wbint_TransIDArray num_ids : 0x00000002 (2) ids: ARRAY(2) ids: struct wbint_TransID type : ID_TYPE_NOT_SPECIFIED (0) domain_index : 0x00000000 (0) rid : 0x00000001 (1) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000001 (1) rid : 0x0000000b (11) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) [2016/02/28 20:47:48.201643, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 158 extra bytes [2016/02/28 20:47:48.201658, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.201665, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.201672, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_SIDS2UNIXIDS (no domain) [2016/02/28 20:47:48.201689, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs in: struct wbint_Sids2UnixIDs domains : * domains: struct lsa_RefDomainList count : 0x00000002 (2) domains : * domains: ARRAY(2) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0000 (0) size : 0x0002 (2) string : * string : '' sid : * sid : S-1-18 domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0018 (24) size : 0x001a (26) string : * string : 'NT AUTHORITY' sid : * sid : S-1-5 max_size : 0x00000020 (32) ids : * ids: struct wbint_TransIDArray num_ids : 0x00000002 (2) ids: ARRAY(2) ids: struct wbint_TransID type : ID_TYPE_NOT_SPECIFIED (0) domain_index : 0x00000000 (0) rid : 0x00000001 (1) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000001 (1) rid : 0x0000000b (11) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_GID (2) [2016/02/28 20:47:48.201835, 10, pid=29690, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap.c:424(idmap_find_domain) idmap_find_domain called for domain '' [2016/02/28 20:47:48.201846, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_srv.c:198(_wbint_Sids2UnixIDs) sids_to_unixids returned NT_STATUS_OK [2016/02/28 20:47:48.201876, 10, pid=29690, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:1562(pdb_default_sid_to_id) Could not find map for sid S-1-5-11 [2016/02/28 20:47:48.201888, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_srv.c:198(_wbint_Sids2UnixIDs) sids_to_unixids returned NT_STATUS_OK [2016/02/28 20:47:48.201896, 1, pid=29690, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs out: struct wbint_Sids2UnixIDs ids : * ids: struct wbint_TransIDArray num_ids : 0x00000002 (2) ids: ARRAY(2) ids: struct wbint_TransID type : ID_TYPE_NOT_SPECIFIED (0) domain_index : 0x00000000 (0) rid : 0x00000001 (1) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000001 (1) rid : 0x0000000b (11) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) result : NT_STATUS_OK [2016/02/28 20:47:48.201969, 4, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.201977, 10, pid=29690, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3548 bytes to parent [2016/02/28 20:47:48.202009, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs out: struct wbint_Sids2UnixIDs ids : * ids: struct wbint_TransIDArray num_ids : 0x00000002 (2) ids: ARRAY(2) ids: struct wbint_TransID type : ID_TYPE_NOT_SPECIFIED (0) domain_index : 0x00000000 (0) rid : 0x00000001 (1) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) ids: struct wbint_TransID type : ID_TYPE_GID (2) domain_index : 0x00000001 (1) rid : 0x0000000b (11) xid: struct unixid id : 0xffffffff (4294967295) type : ID_TYPE_NOT_SPECIFIED (0) result : NT_STATUS_OK [2016/02/28 20:47:48.202095, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/SID2XID/S-1-18-1] and timeout=[Sun Feb 28 20:49:48 2016 IST] (120 seconds ahead) [2016/02/28 20:47:48.202124, 10, pid=29680, effective(0, 0), real(0, 0), class=tdb] ../source3/lib/gencache.c:323(gencache_set_data_blob) Adding cache entry with key=[IDMAP/SID2XID/S-1-5-11] and timeout=[Sun Feb 28 20:49:48 2016 IST] (120 seconds ahead) [2016/02/28 20:47:48.202158, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:SIDS_TO_XIDS]: NT_STATUS_OK [2016/02/28 20:47:48.202181, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:SIDS_TO_XIDS]: delivered response to client [2016/02/28 20:47:48.208648, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.208667, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname CHILD2\deny [2016/02/28 20:47:48.208685, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.208745, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 44 extra bytes [2016/02/28 20:47:48.208760, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.208768, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.208775, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (CHILD2) [2016/02/28 20:47:48.208787, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.208816, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.208824, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.208835, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain CHILD2 [2016/02/28 20:47:48.208844, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:253(msrpc_name_to_sid) msrpc_name_to_sid: name=CHILD2\DENY [2016/02/28 20:47:48.208851, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:267(msrpc_name_to_sid) name_to_sid [rpc] CHILD2\DENY for domain CHILD2 [2016/02/28 20:47:48.208858, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:48.208876, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames4: struct lsa_LookupNames4 in: struct lsa_LookupNames4 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0016 (22) size : 0x0016 (22) string : * string : 'CHILD2\DENY' sids : * sids: struct lsa_TransSidArray3 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:48.208954, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001c (28) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x004d (77) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:48.209044, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:48.209091, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:48.209100, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 168 [2016/02/28 20:47:48.209727, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 200 [2016/02/28 20:47:48.209759, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00d8 (216) auth_length : 0x0038 (56) call_id : 0x0000001c (28) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000078 (120) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=192 [0000] 05 21 A7 19 84 7D F1 0B 3D 39 A4 CF 87 40 72 B5 .!...}.. =9...@r. [0010] E6 2B C7 82 D0 C1 03 E7 AD C2 28 9F 1F 97 07 9B .+...... ..(..... [0020] 67 EB 16 6B 23 88 20 5F 0C C0 ED 55 87 FF 5D 28 g..k#. _ ...U..]( [0030] 74 22 DE 30 94 1F 29 EE 4F 0B 11 75 71 1A F3 F6 t".0..). O..uq... [0040] B7 61 7D A0 12 77 38 2B 73 E4 A7 C0 2E 09 1B EC .a}..w8+ s....... [0050] 99 20 1C 5C B5 06 7C C2 ED 71 FF F4 5A 39 1D 4B . .\..|. .q..Z9.K [0060] 0A BF 4A C4 DB 9A 48 C1 46 57 3D 31 1E 5B DA 8A ..J...H. FW=1.[.. [0070] 0B 4A C2 1F 7D FF 94 58 EB 5E 6B B9 CD 41 1B 53 .J..}..X .^k..A.S [0080] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0090] 8B 43 BF 69 7A 70 27 33 46 06 05 6F 0C E3 86 97 .C.izp'3 F..o.... [00A0] 63 78 20 2C 02 54 B0 5A C2 1F E9 EF A8 7D 07 68 cx ,.T.Z .....}.h [00B0] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [2016/02/28 20:47:48.210078, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:48.210089, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:47:48.210097, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:48.210129, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 216, data_len 120, ss_len 8 [2016/02/28 20:47:48.210138, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 216 at offset 0: NT_STATUS_OK [2016/02/28 20:47:48.210145, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 120 bytes. [2016/02/28 20:47:48.210165, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames4: struct lsa_LookupNames4 out: struct lsa_LookupNames4 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000c (12) size : 0x000e (14) string : * string : 'CHILD2' sid : * sid : S-1-5-21-733680754-3169875714-4083418759 max_size : 0x00000020 (32) sids : * sids: struct lsa_TransSidArray3 count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid3 sid_type : SID_NAME_UNKNOWN (8) sid : NULL sid_index : 0x00000000 (0) flags : 0x00000000 (0) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.210286, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.210296, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.210315, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: CHILD2\DENY -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.210330, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> CHILD2\deny (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.210351, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.210382, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.210390, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.210437, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.210473, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.210483, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.210503, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.210914, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.210929, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname Unix User\deny [2016/02/28 20:47:48.210946, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX USER' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.211014, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:48.211031, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.211039, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.211046, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:48.211060, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX USER' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.211091, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:48.211100, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:48.211144, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:48.211157, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:48.211167, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:48.211198, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:48.211222, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:48.211329, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:48.211356, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:48.211368, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:48.211378, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 09 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.211404, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000009-0000-0000-d356-d44008740000 result : NT_STATUS_OK [2016/02/28 20:47:48.211447, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: UNIX USER\DENY for domain UNIX USER [2016/02/28 20:47:48.211472, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000009-0000-0000-d356-d44008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001c (28) size : 0x001c (28) string : * string : 'UNIX USER\DENY' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:48.211539, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 09 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.211564, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name UNIX USER\DENY [2016/02/28 20:47:48.211573, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: UNIX USER\DENY => domain=[UNIX USER], name=[DENY] [2016/02/28 20:47:48.211589, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:48.211620, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:181(Get_Pwnam_alloc) Finding user DENY [2016/02/28 20:47:48.211631, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:120(Get_Pwnam_internals) Trying _Get_Pwnam(), username as lowercase is deny [2016/02/28 20:47:48.211663, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:159(Get_Pwnam_internals) Get_Pwnam_internals did find user [DENY]! [2016/02/28 20:47:48.211676, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:176(lookup_lsa_rids) init_lsa_rids: UNIX USER\DENY found [2016/02/28 20:47:48.211685, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'UNIX USER' sid : * sid : S-1-22-1 max_size : 0x00000020 (32) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_USER (1) rid : 0x00000006 (6) sid_index : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:48.211812, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000009-0000-0000-d356-d44008740000 [2016/02/28 20:47:48.211840, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 09 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.211865, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 09 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.211888, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:48.211895, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:48.211937, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:48.211954, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:48.211962, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:48.211990, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: UNIX USER\DENY -> S-1-22-1-6 (NT_STATUS_OK) [2016/02/28 20:47:48.212010, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-22-1-6 -> UNIX USER\deny (NT_STATUS_OK) [2016/02/28 20:47:48.212019, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USER (1) sid : * sid : S-1-22-1-6 result : NT_STATUS_OK [2016/02/28 20:47:48.212049, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.212056, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3520 bytes to parent [2016/02/28 20:47:48.212071, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1604(fork_domain_child) fork_domain_child: domain URI-VGW-4 no longer in 'startup' mode. [2016/02/28 20:47:48.212104, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USER (1) sid : * sid : S-1-22-1-6 result : NT_STATUS_OK [2016/02/28 20:47:48.212140, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_OK [2016/02/28 20:47:48.212159, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.212242, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.212255, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname CHILD2\Everyone [2016/02/28 20:47:48.212270, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.212350, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:48.212366, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.212373, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.212380, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (CHILD2) [2016/02/28 20:47:48.212392, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.212421, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.212428, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.212440, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain CHILD2 [2016/02/28 20:47:48.212448, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:253(msrpc_name_to_sid) msrpc_name_to_sid: name=CHILD2\EVERYONE [2016/02/28 20:47:48.212456, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:267(msrpc_name_to_sid) name_to_sid [rpc] CHILD2\EVERYONE for domain CHILD2 [2016/02/28 20:47:48.212462, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:48.212479, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames4: struct lsa_LookupNames4 in: struct lsa_LookupNames4 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001e (30) size : 0x001e (30) string : * string : 'CHILD2\EVERYONE' sids : * sids: struct lsa_TransSidArray3 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:48.212546, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001d (29) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000054 (84) context_id : 0x0000 (0) opnum : 0x004d (77) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:48.212643, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:48.212692, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:48.212701, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 184 [2016/02/28 20:47:48.213251, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 200 [2016/02/28 20:47:48.213283, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00d8 (216) auth_length : 0x0038 (56) call_id : 0x0000001d (29) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000078 (120) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=192 [0000] A8 C7 A9 74 7D 8D 38 98 9A C3 0A 01 7C 7B 09 51 ...t}.8. ....|{.Q [0010] FA 45 AB E2 B9 59 7C A0 90 07 98 EF 84 24 2B D4 .E...Y|. .....$+. [0020] F5 44 C4 33 E1 17 AB 40 59 E1 62 27 25 C9 8F F2 .D.3...@ Y.b'%... [0030] 5B 32 6B C3 D4 4D 34 CD A8 83 A2 4A E3 1D FD 01 [2k..M4. ...J.... [0040] FB 02 40 3B 02 1B 8A B4 38 8B C4 32 1F FA D6 0C ..@;.... 8..2.... [0050] 6B C8 4C 9C 00 49 79 CB D4 26 22 FC DE A2 4A 0C k.L..Iy. .&"...J. [0060] 44 31 34 E7 3E 84 86 21 4B 8D EF 56 09 CC E5 93 D14.>..! K..V.... [0070] 34 F8 12 53 36 64 EF 71 AA B7 BD C3 85 E5 BD E6 4..S6d.q ........ [0080] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0090] 0D FF 35 F3 85 A4 17 01 8D 15 96 BE 20 82 11 33 ..5..... .... ..3 [00A0] C0 AB 43 10 CB B1 B5 E6 C2 1F E9 EF A8 7D 07 68 ..C..... .....}.h [00B0] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [2016/02/28 20:47:48.213598, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:48.213608, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:47:48.213616, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:48.213649, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 216, data_len 120, ss_len 8 [2016/02/28 20:47:48.213657, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 216 at offset 0: NT_STATUS_OK [2016/02/28 20:47:48.213665, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 120 bytes. [2016/02/28 20:47:48.213684, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames4: struct lsa_LookupNames4 out: struct lsa_LookupNames4 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000c (12) size : 0x000e (14) string : * string : 'CHILD2' sid : * sid : S-1-5-21-733680754-3169875714-4083418759 max_size : 0x00000020 (32) sids : * sids: struct lsa_TransSidArray3 count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid3 sid_type : SID_NAME_UNKNOWN (8) sid : NULL sid_index : 0x00000000 (0) flags : 0x00000000 (0) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.213796, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.213805, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.213823, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: CHILD2\EVERYONE -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.213846, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> CHILD2\everyone (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.213855, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.213885, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.213893, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.213937, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.213974, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.213983, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.214003, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.214182, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.214196, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname Unix Group\Everyone [2016/02/28 20:47:48.214213, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.214265, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 52 extra bytes [2016/02/28 20:47:48.214278, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.214285, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.214292, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:48.214304, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.214355, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:48.214364, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:48.214399, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:48.214412, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:48.214420, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:48.214447, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:48.214468, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:48.214564, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:48.214576, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:48.214586, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:48.214596, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 0A 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.214630, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000a-0000-0000-d356-d44008740000 result : NT_STATUS_OK [2016/02/28 20:47:48.214671, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: UNIX GROUP\EVERYONE for domain UNIX GROUP [2016/02/28 20:47:48.214693, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000a-0000-0000-d356-d44008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0026 (38) size : 0x0026 (38) string : * string : 'UNIX GROUP\EVERYONE' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:48.214759, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0A 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.214784, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name UNIX GROUP\EVERYONE [2016/02/28 20:47:48.214792, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: UNIX GROUP\EVERYONE => domain=[UNIX GROUP], name=[EVERYONE] [2016/02/28 20:47:48.214799, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:48.215671, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:181(lookup_lsa_rids) init_lsa_rids: UNIX GROUP\EVERYONE not found [2016/02/28 20:47:48.215691, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.215784, 2, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:328(rpc_name_to_sid) name_to_sid: failed to lookup name: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.215804, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000a-0000-0000-d356-d44008740000 [2016/02/28 20:47:48.215831, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0A 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.215857, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0A 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.215880, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:48.215888, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:48.215921, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:48.215937, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:48.215945, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:48.215970, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: UNIX GROUP\EVERYONE -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.215992, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> UNIX GROUP\everyone (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.216003, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.216034, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.216043, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.216086, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.216123, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.216132, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.216151, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.216330, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.216359, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname CHILD2\deny [2016/02/28 20:47:48.216376, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.216421, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.216455, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.216465, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.216483, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.216865, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.216879, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname Unix User\deny [2016/02/28 20:47:48.216895, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX USER' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.216948, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:48.216969, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.216978, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.216985, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:48.216998, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX USER' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.217026, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:48.217034, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:48.217069, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:48.217081, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:48.217090, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:48.217117, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:48.217137, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:48.217242, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:48.217254, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:48.217263, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:48.217273, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 0B 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.217298, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000b-0000-0000-d356-d44008740000 result : NT_STATUS_OK [2016/02/28 20:47:48.217351, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: UNIX USER\DENY for domain UNIX USER [2016/02/28 20:47:48.217376, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000b-0000-0000-d356-d44008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001c (28) size : 0x001c (28) string : * string : 'UNIX USER\DENY' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:48.217442, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.217467, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name UNIX USER\DENY [2016/02/28 20:47:48.217476, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: UNIX USER\DENY => domain=[UNIX USER], name=[DENY] [2016/02/28 20:47:48.217483, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:48.217495, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:181(Get_Pwnam_alloc) Finding user DENY [2016/02/28 20:47:48.217502, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:120(Get_Pwnam_internals) Trying _Get_Pwnam(), username as lowercase is deny [2016/02/28 20:47:48.217543, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:159(Get_Pwnam_internals) Get_Pwnam_internals did find user [DENY]! [2016/02/28 20:47:48.217556, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:176(lookup_lsa_rids) init_lsa_rids: UNIX USER\DENY found [2016/02/28 20:47:48.217565, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'UNIX USER' sid : * sid : S-1-22-1 max_size : 0x00000020 (32) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_USER (1) rid : 0x00000006 (6) sid_index : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:48.217691, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000b-0000-0000-d356-d44008740000 [2016/02/28 20:47:48.217719, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.217744, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.217767, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:48.217774, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:48.217806, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:48.217829, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:48.217838, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:48.217855, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: UNIX USER\DENY -> S-1-22-1-6 (NT_STATUS_OK) [2016/02/28 20:47:48.217870, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-22-1-6 -> UNIX USER\deny (NT_STATUS_OK) [2016/02/28 20:47:48.217879, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USER (1) sid : * sid : S-1-22-1-6 result : NT_STATUS_OK [2016/02/28 20:47:48.217908, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.217916, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3520 bytes to parent [2016/02/28 20:47:48.217950, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USER (1) sid : * sid : S-1-22-1-6 result : NT_STATUS_OK [2016/02/28 20:47:48.217986, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_OK [2016/02/28 20:47:48.218005, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.218096, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.218110, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname CHILD2\Everyone [2016/02/28 20:47:48.218125, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.218168, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.218201, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.218219, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.218237, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.218412, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.218425, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname Unix Group\Everyone [2016/02/28 20:47:48.218443, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.218493, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 52 extra bytes [2016/02/28 20:47:48.218506, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.218514, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.218522, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:48.218533, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.218562, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:48.218570, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:48.218603, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:48.218615, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:48.218624, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:48.218650, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:48.218670, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:48.218774, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:48.218787, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:48.218797, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:48.218806, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 0C 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.218832, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000c-0000-0000-d356-d44008740000 result : NT_STATUS_OK [2016/02/28 20:47:48.218871, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: UNIX GROUP\EVERYONE for domain UNIX GROUP [2016/02/28 20:47:48.218893, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000c-0000-0000-d356-d44008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0026 (38) size : 0x0026 (38) string : * string : 'UNIX GROUP\EVERYONE' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:48.218964, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0C 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.218990, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name UNIX GROUP\EVERYONE [2016/02/28 20:47:48.218998, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: UNIX GROUP\EVERYONE => domain=[UNIX GROUP], name=[EVERYONE] [2016/02/28 20:47:48.219006, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:48.219043, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:181(lookup_lsa_rids) init_lsa_rids: UNIX GROUP\EVERYONE not found [2016/02/28 20:47:48.219054, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.219132, 2, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:328(rpc_name_to_sid) name_to_sid: failed to lookup name: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.219150, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000c-0000-0000-d356-d44008740000 [2016/02/28 20:47:48.219175, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0C 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.219199, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0C 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.219222, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:48.219237, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:48.219270, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:48.219286, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:48.219293, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:48.219310, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: UNIX GROUP\EVERYONE -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.219324, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> UNIX GROUP\everyone (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.219346, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.219378, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.219386, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.219420, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.219456, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.219466, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.219484, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.219598, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.219612, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname CHILD2\Everyone [2016/02/28 20:47:48.219628, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.219680, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.219714, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.219723, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.219741, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.219925, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.219938, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname Unix Group\Everyone [2016/02/28 20:47:48.219955, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.220009, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 52 extra bytes [2016/02/28 20:47:48.220022, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.220030, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.220037, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:48.220048, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.220077, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:48.220084, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:48.220118, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:48.220139, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:48.220149, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:48.220176, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:48.220196, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:48.220292, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:48.220304, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:48.220314, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:48.220323, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 0D 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.220362, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000d-0000-0000-d356-d44008740000 result : NT_STATUS_OK [2016/02/28 20:47:48.220403, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: UNIX GROUP\EVERYONE for domain UNIX GROUP [2016/02/28 20:47:48.220435, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000d-0000-0000-d356-d44008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0026 (38) size : 0x0026 (38) string : * string : 'UNIX GROUP\EVERYONE' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:48.220501, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0D 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.220526, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name UNIX GROUP\EVERYONE [2016/02/28 20:47:48.220535, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: UNIX GROUP\EVERYONE => domain=[UNIX GROUP], name=[EVERYONE] [2016/02/28 20:47:48.220542, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:48.220579, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:181(lookup_lsa_rids) init_lsa_rids: UNIX GROUP\EVERYONE not found [2016/02/28 20:47:48.220590, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.220669, 2, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:328(rpc_name_to_sid) name_to_sid: failed to lookup name: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.220686, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000d-0000-0000-d356-d44008740000 [2016/02/28 20:47:48.220719, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0D 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.220744, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0D 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.220767, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:48.220774, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:48.220807, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:48.220822, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:48.220830, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:48.220847, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: UNIX GROUP\EVERYONE -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.220861, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> UNIX GROUP\everyone (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.220870, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.220899, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.220907, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.220941, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.220977, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.220986, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.221015, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.228824, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.228842, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname CHILD2\deny [2016/02/28 20:47:48.228859, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.228906, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.228942, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.228952, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.228971, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.229367, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.229383, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname Unix User\deny [2016/02/28 20:47:48.229400, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX USER' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.229452, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 48 extra bytes [2016/02/28 20:47:48.229466, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.229474, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.229481, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:48.229493, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX USER' name : * name : 'DENY' flags : 0x00000000 (0) [2016/02/28 20:47:48.229531, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:48.229540, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:48.229575, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:48.229588, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:48.229596, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:48.229623, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:48.229643, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:48.229740, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:48.229752, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:48.229762, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:48.229771, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 0E 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.229805, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000e-0000-0000-d356-d44008740000 result : NT_STATUS_OK [2016/02/28 20:47:48.229860, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: UNIX USER\DENY for domain UNIX USER [2016/02/28 20:47:48.229884, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000e-0000-0000-d356-d44008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001c (28) size : 0x001c (28) string : * string : 'UNIX USER\DENY' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:48.229949, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0E 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.229974, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name UNIX USER\DENY [2016/02/28 20:47:48.229983, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: UNIX USER\DENY => domain=[UNIX USER], name=[DENY] [2016/02/28 20:47:48.229990, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:48.230002, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:181(Get_Pwnam_alloc) Finding user DENY [2016/02/28 20:47:48.230010, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:120(Get_Pwnam_internals) Trying _Get_Pwnam(), username as lowercase is deny [2016/02/28 20:47:48.230041, 5, pid=29704, effective(0, 0), real(0, 0)] ../source3/lib/username.c:159(Get_Pwnam_internals) Get_Pwnam_internals did find user [DENY]! [2016/02/28 20:47:48.230054, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:176(lookup_lsa_rids) init_lsa_rids: UNIX USER\DENY found [2016/02/28 20:47:48.230063, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0012 (18) size : 0x0014 (20) string : * string : 'UNIX USER' sid : * sid : S-1-22-1 max_size : 0x00000020 (32) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_USER (1) rid : 0x00000006 (6) sid_index : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2016/02/28 20:47:48.230196, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000e-0000-0000-d356-d44008740000 [2016/02/28 20:47:48.230224, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0E 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.230248, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0E 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.230272, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:48.230279, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:48.230312, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:48.230328, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:48.230349, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:48.230367, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: UNIX USER\DENY -> S-1-22-1-6 (NT_STATUS_OK) [2016/02/28 20:47:48.230382, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-1-22-1-6 -> UNIX USER\deny (NT_STATUS_OK) [2016/02/28 20:47:48.230399, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USER (1) sid : * sid : S-1-22-1-6 result : NT_STATUS_OK [2016/02/28 20:47:48.230429, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.230437, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3520 bytes to parent [2016/02/28 20:47:48.230474, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USER (1) sid : * sid : S-1-22-1-6 result : NT_STATUS_OK [2016/02/28 20:47:48.230510, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_OK [2016/02/28 20:47:48.230530, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.230612, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.230625, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname CHILD2\Everyone [2016/02/28 20:47:48.230640, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.230683, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.230716, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.230726, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.230743, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.230913, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.230926, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname Unix Group\Everyone [2016/02/28 20:47:48.230950, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.231001, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 52 extra bytes [2016/02/28 20:47:48.231014, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.231022, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.231029, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:48.231041, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.231070, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:48.231077, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:48.231111, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:48.231124, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:48.231132, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:48.231159, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:48.231179, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:48.231284, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:48.231296, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:48.231306, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:48.231316, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 0F 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.231354, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000f-0000-0000-d356-d44008740000 result : NT_STATUS_OK [2016/02/28 20:47:48.231396, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: UNIX GROUP\EVERYONE for domain UNIX GROUP [2016/02/28 20:47:48.231418, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000f-0000-0000-d356-d44008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0026 (38) size : 0x0026 (38) string : * string : 'UNIX GROUP\EVERYONE' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:48.231483, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.231508, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name UNIX GROUP\EVERYONE [2016/02/28 20:47:48.231516, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: UNIX GROUP\EVERYONE => domain=[UNIX GROUP], name=[EVERYONE] [2016/02/28 20:47:48.231531, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:48.231569, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:181(lookup_lsa_rids) init_lsa_rids: UNIX GROUP\EVERYONE not found [2016/02/28 20:47:48.231580, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.231659, 2, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:328(rpc_name_to_sid) name_to_sid: failed to lookup name: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.231676, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000000f-0000-0000-d356-d44008740000 [2016/02/28 20:47:48.231701, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.231726, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.231749, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:48.231756, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:48.231788, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:48.231804, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:48.231818, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:48.231836, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: UNIX GROUP\EVERYONE -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.231851, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> UNIX GROUP\everyone (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.231859, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.231889, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.231897, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.231931, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.231967, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.231976, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.231994, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.232115, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.232128, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname CHILD2\Everyone [2016/02/28 20:47:48.232144, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.232187, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.232221, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.232239, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.232258, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.232432, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.232445, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname Unix Group\Everyone [2016/02/28 20:47:48.232462, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.232513, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 52 extra bytes [2016/02/28 20:47:48.232526, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.232533, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.232541, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:48.232553, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'EVERYONE' flags : 0x00000000 (0) [2016/02/28 20:47:48.232581, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:48.232589, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:48.232623, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:48.232635, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:48.232644, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:48.232670, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:48.232690, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:48.232796, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:48.232808, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:48.232818, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:48.232827, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 10 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.232853, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000010-0000-0000-d356-d44008740000 result : NT_STATUS_OK [2016/02/28 20:47:48.232893, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: UNIX GROUP\EVERYONE for domain UNIX GROUP [2016/02/28 20:47:48.232915, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000010-0000-0000-d356-d44008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0026 (38) size : 0x0026 (38) string : * string : 'UNIX GROUP\EVERYONE' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:48.232987, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 10 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.233012, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name UNIX GROUP\EVERYONE [2016/02/28 20:47:48.233021, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: UNIX GROUP\EVERYONE => domain=[UNIX GROUP], name=[EVERYONE] [2016/02/28 20:47:48.233028, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:48.233065, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:181(lookup_lsa_rids) init_lsa_rids: UNIX GROUP\EVERYONE not found [2016/02/28 20:47:48.233077, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.233161, 2, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:328(rpc_name_to_sid) name_to_sid: failed to lookup name: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.233180, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000010-0000-0000-d356-d44008740000 [2016/02/28 20:47:48.233207, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 10 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.233234, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 10 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.233259, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:48.233275, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:48.233311, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:48.233327, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:48.233348, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:48.233367, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: UNIX GROUP\EVERYONE -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.233381, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> UNIX GROUP\everyone (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.233390, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.233422, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.233429, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.233464, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.233500, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.233509, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.233527, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.233666, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.233679, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname CHILD2\Administrators [2016/02/28 20:47:48.233695, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'ADMINISTRATORS' flags : 0x00000000 (0) [2016/02/28 20:47:48.233761, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 52 extra bytes [2016/02/28 20:47:48.233776, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.233783, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.233791, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (CHILD2) [2016/02/28 20:47:48.233802, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'CHILD2' name : * name : 'ADMINISTRATORS' flags : 0x00000000 (0) [2016/02/28 20:47:48.233831, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.233838, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.233850, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain CHILD2 [2016/02/28 20:47:48.233858, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:253(msrpc_name_to_sid) msrpc_name_to_sid: name=CHILD2\ADMINISTRATORS [2016/02/28 20:47:48.233865, 3, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_msrpc.c:267(msrpc_name_to_sid) name_to_sid [rpc] CHILD2\ADMINISTRATORS for domain CHILD2 [2016/02/28 20:47:48.233873, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cm.c:2905(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2016/02/28 20:47:48.233889, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames4: struct lsa_LookupNames4 in: struct lsa_LookupNames4 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x002a (42) size : 0x002a (42) string : * string : 'CHILD2\ADMINISTRATORS' sids : * sids: struct lsa_TransSidArray3 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2016/02/28 20:47:48.233956, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001e (30) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000060 (96) context_id : 0x0000 (0) opnum : 0x004d (77) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 [2016/02/28 20:47:48.234052, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2016/02/28 20:47:48.234102, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:756(rpc_api_pipe_send) rpc_api_pipe: host Srv.child2.domain.local [2016/02/28 20:47:48.234111, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:178(rpc_write_send) rpc_write_send: data_to_write: 184 [2016/02/28 20:47:48.234757, 5, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:98(rpc_read_send) rpc_read_send: data_to_read: 200 [2016/02/28 20:47:48.234789, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:402(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00d8 (216) auth_length : 0x0038 (56) call_id : 0x0000001e (30) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000078 (120) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=192 [0000] 3B DC DE 1D 32 BB B5 26 39 FD AB 66 DF E7 C2 34 ;...2..& 9..f...4 [0010] AA 78 06 14 1C 48 F1 92 6C 17 7F D1 2F 5E 85 78 .x...H.. l.../^.x [0020] 4E 11 26 D9 62 99 3D 77 46 68 7E D4 92 A0 47 BF N.&.b.=w Fh~...G. [0030] 8D 18 B7 D5 3D 3C DA 60 EF D5 F3 90 CD D9 C4 DE ....=<.` ........ [0040] F6 0C 9E 8F 08 8D 62 8E DA C0 33 52 9C CD DC 7F ......b. ..3R.... [0050] F0 CD D0 31 C5 EF 5E A0 A1 37 47 50 60 68 83 9D ...1..^. .7GP`h.. [0060] 8B B9 7A 35 58 C8 E9 05 14 A9 1F 83 A8 8B 09 58 ..z5X... .......X [0070] D5 44 66 93 67 EE 72 9F 80 67 8C A7 F6 CF 8E 84 .Df.g.r. .g...... [0080] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0090] 64 56 62 83 6B 1A 76 D1 43 85 EC 31 DC 8B 9F 9F dVb.k.v. C..1.... [00A0] B3 FD 56 9A 0B 75 92 71 C2 1F E9 EF A8 7D 07 68 ..V..u.q .....}.h [00B0] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [2016/02/28 20:47:48.235092, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:507(dcerpc_check_auth) Requested Privacy. [2016/02/28 20:47:48.235101, 6, pid=29681, effective(0, 0), real(0, 0)] ../librpc/rpc/dcerpc_util.c:141(dcerpc_pull_auth_trailer) ../librpc/rpc/dcerpc_util.c:141: auth_pad_length 8 [2016/02/28 20:47:48.235109, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_parse] ../source3/librpc/rpc/dcerpc_helpers.c:564(dcerpc_check_auth) GENSEC auth [2016/02/28 20:47:48.235141, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:447(cli_pipe_validate_current_pdu) Got pdu len 216, data_len 120, ss_len 8 [2016/02/28 20:47:48.235149, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:901(rpc_api_pipe_got_pdu) rpc_api_pipe: got frag len of 216 at offset 0: NT_STATUS_OK [2016/02/28 20:47:48.235157, 10, pid=29681, effective(0, 0), real(0, 0), class=rpc_cli] ../source3/rpc_client/cli_pipe.c:956(rpc_api_pipe_got_pdu) rpc_api_pipe: host Srv.child2.domain.local returned 120 bytes. [2016/02/28 20:47:48.235176, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames4: struct lsa_LookupNames4 out: struct lsa_LookupNames4 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x000c (12) size : 0x000e (14) string : * string : 'CHILD2' sid : * sid : S-1-5-21-733680754-3169875714-4083418759 max_size : 0x00000020 (32) sids : * sids: struct lsa_TransSidArray3 count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid3 sid_type : SID_NAME_UNKNOWN (8) sid : NULL sid_index : 0x00000000 (0) flags : 0x00000000 (0) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.235288, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: CHILD2 time ok [2016/02/28 20:47:48.235297, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: CHILD2 seq number is now 122988 [2016/02/28 20:47:48.235323, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: CHILD2\ADMINISTRATORS -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.235351, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> CHILD2\administrators (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.235361, 1, pid=29681, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.235391, 4, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.235399, 10, pid=29681, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.235445, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.235481, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.235491, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.235511, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:47:48.235699, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:731(process_request) process_request: Handling async request 29727:LOOKUPNAME [2016/02/28 20:47:48.235713, 3, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:69(winbindd_lookupname_send) lookupname Unix Group\Administrators [2016/02/28 20:47:48.235730, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'ADMINISTRATORS' flags : 0x00000000 (0) [2016/02/28 20:47:48.235781, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:69(child_read_request) Need to read 56 extra bytes [2016/02/28 20:47:48.235795, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1389(child_handler) child daemon request 59 [2016/02/28 20:47:48.235802, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:512(child_process_request) child_process_request: request fn NDRCMD [2016/02/28 20:47:48.235810, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual_ndr.c:315(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command WBINT_LOOKUPNAME (URI-VGW-4) [2016/02/28 20:47:48.235830, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName in: struct wbint_LookupName domain : * domain : 'UNIX GROUP' name : * name : 'ADMINISTRATORS' flags : 0x00000000 (0) [2016/02/28 20:47:48.235860, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:1874(name_to_sid) name_to_sid: [Cached] - doing backend query for name for domain URI-VGW-4 [2016/02/28 20:47:48.235868, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_samr.c:548(sam_name_to_sid) sam_name_to_sid [2016/02/28 20:47:48.235902, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:203(make_internal_rpc_pipe_p) Create pipe requested lsarpc [2016/02/28 20:47:48.235914, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:222(init_pipe_handles) init_pipe_handle_list: created handle list for pipe lsarpc [2016/02/28 20:47:48.235923, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:239(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe lsarpc [2016/02/28 20:47:48.235950, 4, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:243(make_internal_rpc_pipe_p) Created internal pipe lsarpc [2016/02/28 20:47:48.235970, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2016/02/28 20:47:48.236066, 10, pid=29704, effective(0, 0), real(0, 0)] ../libcli/security/access_check.c:58(se_map_generic) se_map_generic(): mapped mask 0xb0000000 to 0x000f1fff [2016/02/28 20:47:48.236077, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:95(access_check_object) _lsa_OpenPolicy2: ACCESS should be DENIED (requested: 0x000f1fff) but overritten by euid == initial uid [2016/02/28 20:47:48.236087, 4, pid=29704, effective(0, 0), real(0, 0)] ../source3/rpc_server/srv_access_check.c:117(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x000f1fff, granted: 0x000f1fff) [2016/02/28 20:47:48.236105, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:303(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 11 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.236131, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000011-0000-0000-d356-d44008740000 result : NT_STATUS_OK [2016/02/28 20:47:48.236171, 3, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:309(rpc_name_to_sid) name_to_sid: UNIX GROUP\ADMINISTRATORS for domain UNIX GROUP [2016/02/28 20:47:48.236193, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames in: struct lsa_LookupNames handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000011-0000-0000-d356-d44008740000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0032 (50) size : 0x0032 (50) string : * string : 'UNIX GROUP\ADMINISTRATORS' sids : * sids: struct lsa_TransSidArray count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) [2016/02/28 20:47:48.236259, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 11 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.236283, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:163(lookup_lsa_rids) lookup_lsa_rids: looking up name UNIX GROUP\ADMINISTRATORS [2016/02/28 20:47:48.236292, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:77(lookup_name) lookup_name: UNIX GROUP\ADMINISTRATORS => domain=[UNIX GROUP], name=[ADMINISTRATORS] [2016/02/28 20:47:48.236299, 10, pid=29704, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:78(lookup_name) lookup_name: flags = 0x073 [2016/02/28 20:47:48.236349, 5, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/lsa/srv_lsa_nt.c:181(lookup_lsa_rids) init_lsa_rids: UNIX GROUP\ADMINISTRATORS not found [2016/02/28 20:47:48.236362, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_LookupNames: struct lsa_LookupNames out: struct lsa_LookupNames domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.236450, 2, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_rpc.c:328(rpc_name_to_sid) name_to_sid: failed to lookup name: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.236468, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000011-0000-0000-d356-d44008740000 [2016/02/28 20:47:48.236493, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 11 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.236518, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:338(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 11 00 00 00 00 00 00 00 D3 56 D4 40 ........ .....V.@ [0010] 08 74 00 00 .t.. [2016/02/28 20:47:48.236541, 6, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:387(close_policy_hnd) Closed policy [2016/02/28 20:47:48.236549, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2016/02/28 20:47:48.236580, 10, pid=29704, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:417(close_policy_by_pipe) Deleted handle list for RPC connection lsarpc [2016/02/28 20:47:48.236596, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:542(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 time ok [2016/02/28 20:47:48.236604, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:587(refresh_sequence_number) refresh_sequence_number: URI-VGW-4 seq number is now 1456685221 [2016/02/28 20:47:48.236629, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:966(wcache_save_name_to_sid) wcache_save_name_to_sid: UNIX GROUP\ADMINISTRATORS -> S-0-0 (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.236647, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_cache.c:996(wcache_save_sid_to_name) wcache_save_sid_to_name: S-0-0 -> UNIX GROUP\administrators (NT_STATUS_NONE_MAPPED) [2016/02/28 20:47:48.236656, 1, pid=29704, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.236695, 4, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1397(child_handler) Finished processing child request 59 [2016/02/28 20:47:48.236704, 10, pid=29704, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:104(child_write_response) Writing 3512 bytes to parent [2016/02/28 20:47:48.236738, 1, pid=29680, effective(0, 0), real(0, 0)] ../librpc/ndr/ndr.c:439(ndr_print_function_debug) wbint_LookupName: struct wbint_LookupName out: struct wbint_LookupName type : * type : SID_NAME_USE_NONE (0) sid : * sid : S-0-0 result : NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.236774, 5, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_lookupname.c:104(winbindd_lookupname_recv) Could not convert sid S-0-0: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.236784, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:793(wb_request_done) wb_request_done[29727:LOOKUPNAME]: NT_STATUS_NONE_MAPPED [2016/02/28 20:47:48.236802, 10, pid=29680, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd.c:861(winbind_client_response_written) winbind_client_response_written[29727:LOOKUPNAME]: delivered response to client [2016/02/28 20:48:01.825454, 10, pid=29706, effective(0, 0), real(0, 0), class=winbind] ../source3/winbindd/winbindd_dual.c:1604(fork_domain_child) fork_domain_child: domain BUILTIN no longer in 'startup' mode.