Attachment 18162 Details for Bug 15495 – Samba domain join logs (plain text)

Samba domain join logs (plain text)

samba_domain_join_logs.txt (text/plain), 133.01 KB, created by Akshatha Baliga on 2023-10-17 09:03:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Akshatha Baliga

Created: 2023-10-17 09:03:20 UTC

Size: 133.01 KB

patch

obsolete

>root@oak-vcs1307:~# cat /etc/os-release
>NAME="Ubuntu"
>VERSION="20.04.4 LTS (Focal Fossa)"
>ID=ubuntu
>ID_LIKE=debian
>PRETTY_NAME="Ubuntu 20.04.4 LTS"
>VERSION_ID="20.04"
>HOME_URL="https://www.ubuntu.com/"
>SUPPORT_URL="https://help.ubuntu.com/"
>BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
>PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
>VERSION_CODENAME=focal
>UBUNTU_CODENAME=focal
>root@oak-vcs1307:~# /usr/bin/net -V
>Version 4.19.1
>root@oak-vcs1307:~# /usr/bin/net ads join -d 10 --no-dns-updates -U Administrator%******-k
>INFO: Current debug levels:
>Â  all: 10
>Â  tdb: 10
>Â  printdrivers: 10
>Â  lanman: 10
>Â  smb: 10
>Â  rpc_parse: 10
>Â  rpc_srv: 10
>Â  rpc_cli: 10
>Â  passdb: 10
>Â  sam: 10
>Â  auth: 10
>Â  winbind: 10
>Â  vfs: 10
>Â  idmap: 10
>Â  quota: 10
>Â  acls: 10
>Â  locking: 10
>Â  msdfs: 10
>Â  dmapi: 10
>Â  registry: 10
>Â  scavenger: 10
>Â  dns: 10
>Â  ldb: 10
>Â  tevent: 10
>Â  auth_audit: 10
>Â  auth_json_audit: 10
>Â  kerberos: 10
>Â  drs_repl: 10
>Â  smb2: 10
>Â  smb2_credits: 10
>Â  dsdb_audit: 10
>Â  dsdb_json_audit: 10
>Â  dsdb_password_audit: 10
>Â  dsdb_password_json_audit: 10
>Â  dsdb_transaction_audit: 10
>Â  dsdb_transaction_json_audit: 10
>Â  dsdb_group_audit: 10
>Â  dsdb_group_json_audit: 10
>WARNING: The option -k|--kerberos is deprecated!
>lp_load_ex: refreshing parameters
>Initialising global parameters
>rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
>INFO: Current debug levels:
>Â  all: 10
>Â  tdb: 10
>Â  printdrivers: 10
>Â  lanman: 10
>Â  smb: 10
>Â  rpc_parse: 10
>Â  rpc_srv: 10
>Â  rpc_cli: 10
>Â  passdb: 10
>Â  sam: 10
>Â  auth: 10
>Â  winbind: 10
>Â  vfs: 10
>Â  idmap: 10
>Â  quota: 10
>Â  acls: 10
>Â  locking: 10
>Â  msdfs: 10
>Â  dmapi: 10
>Â  registry: 10
>Â  scavenger: 10
>Â  dns: 10
>Â  ldb: 10
>Â  tevent: 10
>Â  auth_audit: 10
>Â  auth_json_audit: 10
>Â  kerberos: 10
>Â  drs_repl: 10
>Â  smb2: 10
>Â  smb2_credits: 10
>Â  dsdb_audit: 10
>Â  dsdb_json_audit: 10
>Â  dsdb_password_audit: 10
>Â  dsdb_password_json_audit: 10
>Â  dsdb_transaction_audit: 10
>Â  dsdb_transaction_json_audit: 10
>Â  dsdb_group_audit: 10
>Â  dsdb_group_json_audit: 10
>doing parameter workgroup = DC2022
>doing parameter realm = DC2022.TEST
>doing parameter security = ads
>doing parameter idmap config * : backend = tdb
>doing parameter idmap config * : range = 3000-7999
>doing parameter idmap config DC2022 : backend = rid
>doing parameter idmap config DC2022 : range = 10000-999999
>doing parameter template homedir = /home/%U
>doing parameter template shell = /bin/bash
>doing parameter winbind use default domain = true
>doing parameter winbind offline logon = false
>pm_process() returned Yes
>lp_servicenumber: couldn't find homes
>added interface eth0 ip=2600:809:200:536:250:56ff:feae:2291 bcast= netmask=ffff:ffff:ffff:ffff::
>added interface eth0 ip=10.5.54.91 bcast=10.5.54.255 netmask=255.255.255.0
>added interface eth1 ip=10.5.140.58 bcast=10.5.255.255 netmask=255.255.128.0
>messaging_dgm_ref: messaging_dgm_init returned Success
>messaging_dgm_ref: unique = 16345522056155018957
>Registering messaging pointer for type 2 - private_data=(nil)
>register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE
>Registering messaging pointer for type 11 - private_data=(nil)
>Registering messaging pointer for type 12 - private_data=(nil)
>Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
>Registering messaging pointer for type 1 - private_data=(nil)
>Registering messaging pointer for type 5 - private_data=(nil)
>Registering messaging pointer for type 51 - private_data=(nil)
>messaging_init_internal: my id: 1557
>added interface eth0 ip=2600:809:200:536:250:56ff:feae:2291 bcast= netmask=ffff:ffff:ffff:ffff::
>added interface eth0 ip=10.5.54.91 bcast=10.5.54.255 netmask=255.255.255.0
>added interface eth1 ip=10.5.140.58 bcast=10.5.255.255 netmask=255.255.128.0
>libnet_Join:
>Â Â Â  libnet_JoinCtx: struct libnet_JoinCtx
>Â Â Â Â Â Â Â  in: struct libnet_JoinCtx
>Â Â Â Â Â Â Â Â Â Â Â  dc_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  machine_nameÂ Â Â Â Â Â Â Â Â Â Â Â  : 'OAK-VCS1307'
>Â Â Â Â Â Â Â Â Â Â Â  domain_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'DC2022.TEST'
>Â Â Â Â Â Â Â Â Â Â Â  domain_name_typeÂ Â Â Â Â Â Â Â  : JoinDomNameTypeDNS (1)
>Â Â Â Â Â Â Â Â Â Â Â  account_ouÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  admin_accountÂ Â Â Â Â Â Â Â Â Â Â  : 'Administrator'
>Â Â Â Â Â Â Â Â Â Â Â  admin_domainÂ Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  machine_passwordÂ Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  join_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000023 (35)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: WKSSVC_JOIN_FLAGS_IGNORE_UNSUPPORTED_FLAGS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: WKSSVC_JOIN_FLAGS_JOIN_WITH_NEW_NAME
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: WKSSVC_JOIN_FLAGS_JOIN_DC_ACCOUNT
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: WKSSVC_JOIN_FLAGS_DEFER_SPN
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: WKSSVC_JOIN_FLAGS_JOIN_UNSECURE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: WKSSVC_JOIN_FLAGS_WIN9X_UPGRADE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: WKSSVC_JOIN_FLAGS_JOIN_TYPE
>Â Â Â Â Â Â Â Â Â Â Â  os_versionÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  os_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  os_servicepackÂ Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  create_upnÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  upnÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  dnshostnameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  modify_configÂ Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  adsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  debugÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â  use_kerberosÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â  secure_channel_typeÂ Â Â Â Â  : SEC_CHAN_WKSTA (2)
>Â Â Â Â Â Â Â Â Â Â Â  desired_encryption_types : 0x0000001c (28)
>Â Â Â Â Â Â Â Â Â Â Â  provision_computer_account_only: 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  odj_provision_dataÂ Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  request_offline_joinÂ Â Â Â  : 0x00 (0)
>Opening cache file at /usr/local/samba/var/lock/gencache.tdb
>sitename_fetch: Returning sitename for realm 'DC2022.TEST': "Default-First-Site-Name"
>dsgetdcname_internal: domain_name: DC2022.TEST, domain_guid: (null), site_name: Default-First-Site-Name, flags: 0x40021011
>debug_dsdcinfo_flags: 0x40021011
>Â Â Â Â Â Â Â Â Â Â Â  DS_FORCE_REDISCOVERY DS_DIRECTORY_SERVICE_REQUIRED DS_WRITABLE_REQUIRED DS_IS_DNS_NAME DS_RETURN_DNS_NAME
>dsgetdcname_rediscover
>dns_lookup_send_next: Sending DNS request #0 to 10.5.139.71
>dns_cli_request_send: Asking 10.5.139.71 for _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.DC2022.TEST/1/33 via UDP
>[0000] 58 E1 01 00 00 01 00 00Â Â  00 00 00 00 05 5F 6C 64Â Â  X....... ....._ld
>[0010] 61 70 04 5F 74 63 70 17Â Â  44 65 66 61 75 6C 74 2DÂ Â  ap._tcp. Default-
>[0020] 46 69 72 73 74 2D 53 69Â Â  74 65 2D 4E 61 6D 65 06Â Â  First-Si te-Name.
>[0030] 5F 73 69 74 65 73 02 64Â Â  63 06 5F 6D 73 64 63 73Â Â  _sites.d c._msdcs
>[0040] 06 44 43 32 30 32 32 04Â Â  54 45 53 54 00 00 21 00Â Â  .DC2022. TEST..!.
>[0050] 01Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  .
>[0000] 58 E1 85 80 00 01 00 01Â Â  00 00 00 01 05 5F 6C 64Â Â  X....... ....._ld
>[0010] 61 70 04 5F 74 63 70 17Â Â  44 65 66 61 75 6C 74 2DÂ Â  ap._tcp. Default-
>[0020] 46 69 72 73 74 2D 53 69Â Â  74 65 2D 4E 61 6D 65 06Â Â  First-Si te-Name.
>[0030] 5F 73 69 74 65 73 02 64Â Â  63 06 5F 6D 73 64 63 73Â Â  _sites.d c._msdcs
>[0040] 06 44 43 32 30 32 32 04Â Â  54 45 53 54 00 00 21 00Â Â  .DC2022. TEST..!.
>[0050] 01 C0 0C 00 21 00 01 00Â Â  00 02 58 00 23 00 00 00Â Â  ....!... ..X.#...
>[0060] 64 01 85 0F 77 69 6E 2DÂ Â  38 34 31 70 76 34 68 65Â Â  d...win- 841pv4he
>[0070] 6B 30 6F 06 64 63 32 30Â Â  32 32 04 74 65 73 74 00Â Â  k0o.dc20 22.test.
>[0080] C0 63 00 01 00 01 00 00Â Â  0E 10 00 04 0A 05 8B 47Â Â  .c...... .......G
>LDAP ping to win-841pv4hek0o.dc2022.test (10.5.139.71)
>Â Â Â Â  &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX
>Â Â Â Â Â Â Â  commandÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : LOGON_SAM_LOGON_RESPONSE_EX (23)
>Â Â Â Â Â Â Â  sbzÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  server_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0007f3fd (521213)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_PDC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_GC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_LDAP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_KDC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_TIMESERV
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_CLOSEST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_WRITABLE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_GOOD_TIMESERV
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_NDNC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_SELECT_SECRET_DOMAIN_6
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_FULL_SECRET_DOMAIN_6
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_ADS_WEB_SERVICE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS_8
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS_9
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS_10
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_HAS_DNS_NAME
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_IS_DEFAULT_NC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_FOREST_ROOT
>Â Â Â Â Â Â Â  domain_uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 15a99073-0553-41da-9071-ff8270e0cf35
>Â Â Â Â Â Â Â  forestÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â  dns_domainÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â  pdc_dns_nameÂ Â Â Â Â Â Â Â Â Â Â Â  : 'WIN-841PV4HEK0O.dc2022.test'
>Â Â Â Â Â Â Â  domain_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'DC2022'
>Â Â Â Â Â Â Â  pdc_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'WIN-841PV4HEK0O'
>Â Â Â Â Â Â Â  user_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : ''
>Â Â Â Â Â Â Â  server_siteÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'Default-First-Site-Name'
>Â Â Â Â Â Â Â  client_siteÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'Default-First-Site-Name'
>Â Â Â Â Â Â Â  sockaddr_sizeÂ Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  sockaddr: struct nbt_sockaddr
>Â Â Â Â Â Â Â Â Â Â Â  sockaddr_familyÂ Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  pdc_ipÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : (null)
>Â Â Â Â Â Â Â Â Â Â Â  remainingÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DATA_BLOB length=0
>Â Â Â Â Â Â Â  next_closest_siteÂ Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â  nt_versionÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000005 (5)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NETLOGON_NT_VERSION_1
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_5
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NETLOGON_NT_VERSION_5EX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_5EX_WITH_IP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_AVOID_NT4EMUL
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_PDC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_IP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_LOCAL
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_GC
>Â Â Â Â Â Â Â  lmnt_tokenÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0xffff (65535)
>Â Â Â Â Â Â Â  lm20_tokenÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0xffff (65535)
>gencache_set_data_blob: Adding cache entry with key=[DSGETDCNAME/DOMAIN/DC2022] and timeout=[Fri Oct 13 06:44:54 AM 2023 UTC] (900 seconds ahead)
>sitename_store: realm = [DC2022], sitename = [Default-First-Site-Name], expire = [2085923199]
>gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/DC2022] and timeout=[Wed Dec 31 11:59:59 PM -2147481749 UTC] (67768034494498205 seconds ahead)
>gencache_set_data_blob: Adding cache entry with key=[DSGETDCNAME/DOMAIN/DC2022.TEST] and timeout=[Fri Oct 13 06:44:54 AM 2023 UTC] (900 seconds ahead)
>sitename_store: realm = [dc2022.test], sitename = [Default-First-Site-Name], expire = [2085923199]
>gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/DC2022.TEST] and timeout=[Wed Dec 31 11:59:59 PM -2147481749 UTC] (67768034494498205 seconds ahead)
>create_local_private_krb5_conf_for_domain: fname = /usr/local/samba/var/lock/smb_krb5/krb5.conf._JOIN_, realm = DC2022.TEST, domain = _JOIN_
>gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/DC2022.TEST] and timeout=[Thu JanÂ  1 12:00:00 AM 1970 UTC] (-1697178594 seconds in the past)
>saf_fetch: failed to find server for "DC2022.TEST" domain
>get_dc_list: preferred server list: ", *"
>internal_resolve_name: looking up DC2022.TEST#dcdc (sitename Default-First-Site-Name)
>resolve_ads: Attempting to resolve KDCs for DC2022.TEST using DNS
>resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.DC2022.TEST
>dns_lookup_send_next: Sending DNS request #0 to 10.5.139.71
>dns_cli_request_send: Asking 10.5.139.71 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.DC2022.TEST/1/33 via UDP
>[0000] 7E 35 01 00 00 01 00 00Â Â  00 00 00 00 09 5F 6B 65Â Â  ~5...... ....._ke
>[0010] 72 62 65 72 6F 73 04 5FÂ Â  74 63 70 17 44 65 66 61Â Â  rberos._ tcp.Defa
>[0020] 75 6C 74 2D 46 69 72 73Â Â  74 2D 53 69 74 65 2D 4EÂ Â  ult-Firs t-Site-N
>[0030] 61 6D 65 06 5F 73 69 74Â Â  65 73 02 64 63 06 5F 6DÂ Â  ame._sit es.dc._m
>[0040] 73 64 63 73 06 44 43 32Â Â  30 32 32 04 54 45 53 54Â Â  sdcs.DC2 022.TEST
>[0050] 00 00 21 00 01Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ..!..
>[0000] 7E 35 85 80 00 01 00 01Â Â  00 00 00 01 09 5F 6B 65Â Â  ~5...... ....._ke
>[0010] 72 62 65 72 6F 73 04 5FÂ Â  74 63 70 17 44 65 66 61Â Â  rberos._ tcp.Defa
>[0020] 75 6C 74 2D 46 69 72 73Â Â  74 2D 53 69 74 65 2D 4EÂ Â  ult-Firs t-Site-N
>[0030] 61 6D 65 06 5F 73 69 74Â Â  65 73 02 64 63 06 5F 6DÂ Â  ame._sit es.dc._m
>[0040] 73 64 63 73 06 44 43 32Â Â  30 32 32 04 54 45 53 54Â Â  sdcs.DC2 022.TEST
>[0050] 00 00 21 00 01 C0 0C 00Â Â  21 00 01 00 00 02 58 00Â Â  ..!..... !.....X.
>[0060] 23 00 00 00 64 00 58 0FÂ Â  77 69 6E 2D 38 34 31 70Â Â  #...d.X. win-841p
>[0070] 76 34 68 65 6B 30 6F 06Â Â  64 63 32 30 32 32 04 74Â Â  v4hek0o. dc2022.t
>[0080] 65 73 74 00 C0 67 00 01Â Â  00 01 00 00 0E 10 00 04Â Â  est..g.. ........
>[0090] 0A 05 8B 47Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ...G
>resolve_ads: SRV lookup DC2022.TEST got IP[0] 10.5.139.71
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>internal_resolve_name: returning 1 addresses: 10.5.139.71
>get_dc_list: Adding 1 DC's from auto lookup
>check_negative_conn_cache returning result 0 for domain DC2022.TEST server 10.5.139.71
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>get_dc_list: returning 1 ip addresses in an ordered list
>get_dc_list: 10.5.139.71
>get_kdc_ip_string: got 1 addresses from site Default-First-Site-Name search
>saf_fetch: failed to find server for "DC2022.TEST" domain
>get_dc_list: preferred server list: ", *"
>internal_resolve_name: looking up DC2022.TEST#dcdc (sitename (null))
>resolve_ads: Attempting to resolve KDCs for DC2022.TEST using DNS
>resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.DC2022.TEST
>dns_lookup_send_next: Sending DNS request #0 to 10.5.139.71
>dns_cli_request_send: Asking 10.5.139.71 for _kerberos._tcp.dc._msdcs.DC2022.TEST/1/33 via UDP
>[0000] 11 14 01 00 00 01 00 00Â Â  00 00 00 00 09 5F 6B 65Â Â  ........ ....._ke
>[0010] 72 62 65 72 6F 73 04 5FÂ Â  74 63 70 02 64 63 06 5FÂ Â  rberos._ tcp.dc._
>[0020] 6D 73 64 63 73 06 44 43Â Â  32 30 32 32 04 54 45 53Â Â  msdcs.DC 2022.TES
>[0030] 54 00 00 21 00 01Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  T..!..
>[0000] 11 14 85 80 00 01 00 01Â Â  00 00 00 01 09 5F 6B 65Â Â  ........ ....._ke
>[0010] 72 62 65 72 6F 73 04 5FÂ Â  74 63 70 02 64 63 06 5FÂ Â  rberos._ tcp.dc._
>[0020] 6D 73 64 63 73 06 44 43Â Â  32 30 32 32 04 54 45 53Â Â  msdcs.DC 2022.TES
>[0030] 54 00 00 21 00 01 C0 0CÂ Â  00 21 00 01 00 00 02 58Â Â  T..!.... .!.....X
>[0040] 00 23 00 00 00 64 00 58Â Â  0F 77 69 6E 2D 38 34 31Â Â  .#...d.X .win-841
>[0050] 70 76 34 68 65 6B 30 6FÂ Â  06 64 63 32 30 32 32 04Â Â  pv4hek0o .dc2022.
>[0060] 74 65 73 74 00 C0 48 00Â Â  01 00 01 00 00 0E 10 00Â Â  test..H. ........
>[0070] 04 0A 05 8B 47Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ....G
>resolve_ads: SRV lookup DC2022.TEST got IP[0] 10.5.139.71
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>internal_resolve_name: returning 1 addresses: 10.5.139.71
>get_dc_list: Adding 1 DC's from auto lookup
>check_negative_conn_cache returning result 0 for domain DC2022.TEST server 10.5.139.71
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>get_dc_list: returning 1 ip addresses in an ordered list
>get_dc_list: 10.5.139.71
>get_kdc_ip_string: got 1 addresses from site-less search
>get_kdc_ip_string: 0 additional KDCs to test
>get_kdc_ip_string: Returning
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  kdc = 10.5.139.71
>Â 
>create_local_private_krb5_conf_for_domain: wrote file /usr/local/samba/var/lock/smb_krb5/krb5.conf._JOIN_ with realm DC2022.TEST KDC list:
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  kdc = 10.5.139.71
>Â 
>sitename_fetch: Returning sitename for realm 'DC2022.TEST': "Default-First-Site-Name"
>internal_resolve_name: looking up WIN-841PV4HEK0O.dc2022.test#20 (sitename Default-First-Site-Name)
>gencache_set_data_blob: Adding cache entry with key=[NBT/WIN-841PV4HEK0O.DC2022.TEST#20] and timeout=[Thu JanÂ  1 12:00:00 AM 1970 UTC] (-1697178594 seconds in the past)
>namecache_fetch: no entry for WIN-841PV4HEK0O.dc2022.test#20 found.
>resolve_hosts: Attempting host lookup for name WIN-841PV4HEK0O.dc2022.test<0x20>
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>namecache_store: storing 1 address for WIN-841PV4HEK0O.dc2022.test#20: 10.5.139.71
>gencache_set_data_blob: Adding cache entry with key=[NBT/WIN-841PV4HEK0O.DC2022.TEST#20] and timeout=[Fri Oct 13 06:40:54 AM 2023 UTC] (660 seconds ahead)
>internal_resolve_name: returning 1 addresses: 10.5.139.71
>Connecting to 10.5.139.71 at port 445
>socket options: SO_KEEPALIVE=0, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=9, TCP_KEEPIDLE=7200, TCP_KEEPINTVL=75, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=131072, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0
>cli_session_creds_prepare_krb5: Doing kinit for Administrator@DC2022.TEST to access WIN-841PV4HEK0O.dc2022.test
>kerberos_kinit_password_ext: as Administrator@DC2022.TEST using [MEMORY:cliconnect] as ccache and config [/usr/local/samba/var/lock/smb_krb5/krb5.conf._JOIN_]
>kerberos_kinit_password_ext: Administrator@DC2022.TEST mapped to Administrator@DC2022.TEST
>cli_session_creds_prepare_krb5: Successfully authenticated as Administrator@DC2022.TEST (Administrator@DC2022.TEST) to access WIN-841PV4HEK0O.dc2022.test using Kerberos
>cli_session_setup_spnego_send: Connect to WIN-841PV4HEK0O.dc2022.test as Administrator@DC2022.TEST using SPNEGO
>GENSEC backend 'gssapi_spnego' registered
>GENSEC backend 'gssapi_krb5' registered
>GENSEC backend 'gssapi_krb5_sasl' registered
>GENSEC backend 'spnego' registered
>GENSEC backend 'schannel' registered
>GENSEC backend 'ncalrpc_as_system' registered
>GENSEC backend 'sasl-EXTERNAL' registered
>GENSEC backend 'ntlmssp' registered
>GENSEC backend 'ntlmssp_resume_ccache' registered
>GENSEC backend 'http_basic' registered
>GENSEC backend 'http_ntlm' registered
>GENSEC backend 'http_negotiate' registered
>GENSEC backend 'krb5' registered
>GENSEC backend 'fake_gssapi_krb5' registered
>Starting GENSEC mechanism spnego
>Starting GENSEC submechanism gse_krb5
>gensec_update_send: gse_krb5[0x5561ecc7bef0]: subreq: 0x5561ecc5b0a0
>gensec_update_send: spnego[0x5561ecc76a60]: subreq: 0x5561ecc83c90
>gensec_update_done: gse_krb5[0x5561ecc7bef0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x5561ecc5b0a0/../../source3/librpc/crypto/gse.c:895]: state[2] error[0 (0x0)]Â  state[struct gensec_gse_update_state (0x5561ecc5b280)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906]
>gensec_update_done: spnego[0x5561ecc76a60]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x5561ecc83c90/../../auth/gensec/spnego.c:1631]: state[2] error[0 (0x0)]Â  state[struct gensec_spnego_update_state (0x5561ecc83e70)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116]
>gensec_update_send: gse_krb5[0x5561ecc7bef0]: subreq: 0x5561ecc7b910
>gensec_update_send: spnego[0x5561ecc76a60]: subreq: 0x5561ecc83c90
>gensec_update_done: gse_krb5[0x5561ecc7bef0]: NT_STATUS_OK tevent_req[0x5561ecc7b910/../../source3/librpc/crypto/gse.c:895]: state[2] error[0 (0x0)]Â  state[struct gensec_gse_update_state (0x5561ecc7baf0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913]
>gensec_update_done: spnego[0x5561ecc76a60]: NT_STATUS_OK tevent_req[0x5561ecc83c90/../../auth/gensec/spnego.c:1631]: state[2] error[0 (0x0)]Â  state[struct gensec_spnego_update_state (0x5561ecc83e70)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116]
>signed SMB2 message (sign_algo_id=2)
>signed SMB2 message (sign_algo_id=2)
>Bind RPC Pipe: host WIN-841PV4HEK0O.dc2022.test auth_type 0, auth_level 1
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_BIND (11)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0048 (72)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000001 (1)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 11)
>Â Â Â Â Â Â Â  bind: struct dcerpc_bind
>Â Â Â Â Â Â Â Â Â Â Â  max_xmit_fragÂ Â Â Â Â Â Â Â Â Â Â  : 0x10b8 (4280)
>Â Â Â Â Â Â Â Â Â Â Â  max_recv_fragÂ Â Â Â Â Â Â Â Â Â Â  : 0x10b8 (4280)
>Â Â Â Â Â Â Â Â Â Â Â  assoc_group_idÂ Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  num_contextsÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â  ctx_list: ARRAY(1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ctx_list: struct dcerpc_ctx_list
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  num_transfer_syntaxesÂ Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  abstract_syntax: struct ndr_syntax_id
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 12345778-1234-abcd-ef00-0123456789ab
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  if_versionÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  transfer_syntaxes: ARRAY(1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  transfer_syntaxes: struct ndr_syntax_id
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 8a885d04-1ceb-11c9-9fe8-08002b104860
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  if_versionÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000002 (2)
>Â Â Â Â Â Â Â Â Â Â Â  auth_infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 52
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_BIND_ACK (12)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0044 (68)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000001 (1)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 12)
>Â Â Â Â Â Â Â  bind_ack: struct dcerpc_bind_ack
>Â Â Â Â Â Â Â Â Â Â Â  max_xmit_fragÂ Â Â Â Â Â Â Â Â Â Â  : 0x10b8 (4280)
>Â Â Â Â Â Â Â Â Â Â Â  max_recv_fragÂ Â Â Â Â Â Â Â Â Â Â  : 0x10b8 (4280)
>Â Â Â Â Â Â Â Â Â Â Â  assoc_group_idÂ Â Â Â Â Â Â Â Â Â  : 0x0000310c (12556)
>Â Â Â Â Â Â Â Â Â Â Â  secondary_address_sizeÂ Â  : 0x000c (12)
>Â Â Â Â Â Â Â Â Â Â Â  secondary_addressÂ Â Â Â Â Â Â  : '\pipe\lsass'
>Â Â Â Â Â Â Â Â Â Â Â  _pad1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DATA_BLOB length=2
>[0000] 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ..
>Â Â Â Â Â Â Â Â Â Â Â  num_resultsÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â  ctx_list: ARRAY(1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ctx_list: struct dcerpc_ack_ctx
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  reasonÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_bind_ack_reason(case 0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  valueÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  syntax: struct ndr_syntax_id
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 8a885d04-1ceb-11c9-9fe8-08002b104860
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  if_versionÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000002 (2)
>Â Â Â Â Â Â Â Â Â Â Â  auth_infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe_got_pdu: got frag len of 68 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 68 bytes.
>check_bind_response: accepted!
>cli_rpc_pipe_open_noauth: opened pipe lsarpc to machine WIN-841PV4HEK0O.dc2022.test and bound anonymously.
>Â Â Â Â  lsa_OpenPolicy: struct lsa_OpenPolicy
>Â Â Â Â Â Â Â  in: struct lsa_OpenPolicy
>Â Â Â Â Â Â Â Â Â Â Â  system_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  system_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x005c (92)
>Â Â Â Â Â Â Â Â Â Â Â  attrÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  attr: struct lsa_ObjectAttribute
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  lenÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000018 (24)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  root_dirÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  object_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  attributesÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sec_descÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sec_qosÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sec_qos: struct lsa_QosInfo
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  lenÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000c (12)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  impersonation_levelÂ Â Â Â Â  : 0x0002 (2)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  context_modeÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  effective_onlyÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  access_maskÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x02000000 (33554432)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_VIEW_LOCAL_INFORMATION
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_VIEW_AUDIT_INFORMATION
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_GET_PRIVATE_INFORMATION
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_TRUST_ADMIN
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_CREATE_ACCOUNT
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_CREATE_SECRET
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_CREATE_PRIVILEGE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_SET_AUDIT_REQUIREMENTS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_AUDIT_LOG_ADMIN
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_SERVER_ADMIN
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_LOOKUP_NAMES
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: LSA_POLICY_NOTIFICATION
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000002 (2)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000002c (44)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0006 (6)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 32
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0030 (48)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000002 (2)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000018 (24)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=24
>[0000] 00 00 00 00 6C CE 31 9AÂ Â  1A 30 0A 4F 94 54 2B 38Â Â  ....l.1. .0.O.T+8
>[0010] AB 1B 7F 35 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Â Â Â Â Â Â ...5....
>Got pdu len 48, data_len 24
>rpc_api_pipe_got_pdu: got frag len of 48 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 24 bytes.
>Â Â Â Â  lsa_OpenPolicy: struct lsa_OpenPolicy
>Â Â Â Â Â Â Â  out: struct lsa_OpenPolicy
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 9a31ce6c-301a-4f0a-9454-2b38ab1b7f35
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Â Â Â Â  lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2
>Â Â Â Â Â Â Â  in: struct lsa_QueryInfoPolicy2
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 9a31ce6c-301a-4f0a-9454-2b38ab1b7f35
>Â Â Â Â Â Â Â Â Â Â Â  levelÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : LSA_POLICY_INFO_DNS (12)
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000003 (3)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000016 (22)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x002e (46)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 188
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00cc (204)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000003 (3)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x000000b4 (180)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=180
>[0000] 00 00 02 00 0C 00 00 00Â Â  0C 00 0E 00 04 00 02 00Â Â  ........ ........
>[0010] 16 00 18 00 08 00 02 00Â Â  16 00 18 00 0C 00 02 00Â Â  ........ ........
>[0020] 73 90 A9 15 53 05 DA 41Â Â  90 71 FF 82 70 E0 CF 35Â Â  s...S..A .q..p..5
>[0030] 10 00 02 00 07 00 00 00Â Â  00 00 00 00 06 00 00 00Â Â  ........ ........
>[0040] 44 00 43 00 32 00 30 00Â Â  32 00 32 00 0C 00 00 00Â Â  D.C.2.0. 2.2.....
>[0050] 00 00 00 00 0B 00 00 00Â Â  64 00 63 00 32 00 30 00Â Â  ........ d.c.2.0.
>[0060] 32 00 32 00 2E 00 74 00Â Â  65 00 73 00 74 00 00 00Â Â  2.2...t. e.s.t...
>[0070] 0C 00 00 00 00 00 00 00Â Â  0B 00 00 00 64 00 63 00Â Â  ........ ....d.c.
>[0080] 32 00 30 00 32 00 32 00Â Â  2E 00 74 00 65 00 73 00Â Â  2.0.2.2. ..t.e.s.
>[0090] 74 00 00 00 04 00 00 00Â Â  01 04 00 00 00 00 00 05Â Â  t....... ........
>[00A0] 15 00 00 00 00 2B C4 ACÂ Â  2C 49 C2 ED A3 C0 51 A1Â Â  .....+.. ,I....Q.
>[00B0] 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ....
>Got pdu len 204, data_len 180
>rpc_api_pipe_got_pdu: got frag len of 204 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 180 bytes.
>Â Â Â Â  lsa_QueryInfoPolicy2: struct lsa_QueryInfoPolicy2
>Â Â Â Â Â Â Â  out: struct lsa_QueryInfoPolicy2
>Â Â Â Â Â Â Â Â Â Â Â  infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union lsa_PolicyInformation(case 12)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dns: struct lsa_DnsDomainInfo
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  name: struct lsa_StringLarge
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x000c (12)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sizeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x000e (14)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'DC2022'
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dns_domain: struct lsa_StringLarge
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0016 (22)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sizeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dns_forest: struct lsa_StringLarge
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0016 (22)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sizeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_guidÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 15a99073-0553-41da-9071-ff8270e0cf35
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : S-1-5-21-2898537216-3988932908-2706489507
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Â Â Â Â  lsa_Close: struct lsa_Close
>Â Â Â Â Â Â Â  in: struct lsa_Close
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 9a31ce6c-301a-4f0a-9454-2b38ab1b7f35
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000004 (4)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000014 (20)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 32
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0030 (48)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000004 (4)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000018 (24)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=24
>[0000] 00 00 00 00 00 00 00 00Â Â  00 00 00 00 00 00 00 00Â Â  ........ ........
>[0010] 00 00 00 00 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ........
>Got pdu len 48, data_len 24
>rpc_api_pipe_got_pdu: got frag len of 48 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 24 bytes.
>Â Â Â Â  lsa_Close: struct lsa_Close
>Â Â Â Â Â Â Â  out: struct lsa_Close
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 00000000-0000-0000-0000-000000000000
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>signed SMB2 message (sign_algo_id=2)
>create_local_private_krb5_conf_for_domain: fname = /usr/local/samba/var/lock/smb_krb5/krb5.conf.DC2022, realm = dc2022.test, domain = DC2022
>saf_fetch: failed to find server for "dc2022.test" domain
>get_dc_list: preferred server list: ", *"
>internal_resolve_name: looking up dc2022.test#dcdc (sitename Default-First-Site-Name)
>resolve_ads: Attempting to resolve KDCs for dc2022.test using DNS
>resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.dc2022.test
>dns_lookup_send_next: Sending DNS request #0 to 10.5.139.71
>dns_cli_request_send: Asking 10.5.139.71 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.dc2022.test/1/33 via UDP
>[0000] C2 ED 01 00 00 01 00 00Â Â  00 00 00 00 09 5F 6B 65Â Â  ........ ....._ke
>[0010] 72 62 65 72 6F 73 04 5FÂ Â  74 63 70 17 44 65 66 61Â Â  rberos._ tcp.Defa
>[0020] 75 6C 74 2D 46 69 72 73Â Â  74 2D 53 69 74 65 2D 4EÂ Â  ult-Firs t-Site-N
>[0030] 61 6D 65 06 5F 73 69 74Â Â  65 73 02 64 63 06 5F 6DÂ Â  ame._sit es.dc._m
>[0040] 73 64 63 73 06 64 63 32Â Â  30 32 32 04 74 65 73 74Â Â  sdcs.dc2 022.test
>[0050] 00 00 21 00 01Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ..!..
>[0000] C2 ED 85 80 00 01 00 01Â Â  00 00 00 01 09 5F 6B 65Â Â  ........ ....._ke
>[0010] 72 62 65 72 6F 73 04 5FÂ Â  74 63 70 17 44 65 66 61Â Â  rberos._ tcp.Defa
>[0020] 75 6C 74 2D 46 69 72 73Â Â  74 2D 53 69 74 65 2D 4EÂ Â  ult-Firs t-Site-N
>[0030] 61 6D 65 06 5F 73 69 74Â Â  65 73 02 64 63 06 5F 6DÂ Â  ame._sit es.dc._m
>[0040] 73 64 63 73 06 64 63 32Â Â  30 32 32 04 74 65 73 74Â Â  sdcs.dc2 022.test
>[0050] 00 00 21 00 01 C0 0C 00Â Â  21 00 01 00 00 02 58 00Â Â  ..!..... !.....X.
>[0060] 23 00 00 00 64 00 58 0FÂ Â  77 69 6E 2D 38 34 31 70Â Â  #...d.X. win-841p
>[0070] 76 34 68 65 6B 30 6F 06Â Â  64 63 32 30 32 32 04 74Â Â  v4hek0o. dc2022.t
>[0080] 65 73 74 00 C0 67 00 01Â Â  00 01 00 00 0E 10 00 04Â Â  est..g.. ........
>[0090] 0A 05 8B 47Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ...G
>resolve_ads: SRV lookup dc2022.test got IP[0] 10.5.139.71
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>internal_resolve_name: returning 1 addresses: 10.5.139.71
>get_dc_list: Adding 1 DC's from auto lookup
>check_negative_conn_cache returning result 0 for domain dc2022.test server 10.5.139.71
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>get_dc_list: returning 1 ip addresses in an ordered list
>get_dc_list: 10.5.139.71
>get_kdc_ip_string: got 1 addresses from site Default-First-Site-Name search
>saf_fetch: failed to find server for "dc2022.test" domain
>get_dc_list: preferred server list: ", *"
>internal_resolve_name: looking up dc2022.test#dcdc (sitename (null))
>resolve_ads: Attempting to resolve KDCs for dc2022.test using DNS
>resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.dc2022.test
>dns_lookup_send_next: Sending DNS request #0 to 10.5.139.71
>dns_cli_request_send: Asking 10.5.139.71 for _kerberos._tcp.dc._msdcs.dc2022.test/1/33 via UDP
>[0000] A8 C9 01 00 00 01 00 00Â Â  00 00 00 00 09 5F 6B 65Â Â  ........ ....._ke
>[0010] 72 62 65 72 6F 73 04 5FÂ Â  74 63 70 02 64 63 06 5FÂ Â  rberos._ tcp.dc._
>[0020] 6D 73 64 63 73 06 64 63Â Â  32 30 32 32 04 74 65 73Â Â  msdcs.dc 2022.tes
>[0030] 74 00 00 21 00 01Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  t..!..
>[0000] A8 C9 85 80 00 01 00 01Â Â  00 00 00 01 09 5F 6B 65Â Â  ........ ....._ke
>[0010] 72 62 65 72 6F 73 04 5FÂ Â  74 63 70 02 64 63 06 5FÂ Â  rberos._ tcp.dc._
>[0020] 6D 73 64 63 73 06 64 63Â Â  32 30 32 32 04 74 65 73Â Â  msdcs.dc 2022.tes
>[0030] 74 00 00 21 00 01 C0 0CÂ Â  00 21 00 01 00 00 02 58Â Â  t..!.... .!.....X
>[0040] 00 23 00 00 00 64 00 58Â Â  0F 77 69 6E 2D 38 34 31Â Â  .#...d.X .win-841
>[0050] 70 76 34 68 65 6B 30 6FÂ Â  06 64 63 32 30 32 32 04Â Â  pv4hek0o .dc2022.
>[0060] 74 65 73 74 00 C0 48 00Â Â  01 00 01 00 00 0E 10 00Â Â  test..H. ........
>[0070] 04 0A 05 8B 47Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ....G
>resolve_ads: SRV lookup dc2022.test got IP[0] 10.5.139.71
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>internal_resolve_name: returning 1 addresses: 10.5.139.71
>get_dc_list: Adding 1 DC's from auto lookup
>check_negative_conn_cache returning result 0 for domain dc2022.test server 10.5.139.71
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>get_dc_list: returning 1 ip addresses in an ordered list
>get_dc_list: 10.5.139.71
>get_kdc_ip_string: got 1 addresses from site-less search
>get_kdc_ip_string: 0 additional KDCs to test
>get_kdc_ip_string: Returning
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  kdc = 10.5.139.71
>Â 
>create_local_private_krb5_conf_for_domain: wrote file /usr/local/samba/var/lock/smb_krb5/krb5.conf.DC2022 with realm DC2022.TEST KDC list:
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  kdc = 10.5.139.71
>Â 
>sitename_fetch: Returning sitename for realm 'DC2022.TEST': "Default-First-Site-Name"
>internal_resolve_name: looking up WIN-841PV4HEK0O.dc2022.test#20 (sitename Default-First-Site-Name)
>namecache_fetch: name WIN-841PV4HEK0O.dc2022.test#20 found.
>remove_duplicate_addrs2: looking for duplicate address/port pairs
>ads_try_connect: ads_try_connect: sending CLDAP request to 10.5.139.71 (realm: dc2022.test)
>Â Â Â Â  &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX
>Â Â Â Â Â Â Â  commandÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : LOGON_SAM_LOGON_RESPONSE_EX (23)
>Â Â Â Â Â Â Â  sbzÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  server_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0007f3fd (521213)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_PDC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_GC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_LDAP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_KDC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_TIMESERV
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_CLOSEST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_WRITABLE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_GOOD_TIMESERV
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_NDNC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_SELECT_SECRET_DOMAIN_6
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_FULL_SECRET_DOMAIN_6
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_ADS_WEB_SERVICE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS_8
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS_9
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS_10
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_HAS_DNS_NAME
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_IS_DEFAULT_NC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_FOREST_ROOT
>Â Â Â Â Â Â Â  domain_uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 15a99073-0553-41da-9071-ff8270e0cf35
>Â Â Â Â Â Â Â  forestÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â  dns_domainÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â  pdc_dns_nameÂ Â Â Â Â Â Â Â Â Â Â Â  : 'WIN-841PV4HEK0O.dc2022.test'
>Â Â Â Â Â Â Â  domain_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'DC2022'
>Â Â Â Â Â Â Â  pdc_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'WIN-841PV4HEK0O'
>Â Â Â Â Â Â Â  user_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : ''
>Â Â Â Â Â Â Â  server_siteÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'Default-First-Site-Name'
>Â Â Â Â Â Â Â  client_siteÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'Default-First-Site-Name'
>Â Â Â Â Â Â Â  sockaddr_sizeÂ Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  sockaddr: struct nbt_sockaddr
>Â Â Â Â Â Â Â Â Â Â Â  sockaddr_familyÂ Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  pdc_ipÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : (null)
>Â Â Â Â Â Â Â Â Â Â Â  remainingÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DATA_BLOB length=0
>Â Â Â Â Â Â Â  next_closest_siteÂ Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â  nt_versionÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000005 (5)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NETLOGON_NT_VERSION_1
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_5
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NETLOGON_NT_VERSION_5EX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_5EX_WITH_IP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_AVOID_NT4EMUL
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_PDC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_IP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_LOCAL
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NETLOGON_NT_VERSION_GC
>Â Â Â Â Â Â Â  lmnt_tokenÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0xffff (65535)
>Â Â Â Â Â Â Â  lm20_tokenÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0xffff (65535)
>sitename_store: realm = [DC2022], sitename = [Default-First-Site-Name], expire = [2085923199]
>gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/DC2022] and timeout=[Wed Dec 31 11:59:59 PM -2147481749 UTC] (67768034494498205 seconds ahead)
>sitename_store: realm = [dc2022.test], sitename = [Default-First-Site-Name], expire = [2085923199]
>gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/DC2022.TEST] and timeout=[Wed Dec 31 11:59:59 PM -2147481749 UTC] (67768034494498205 seconds ahead)
>Successfully contacted LDAP server 10.5.139.71
>Opening connection to LDAP server 'WIN-841PV4HEK0O.dc2022.test:389', timeout 15 seconds
>Connecting to 10.5.139.71 at port 389
>Initialized connection for LDAP server 'ldap://WIN-841PV4HEK0O.dc2022.test:389'
>Connected to LDAP server WIN-841PV4HEK0O.dc2022.test
>ads_closest_dc: NBT_SERVER_CLOSEST flag set
>saf_store: domain = [DC2022], server = [WIN-841PV4HEK0O.dc2022.test], expire = [1697179494]
>gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/DC2022] and timeout=[Fri Oct 13 06:44:54 AM 2023 UTC] (900 seconds ahead)
>saf_store: domain = [dc2022.test], server = [WIN-841PV4HEK0O.dc2022.test], expire = [1697179494]
>gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/DC2022.TEST] and timeout=[Fri Oct 13 06:44:54 AM 2023 UTC] (900 seconds ahead)
>KDC time offset is 6 seconds
>Found SASL mechanism GSS-SPNEGO
>ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.30
>ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2
>ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2
>ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2.3
>ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10
>kerberos_kinit_password_ext: as Administrator@DC2022.TEST using [MEMORY:cliconnect] as ccache and config [/usr/local/samba/var/lock/smb_krb5/krb5.conf.DC2022]
>kerberos_kinit_password_ext: Administrator@DC2022.TEST mapped to Administrator@DC2022.TEST
>Starting GENSEC mechanism spnego
>Starting GENSEC submechanism gse_krb5
>gensec_update_send: gse_krb5[0x5561ecc76a60]: subreq: 0x5561ecc5b0a0
>gensec_update_send: spnego[0x5561ecc7bef0]: subreq: 0x5561ecc89c50
>gensec_update_done: gse_krb5[0x5561ecc76a60]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x5561ecc5b0a0/../../source3/librpc/crypto/gse.c:895]: state[2] error[0 (0x0)]Â  state[struct gensec_gse_update_state (0x5561ecc5b280)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906]
>gensec_update_done: spnego[0x5561ecc7bef0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x5561ecc89c50/../../auth/gensec/spnego.c:1631]: state[2] error[0 (0x0)]Â  state[struct gensec_spnego_update_state (0x5561ecc89e30)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116]
>gensec_update_send: gse_krb5[0x5561ecc76a60]: subreq: 0x5561ecc5b0a0
>gensec_update_send: spnego[0x5561ecc7bef0]: subreq: 0x5561ecc89c50
>gensec_update_done: gse_krb5[0x5561ecc76a60]: NT_STATUS_OK tevent_req[0x5561ecc5b0a0/../../source3/librpc/crypto/gse.c:895]: state[2] error[0 (0x0)]Â  state[struct gensec_gse_update_state (0x5561ecc5b280)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913]
>gensec_update_done: spnego[0x5561ecc7bef0]: NT_STATUS_OK tevent_req[0x5561ecc89c50/../../auth/gensec/spnego.c:1631]: state[2] error[0 (0x0)]Â  state[struct gensec_spnego_update_state (0x5561ecc89e30)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116]
>gensec_gse_unwrap: GSS UnWrap failed:Â  A token was invalid: unknown mech-code 0 for mech 1 2 840 113554 1 2 2
>Failed while searching for: <WKGUID=AA312825768811D1ADED00C04FD8D5CD,dc=DC2022,dc=TEST>
>libnet_DomainJoin: Failed to pre-create account in OU cn=Computers,dc=DC2022,dc=TEST: Time limit exceeded
>signed SMB2 message (sign_algo_id=2)
>Bind RPC Pipe: host WIN-841PV4HEK0O.dc2022.test auth_type 0, auth_level 1
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_BIND (11)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0048 (72)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000005 (5)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 11)
>Â Â Â Â Â Â Â  bind: struct dcerpc_bind
>Â Â Â Â Â Â Â Â Â Â Â  max_xmit_fragÂ Â Â Â Â Â Â Â Â Â Â  : 0x10b8 (4280)
>Â Â Â Â Â Â Â Â Â Â Â  max_recv_fragÂ Â Â Â Â Â Â Â Â Â Â  : 0x10b8 (4280)
>Â Â Â Â Â Â Â Â Â Â Â  assoc_group_idÂ Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  num_contextsÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â  ctx_list: ARRAY(1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ctx_list: struct dcerpc_ctx_list
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  num_transfer_syntaxesÂ Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  abstract_syntax: struct ndr_syntax_id
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 12345778-1234-abcd-ef00-0123456789ac
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  if_versionÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000001 (1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  transfer_syntaxes: ARRAY(1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  transfer_syntaxes: struct ndr_syntax_id
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 8a885d04-1ceb-11c9-9fe8-08002b104860
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  if_versionÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000002 (2)
>Â Â Â Â Â Â Â Â Â Â Â  auth_infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 52
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_BIND_ACK (12)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0044 (68)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000005 (5)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 12)
>Â Â Â Â Â Â Â  bind_ack: struct dcerpc_bind_ack
>Â Â Â Â Â Â Â Â Â Â Â  max_xmit_fragÂ Â Â Â Â Â Â Â Â Â Â  : 0x10b8 (4280)
>Â Â Â Â Â Â Â Â Â Â Â  max_recv_fragÂ Â Â Â Â Â Â Â Â Â Â  : 0x10b8 (4280)
>Â Â Â Â Â Â Â Â Â Â Â  assoc_group_idÂ Â Â Â Â Â Â Â Â Â  : 0x0000310d (12557)
>Â Â Â Â Â Â Â Â Â Â Â  secondary_address_sizeÂ Â  : 0x000c (12)
>Â Â Â Â Â Â Â Â Â Â Â  secondary_addressÂ Â Â Â Â Â Â  : '\pipe\lsass'
>Â Â Â Â Â Â Â Â Â Â Â  _pad1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DATA_BLOB length=2
>[0000] 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ..
>Â Â Â Â Â Â Â Â Â Â Â  num_resultsÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â  ctx_list: ARRAY(1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ctx_list: struct dcerpc_ack_ctx
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  reasonÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_bind_ack_reason(case 0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  valueÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  syntax: struct ndr_syntax_id
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 8a885d04-1ceb-11c9-9fe8-08002b104860
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  if_versionÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000002 (2)
>Â Â Â Â Â Â Â Â Â Â Â  auth_infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe_got_pdu: got frag len of 68 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 68 bytes.
>check_bind_response: accepted!
>cli_rpc_pipe_open_noauth: opened pipe samr to machine WIN-841PV4HEK0O.dc2022.test and bound anonymously.
>Â Â Â Â  samr_Connect2: struct samr_Connect2
>Â Â Â Â Â Â Â  in: struct samr_Connect2
>Â Â Â Â Â Â Â Â Â Â Â  system_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  system_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'WIN-841PV4HEK0O.dc2022.test'
>Â Â Â Â Â Â Â Â Â Â Â  access_maskÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000030 (48)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_ACCESS_CONNECT_TO_SERVER
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_ACCESS_SHUTDOWN_SERVER
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_ACCESS_INITIALIZE_SERVER
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_ACCESS_CREATE_DOMAIN
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: SAMR_ACCESS_ENUM_DOMAINS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: SAMR_ACCESS_LOOKUP_DOMAIN
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000006 (6)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000004c (76)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0039 (57)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 32
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0030 (48)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000006 (6)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000018 (24)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=24
>[0000] 00 00 00 00 D7 6C F5 A3Â Â  4D E5 2E 40 81 6E F4 F7Â Â  .....l.. M..@.n..
>[0010] 9F 53 65 95 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  .Se.....
>Got pdu len 48, data_len 24
>rpc_api_pipe_got_pdu: got frag len of 48 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 24 bytes.
>Â Â Â Â  samr_Connect2: struct samr_Connect2
>Â Â Â Â Â Â Â  out: struct samr_Connect2
>Â Â Â Â Â Â Â Â Â Â Â  connect_handleÂ Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  connect_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : a3f56cd7-e54d-402e-816e-f4f79f536595
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Â Â Â Â  samr_OpenDomain: struct samr_OpenDomain
>Â Â Â Â Â Â Â  in: struct samr_OpenDomain
>Â Â Â Â Â Â Â Â Â Â Â  connect_handleÂ Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  connect_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : a3f56cd7-e54d-402e-816e-f4f79f536595
>Â Â Â Â Â Â Â Â Â Â Â  access_maskÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000211 (529)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_DOMAIN_ACCESS_SET_INFO_1
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_DOMAIN_ACCESS_SET_INFO_2
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: SAMR_DOMAIN_ACCESS_CREATE_USER
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_DOMAIN_ACCESS_CREATE_GROUP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_DOMAIN_ACCESS_CREATE_ALIAS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_DOMAIN_ACCESS_SET_INFO_3
>Â Â Â Â Â Â Â Â Â Â Â  sidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : S-1-5-21-2898537216-3988932908-2706489507
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000007 (7)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000034 (52)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0007 (7)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 32
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0030 (48)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000007 (7)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000018 (24)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=24
>[0000] 00 00 00 00 E8 AF 02 34Â Â  6E 67 4F 44 A4 14 F0 5AÂ Â  .......4 ngOD...Z
>[0010] C9 9F D4 F6 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ........
>Got pdu len 48, data_len 24
>rpc_api_pipe_got_pdu: got frag len of 48 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 24 bytes.
>Â Â Â Â  samr_OpenDomain: struct samr_OpenDomain
>Â Â Â Â Â Â Â  out: struct samr_OpenDomain
>Â Â Â Â Â Â Â Â Â Â Â  domain_handleÂ Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 3402afe8-676e-444f-a414-f05ac99fd4f6
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Creating account with desired access mask: -536543056
>Â Â Â Â  samr_CreateUser2: struct samr_CreateUser2
>Â Â Â Â Â Â Â  in: struct samr_CreateUser2
>Â Â Â Â Â Â Â Â Â Â Â  domain_handleÂ Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 3402afe8-676e-444f-a414-f05ac99fd4f6
>Â Â Â Â Â Â Â Â Â Â Â  account_nameÂ Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  account_name: struct lsa_String
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sizeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'oak-vcs1307$'
>Â Â Â Â Â Â Â Â Â Â Â  acct_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000080 (128)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_DISABLED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_HOMDIRREQ
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_PWNOTREQ
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_TEMPDUP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_NORMAL
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_MNS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_DOMTRUST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: ACB_WSTRUST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_SVRTRUST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_PWNOEXP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_AUTOLOCK
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_ENC_TXT_PWD_ALLOWED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_SMARTCARD_REQUIRED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_TRUSTED_FOR_DELEGATION
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_NOT_DELEGATED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_USE_DES_KEY_ONLY
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_DONT_REQUIRE_PREAUTH
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_PW_EXPIRED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_NO_AUTH_DATA_REQD
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_PARTIAL_SECRETS_ACCOUNT
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_USE_AES_KEYS
>Â Â Â Â Â Â Â Â Â Â Â  access_maskÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0xe00500b0 (3758424240)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_NAME_ETC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_LOCALE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_SET_LOC_COM
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_LOGONINFO
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: SAMR_USER_ACCESS_GET_ATTRIBUTES
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: SAMR_USER_ACCESS_SET_ATTRIBUTES
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_CHANGE_PASSWORD
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: SAMR_USER_ACCESS_SET_PASSWORD
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_GROUPS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000008 (8)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000048 (72)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0032 (50)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 40
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0038 (56)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000008 (8)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000020 (32)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=32
>[0000] 00 00 00 00 00 00 00 00Â Â  00 00 00 00 00 00 00 00Â Â  ........ ........
>[0010] 00 00 00 00 00 00 00 00Â Â  00 00 00 00 63 00 00 C0Â Â  ........ ....c...
>Got pdu len 56, data_len 32
>rpc_api_pipe_got_pdu: got frag len of 56 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 32 bytes.
>Â Â Â Â  samr_CreateUser2: struct samr_CreateUser2
>Â Â Â Â Â Â Â  out: struct samr_CreateUser2
>Â Â Â Â Â Â Â Â Â Â Â  user_handleÂ Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  user_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 00000000-0000-0000-0000-000000000000
>Â Â Â Â Â Â Â Â Â Â Â  access_grantedÂ Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  access_grantedÂ Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  ridÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ridÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_USER_EXISTS
>Â Â Â Â  samr_LookupNames: struct samr_LookupNames
>Â Â Â Â Â Â Â  in: struct samr_LookupNames
>Â Â Â Â Â Â Â Â Â Â Â  domain_handleÂ Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 3402afe8-676e-444f-a414-f05ac99fd4f6
>Â Â Â Â Â Â Â Â Â Â Â  num_namesÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000001 (1)
>Â Â Â Â Â Â Â Â Â Â Â  names: ARRAY(1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  names: struct lsa_String
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  sizeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  stringÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 'oak-vcs1307$'
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000009 (9)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000050 (80)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0011 (17)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 44
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x003c (60)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000009 (9)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000024 (36)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=36
>[0000] 01 00 00 00 00 00 02 00Â Â  01 00 00 00 59 04 00 00Â Â  ........ ....Y...
>[0010] 01 00 00 00 04 00 02 00Â Â  01 00 00 00 01 00 00 00Â Â  ........ ........
>[0020] 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ....
>Got pdu len 60, data_len 36
>rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 36 bytes.
>Â Â Â Â  samr_LookupNames: struct samr_LookupNames
>Â Â Â Â Â Â Â  out: struct samr_LookupNames
>Â Â Â Â Â Â Â Â Â Â Â  ridsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  rids: struct samr_Ids
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  countÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000001 (1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  idsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ids: ARRAY(1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  idsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000459 (1113)
>Â Â Â Â Â Â Â Â Â Â Â  typesÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  types: struct samr_Ids
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  countÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000001 (1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  idsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ids: ARRAY(1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  idsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000001 (1)
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Â Â Â Â  samr_OpenUser: struct samr_OpenUser
>Â Â Â Â Â Â Â  in: struct samr_OpenUser
>Â Â Â Â Â Â Â Â Â Â Â  domain_handleÂ Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 3402afe8-676e-444f-a414-f05ac99fd4f6
>Â Â Â Â Â Â Â Â Â Â Â  access_maskÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x02000000 (33554432)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_NAME_ETC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_LOCALE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_SET_LOC_COM
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_LOGONINFO
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_ATTRIBUTES
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_SET_ATTRIBUTES
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_CHANGE_PASSWORD
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_SET_PASSWORD
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_GROUPS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP
>Â Â Â Â Â Â Â Â Â Â Â  ridÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000459 (1113)
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000a (10)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000001c (28)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0022 (34)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 32
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0030 (48)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000a (10)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000018 (24)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=24
>[0000] 00 00 00 00 53 71 BA C4Â Â  B1 EB D5 4D BA D5 73 8BÂ Â  ....Sq.. ...M..s.
>[0010] DB 6E 62 7A 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  .nbz....
>Got pdu len 48, data_len 24
>rpc_api_pipe_got_pdu: got frag len of 48 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 24 bytes.
>Â Â Â Â  samr_OpenUser: struct samr_OpenUser
>Â Â Â Â Â Â Â  out: struct samr_OpenUser
>Â Â Â Â Â Â Â Â Â Â Â  user_handleÂ Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  user_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : c4ba7153-ebb1-4dd5-bad5-738bdb6e627a
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Â Â Â Â  samr_SetUserInfo2: struct samr_SetUserInfo2
>Â Â Â Â Â Â Â  in: struct samr_SetUserInfo2
>Â Â Â Â Â Â Â Â Â Â Â  user_handleÂ Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  user_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : c4ba7153-ebb1-4dd5-bad5-738bdb6e627a
>Â Â Â Â Â Â Â Â Â Â Â  levelÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : UserControlInformation (16)
>Â Â Â Â Â Â Â Â Â Â Â  infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union samr_UserInfo(case 16)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  info16: struct samr_UserInfo16
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  acct_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000280 (640)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_DISABLED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_HOMDIRREQ
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_PWNOTREQ
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_TEMPDUP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_NORMAL
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_MNS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_DOMTRUST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: ACB_WSTRUST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_SVRTRUST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: ACB_PWNOEXP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_AUTOLOCK
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_ENC_TXT_PWD_ALLOWED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_SMARTCARD_REQUIRED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_TRUSTED_FOR_DELEGATION
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_NOT_DELEGATED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_USE_DES_KEY_ONLY
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_DONT_REQUIRE_PREAUTH
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_PW_EXPIRED
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_NO_AUTH_DATA_REQD
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_PARTIAL_SECRETS_ACCOUNT
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: ACB_USE_AES_KEYS
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000b (11)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000001c (28)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x003a (58)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 12
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x001c (28)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000b (11)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000004 (4)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=4
>[0000] 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ....
>Got pdu len 28, data_len 4
>rpc_api_pipe_got_pdu: got frag len of 28 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 4 bytes.
>Â Â Â Â  samr_SetUserInfo2: struct samr_SetUserInfo2
>Â Â Â Â Â Â Â  out: struct samr_SetUserInfo2
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Â Â Â Â  samr_SetUserInfo2: struct samr_SetUserInfo2
>Â Â Â Â Â Â Â  in: struct samr_SetUserInfo2
>Â Â Â Â Â Â Â Â Â Â Â  user_handleÂ Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  user_handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : c4ba7153-ebb1-4dd5-bad5-738bdb6e627a
>Â Â Â Â Â Â Â Â Â Â Â  levelÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : UserInternal5InformationNew (26)
>Â Â Â Â Â Â Â Â Â Â Â  infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  infoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union samr_UserInfo(case 26)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  info26: struct samr_UserInfo26
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  password: struct samr_CryptPasswordEx
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  data: ARRAY(532)
>[0000] 76 F6 AC CC DA 4B 9E 57Â Â  24 3A C3 14 AB 80 24 C7Â Â  v....K.W $:....$.
>[0010] 5C BA 96 98 00 5F D6 B8Â Â  F3 DF 53 2E 2F 53 50 0BÂ Â  \...._.. ..S./SP.
>[0020] A8 F3 02 73 BA 11 15 0DÂ Â  11 23 6D EC 55 4B DD 08Â Â  ...s.... .#m.UK..
>[0030] B2 4E 97 03 2D 2E 21 A5Â Â  58 60 0C 29 79 05 80 CBÂ Â  .N..-.!. X`.)y...
>[0040] 1C DA 35 7E 7F 5E 86 14Â Â  2F E8 94 24 35 01 A8 13Â Â  ..5~.^.. /..$5...
>[0050] C6 18 9E ED D6 46 10 B3Â Â  ED F6 D9 00 12 DE F5 0EÂ Â  .....F.. ........
>[0060] 1D 44 86 AB E8 87 7D 99Â Â  26 31 FF 08 F6 9E 38 F9Â Â  .D....}. &1....8.
>[0070] 72 24 8F 30 4F 97 A3 B7Â Â  F2 7B 0F 96 84 60 37 80Â Â  r$.0O... .{...`7.
>[0080] 90 C8 E6 D3 C2 AF B1 E1Â Â  A6 44 B0 55 A3 D8 28 18Â Â  ........ .D.U..(.
>[0090] 85 7D 49 5E 7E BB FC C5Â Â  B7 75 FB FE 38 24 60 E4Â Â  .}I^~... .u..8$`.
>[00A0] 6E B1 12 9D C1 29 38 E4Â Â  15 3C 68 79 1C 6B 05 03Â Â  n....)8. .<hy.k..
>[00B0] 07 EA 9C E3 4E EF 49 2DÂ Â  53 2F 98 CA 89 1E 51 8AÂ Â  ....N.I- S/....Q.
>[00C0] 4C 33 FE EC A7 B7 A6 6DÂ Â  7A 29 28 04 F4 B4 14 43Â Â  L3.....m z)(....C
>[00D0] E3 31 AD 9A 5C A7 0B 62Â Â  28 53 45 CC 49 DC 02 25Â Â  .1..\..b (SE.I..%
>[00E0] 73 5E 8C 22 8D D7 3A 1BÂ Â  9D A1 86 CE 64 62 E7 37Â Â  s^."..:. ....db.7
>[00F0] 8F 89 74 5C EF C9 98 75Â Â  A5 14 D1 4E A7 D7 FA 3BÂ Â  ..t\...u ...N...;
>[0100] 66 51 6F 35 B8 5A 66 36Â Â  17 56 88 6A AE E6 EA 92Â Â  fQo5.Zf6 .V.j....
>[0110] CF 38 FE 53 24 45 E7 70Â Â  9D 84 61 AA 4E EF 47 88Â Â  .8.S$E.p ..a.N.G.
>[0120] 3C DC 80 6B 8E 36 28 36Â Â  04 92 AE BF A9 40 63 DCÂ Â  <..k.6(6 .....@c.
>[0130] 8F 21 5F DB 43 13 69 0DÂ Â  B9 75 59 09 92 DD DC 22Â Â  .!_.C.i. .uY...."
>[0140] 4A 13 F3 BF 32 CD B6 70Â Â  D7 F1 2E A7 16 ED 1B 62Â Â  J...2..p .......b
>[0150] B1 FE E0 B2 E6 5A 6F 7AÂ Â  10 B0 E7 51 A4 9A D8 C2Â Â  .....Zoz ...Q....
>[0160] 6E 4C C0 A5 44 1B AF 4CÂ Â  39 D8 B6 11 AB 3F 86 DBÂ Â  nL..D..L 9....?..
>[0170] 08 16 5D DA 38 97 A1 0FÂ Â  62 63 3E D1 E6 B5 A8 ABÂ Â  ..].8... bc>.....
>[0180] 0C CC 75 1B AA 65 69 FFÂ Â  E2 84 37 A6 69 24 71 96Â Â  ..u..ei. ..7.i$q.
>[0190] 4C 15 76 45 3B 3A A5 65Â Â  72 CB B9 88 A9 B2 CF D6Â Â  L.vE;:.e r.......
>[01A0] 62 2B 44 E2 4F E4 4A 92Â Â  2E 02 5D CC D0 B0 F7 C5Â Â  b+D.O.J. ..].....
>[01B0] 9D 06 AE 29 6D 2C 22 BCÂ Â  D8 D9 0F BB FC 34 F3 43Â Â  ...)m,". .....4.C
>[01C0] 8C E9 3B 9B 2D 95 D6 F3Â Â  77 8B 0D FC DE F1 44 C8Â Â  ..;.-... w.....D.
>[01D0] 71 FF 1D 08 EE 67 E8 50Â Â  3E 2B A9 EA 61 9A D0 F9Â Â  q....g.P >+..a...
>[01E0] 10 3F 54 1D 7C 95 53 71Â Â  31 06 B8 FF C5 2B 70 FBÂ Â  .?T.|.Sq 1....+p.
>[01F0] C4 E2 45 9F 41 9F 00 6FÂ Â  02 75 C0 F1 89 05 AD C2Â Â  ..E.A..o .u......
>[0200] 26 0D AC A5 A8 72 8A BEÂ Â  83 A4 D8 76 04 11 72 94Â Â  &....r.. ...v..r.
>[0210] 6C 88 C7 90Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  l...
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  password_expiredÂ Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000c (12)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000022d (557)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x003a (58)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 12
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x001c (28)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000c (12)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000004 (4)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=4
>[0000] 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ....
>Got pdu len 28, data_len 4
>rpc_api_pipe_got_pdu: got frag len of 28 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 4 bytes.
>Â Â Â Â  samr_SetUserInfo2: struct samr_SetUserInfo2
>Â Â Â Â Â Â Â  out: struct samr_SetUserInfo2
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Â Â Â Â  samr_Close: struct samr_Close
>Â Â Â Â Â Â Â  in: struct samr_Close
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : a3f56cd7-e54d-402e-816e-f4f79f536595
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000d (13)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000014 (20)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0001 (1)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 32
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0030 (48)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000d (13)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000018 (24)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=24
>[0000] 00 00 00 00 00 00 00 00Â Â  00 00 00 00 00 00 00 00Â Â  ........ ........
>[0010] 00 00 00 00 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ........
>Got pdu len 48, data_len 24
>rpc_api_pipe_got_pdu: got frag len of 48 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 24 bytes.
>Â Â Â Â  samr_Close: struct samr_Close
>Â Â Â Â Â Â Â  out: struct samr_Close
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 00000000-0000-0000-0000-000000000000
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Â Â Â Â  samr_Close: struct samr_Close
>Â Â Â Â Â Â Â  in: struct samr_Close
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 3402afe8-676e-444f-a414-f05ac99fd4f6
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000e (14)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000014 (20)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0001 (1)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 32
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0030 (48)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000e (14)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000018 (24)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=24
>[0000] 00 00 00 00 00 00 00 00Â Â  00 00 00 00 00 00 00 00Â Â  ........ ........
>[0010] 00 00 00 00 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ........
>Got pdu len 48, data_len 24
>rpc_api_pipe_got_pdu: got frag len of 48 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 24 bytes.
>Â Â Â Â  samr_Close: struct samr_Close
>Â Â Â Â Â Â Â  out: struct samr_Close
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 00000000-0000-0000-0000-000000000000
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>Â Â Â Â  samr_Close: struct samr_Close
>Â Â Â Â Â Â Â  in: struct samr_Close
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : c4ba7153-ebb1-4dd5-bad5-738bdb6e627a
>Â Â Â Â  &r: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_REQUEST (0)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0018 (24)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000f (15)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 0)
>Â Â Â Â Â Â Â  request: struct dcerpc_request
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000014 (20)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  opnumÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0001 (1)
>Â Â Â Â Â Â Â Â Â Â Â  objectÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_object(case 0)
>Â Â Â Â Â Â Â Â Â Â Â  empty: struct dcerpc_empty
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=0
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test
>signed SMB2 message (sign_algo_id=2)
>rpc_read_send: data_to_read: 32
>Â Â Â Â  state->pkt: struct ncacn_packet
>Â Â Â Â Â Â Â  rpc_versÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x05 (5)
>Â Â Â Â Â Â Â  rpc_vers_minorÂ Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  ptypeÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : DCERPC_PKT_RESPONSE (2)
>Â Â Â Â Â Â Â  pfc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x03 (3)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_FIRST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: DCERPC_PFC_FLAG_LAST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_CONC_MPX
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_MAYBE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: DCERPC_PFC_FLAG_OBJECT_UUID
>Â Â Â Â Â Â Â  drep: ARRAY(4)
>Â Â Â Â Â Â Â Â Â Â Â  [0]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x10 (16)
>Â Â Â Â Â Â Â Â Â Â Â  [1]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [2]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  [3]Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â  frag_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0030 (48)
>Â Â Â Â Â Â Â  auth_lengthÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â  call_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000000f (15)
>Â Â Â Â Â Â Â  uÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : union dcerpc_payload(case 2)
>Â Â Â Â Â Â Â  response: struct dcerpc_response
>Â Â Â Â Â Â Â Â Â Â Â  alloc_hintÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000018 (24)
>Â Â Â Â Â Â Â Â Â Â Â  context_idÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x0000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  cancel_countÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  reservedÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  stub_and_verifierÂ Â Â Â Â Â Â  : DATA_BLOB length=24
>[0000] 00 00 00 00 00 00 00 00Â Â  00 00 00 00 00 00 00 00Â Â  ........ ........
>[0010] 00 00 00 00 00 00 00 00Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  ........
>Got pdu len 48, data_len 24
>rpc_api_pipe_got_pdu: got frag len of 48 at offset 0: NT_STATUS_OK
>rpc_api_pipe: host WIN-841PV4HEK0O.dc2022.test returned 24 bytes.
>Â Â Â Â  samr_Close: struct samr_Close
>Â Â Â Â Â Â Â  out: struct samr_Close
>Â Â Â Â Â Â Â Â Â Â Â  handleÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle: struct policy_handle
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  handle_typeÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  uuidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 00000000-0000-0000-0000-000000000000
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NT_STATUS_OK
>signed SMB2 message (sign_algo_id=2)
>signed SMB2 message (sign_algo_id=2)
>libnet_Join:
>Â Â Â  libnet_JoinCtx: struct libnet_JoinCtx
>Â Â Â Â Â Â Â  out: struct libnet_JoinCtx
>Â Â Â Â Â Â Â Â Â Â Â  odj_provision_dataÂ Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  account_nameÂ Â Â Â Â Â Â Â Â Â Â Â  : 'OAK-VCS1307$'
>Â Â Â Â Â Â Â Â Â Â Â  netbios_domain_nameÂ Â Â Â Â  : 'DC2022'
>Â Â Â Â Â Â Â Â Â Â Â  dns_domain_nameÂ Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â Â Â Â Â  forest_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â Â Â Â Â  dnÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  domain_guidÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 15a99073-0553-41da-9071-ff8270e0cf35
>Â Â Â Â Â Â Â Â Â Â Â  domain_sidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_sidÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : S-1-5-21-2898537216-3988932908-2706489507
>Â Â Â Â Â Â Â Â Â Â Â  modified_configÂ Â Â Â Â Â Â Â Â  : 0x00 (0)
>Â Â Â Â Â Â Â Â Â Â Â  error_stringÂ Â Â Â Â Â Â Â Â Â Â Â  : 'Failed to set machine spn: Time limit exceeded
>Do you have sufficient permissions to create machine accounts?'
>Â Â Â Â Â Â Â Â Â Â Â  domain_is_adÂ Â Â Â Â Â Â Â Â Â Â Â  : 0x01 (1)
>Â Â Â Â Â Â Â Â Â Â Â  set_encryption_typesÂ Â Â Â  : 0x00000000 (0)
>Â Â Â Â Â Â Â Â Â Â Â  krb5_saltÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : NULL
>Â Â Â Â Â Â Â Â Â Â Â  dcinfoÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dcinfo: struct netr_DsRGetDCNameInfo
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dc_uncÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dc_uncÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : '\\WIN-841PV4HEK0O.dc2022.test'
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dc_addressÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dc_addressÂ Â Â Â Â Â Â Â Â Â Â Â Â Â  : '\\10.5.139.71'
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dc_address_typeÂ Â Â Â Â Â Â Â Â  : DS_ADDRESS_TYPE_INET (1)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_guidÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 15a99073-0553-41da-9071-ff8270e0cf35
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  domain_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  forest_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  forest_nameÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 'dc2022.test'
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dc_flagsÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : 0xe007f3fd (3758617597)
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_PDC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_GC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_LDAP
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_KDC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_TIMESERV
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_CLOSEST
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_WRITABLE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_GOOD_TIMESERV
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_NDNC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  0: NBT_SERVER_SELECT_SECRET_DOMAIN_6
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_FULL_SECRET_DOMAIN_6
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_ADS_WEB_SERVICE
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS_8
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS_9
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_DS_10
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_HAS_DNS_NAME
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_IS_DEFAULT_NC
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  1: NBT_SERVER_FOREST_ROOT
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dc_site_nameÂ Â Â Â Â Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  dc_site_nameÂ Â Â Â Â Â Â Â Â Â Â Â  : 'Default-First-Site-Name'
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  client_site_nameÂ Â Â Â Â Â Â Â  : *
>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  client_site_nameÂ Â Â Â Â Â Â Â  : 'Default-First-Site-Name'
>Â Â Â Â Â Â Â Â Â Â Â  account_ridÂ Â Â Â Â Â Â Â Â Â Â Â Â  : 0x00000459 (1113)
>Â Â Â Â Â Â Â Â Â Â Â  resultÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  : WERR_GEN_FAILURE
>Failed to join domain: Failed to set machine spn: Time limit exceeded
>Do you have sufficient permissions to create machine accounts?
>return code = -1
>msg_dgm_ref_destructor: refs=(nil)
>root@oak-vcs1307:~# cat /etc/samba/smb.conf
>Â Â  workgroup = DC2022
>Â Â  realm = DC2022.TEST
>Â Â  security = ads
>Â Â  idmap config * : backend = tdb
>Â Â  idmap config * : range = 3000-7999
>Â Â  idmap config DC2022 : backend = rid
>Â Â  idmap config DC2022 : range = 10000-999999
>Â Â  template homedir = /home/%U
>Â Â  template shell = /bin/bash
>Â Â  winbind use default domain = true
>Â Â  winbind offline logon = false
>root@oak-vcs1307:~#
>root@oak-vcs1307:~# net ads info
>LDAP server: 10.5.139.71
>LDAP server name: WIN-841PV4HEK0O.dc2022.test
>Realm: DC2022.TEST
>Bind Path: dc=DC2022,dc=TEST
>LDAP port: 389
>Server time: Fri, 13 Oct 2023 06:30:32 UTC
>KDC server: 10.5.139.71
>Server time offset: 6
>Last machine account password change: Thu, 01 Jan 1970 00:00:00 UTC
>root@oak-vcs1307:~# 
>root@oak-vcs1307:~# net ads lookup
>Information for Domain Controller: 10.5.139.71
>Â 
>Response Type: LOGON_SAM_LOGON_RESPONSE_EX
>GUID: 15a99073-0553-41da-9071-ff8270e0cf35
>Flags:
>Â Â Â Â Â Â Â Â Â Â Â  Is a PDC:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Is a GC of the forest:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Is an LDAP server:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Supports DS:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Is running a KDC:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Is running time services:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Is the closest DC:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Is writable:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Has a hardware clock:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Is a non-domain NC serviced by LDAP server: no
>Â Â Â Â Â Â Â Â Â Â Â  Is NT6 DC that has some secrets:Â Â Â Â Â Â Â Â Â Â Â  no
>Â Â Â Â Â Â Â Â Â Â Â  Is NT6 DC that has all secrets:Â Â Â Â Â Â Â Â  Â Â Â Â yes
>Â Â Â Â Â Â Â Â Â Â Â  Runs Active Directory Web Services:Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Runs on Windows 2012 or later:Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Runs on Windows 2012R2 or later:Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Runs on Windows 2016 or later:Â Â Â Â Â Â Â Â Â Â Â Â Â  yes
>Â Â Â Â Â Â Â Â Â Â Â  Has a DNS name:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  no
>Â Â Â Â Â Â Â Â Â Â Â  Is a default NC:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  no
>Â Â Â Â Â Â Â Â Â Â Â  Is the forest root:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  no
>Forest: dc2022.test
>Domain: dc2022.test
>Domain Controller: WIN-841PV4HEK0O.dc2022.test
>Pre-Win2k Domain: DC2022
>Pre-Win2k Hostname: WIN-841PV4HEK0O
>Server Site Name: Default-First-Site-Name
>Client Site Name: Default-First-Site-Name
>NT Version: 5
>LMNT Token: ffff
>LM20 Token: ffff
>root@oak-vcs1307:~#
>Â

Actions: View

Attachments on bug 15495: 18157 | 18162 | 18163 | 18164